SoK: "Plug & Pray" Today – Understanding USB Insecurity in Versions 1 Through C

Abstract

USB-based attacks have increased in complexity in recent years. Modern attacks now incorporate a wide range of attack vectors, from social engineering to signal injection. To address these challenges, the security community has responded with a growing set of fragmented defenses. In this work, we survey and categorize USB attacks and defenses, unifying observations from both peer-reviewed research and industry. Our systematization extracts offensive and defensive primitives that operate across layers of communication within the USB ecosystem. Based on our taxonomy, we discover that USB attacks often abuse the trust-by-default nature of the ecosystem, and transcend different layers within a software stack; none of the existing defenses provide a complete solution, and solutions expanding multiple layers are most effective. We then develop the first formal verification of the recently released USB Type-C Authentication specification, and uncover fundamental flaws in the specification's design. Based on the findings from our systematization, we observe that while the spec has successfully pinpointed an urgent need to solve the USB security problem, its flaws render these goals unattainable. We conclude by outlining future research directions to ensure a safer computing experience with USB.

Distributed Architecture to Enhance Systems Protection against Unauthorized Activity via USB Devices

“…The USB is a communication standard [11], commonly used for connecting peripherals to computers. Introduced in the 1990s, the USB interface and protocol increased in popularity because it facilitated communication between peripherals and hosts [12]. However, according to [13], one of the major weaknesses of the USB protocol is its flexibility, and potential threats increase if the device is connected to other devices, networks or the Internet [14].…”

BadBluetooth: Breaking Android Security Mechanisms via Malicious Bluetooth Peripherals

“…Also, Angel et al [20] proposed a virtualization-based solution, which attaches peripheral devices to a logically separate, untrusted machine. Recently, Tian et al [46] carried out a comprehensive survey on the research in USB security. The study suggests most of the USB attacks abuse the trust-by-default nature of the USB ecosystem and only a comprehensive defense solution expanding multiple layers would success in practice.…”

Salaxy: Enabling USB Debugging Mode Automatically to Control Android Devices

“…Tian et al [29] surveyed and categorized USB host-related attacks. On their basis, Opasiak et al [30] considered a broader spectrum of the USB-related attacks and evaluated the security of the Secure USB debugging from the USB connectivity perspective.…”