USB attacks explained

Introduction
On a very high level, USB is a communication protocol which allows to provide and use some abstract services (functionalities). Machine which provides some additional functionality is called a USB device and machine which uses this functionality is called a USB host. Typically USB host is a computer, DVD player etc. and USB device is a pendrive, web camera or sound card but it can also be a mobile phone or tablet!
One of very famous USB features is Plug&Play. It means that USB host is able to automatically detect new USB devices and discover functionalities offered by them. Together with automatic support provided by most of host operating systems it makes USB very user-friendly and easy to use. Unfortunately, the same automation may lead to new security threats. . .

USB attacks
Popularity and blind trust in USB security seem to be one of the major reasons why malware started spreading also using this attack vector. From the security perspective we can distinguish three types of attacks toward USB based on their main target:
• USB host focused attacks,
• USB traffic analysis, modification and injection attacks,
• USB device focused attacks.

USB host focused attacks
This type of attacks aims at taking over the control of the USB host machine.
We can distinguish three subgroups of such attacks.
The first group of such attacks uses vulnerabilities in the high level system infrastructure related to support of given USB function. Very good examples of such attacks are Conficker ¹ and Stuxnet ², which used the vulnerabilities in external storage support.
The second group of USB host focused attacks tries to exploit vulnerabilities in USB stack and drivers implementation. This is mainly done by creating malicious devices which sends specially prepared payload to exploit some buffer overflow or other vulnerability. Very good repentant of such attacks is Plug & Root device presented during BlackHat Conference in Las Vegas back in 2005 ³.
Thanks to dedicated fuzzers like facedancer ⁴ and umap ⁵ and increasing developers’ awareness USB stacks (esp. Linux stack) are getting more and more resistant to this group of attacks.
Finally, the third group of attacks abuses Plug & Play philosophy and blind user trust in harmlessness of USB devices. This group of attacks became famous in 2014 thanks to BlackHat USA presentation – BadUSB ⁶. This attack simply tries to trick user to connect device which offers different functionality than user may assume based on its physical outfit.

USB traffic analysis, modification and injection attacks
This type of attacks usually aims at discovering some secret information like passwords or at modification of USB traffic to abuse functionality expected by user.
First group of those attacks are passive listeners usually recording HID protocol which is used by for example keyboards. Those devices are relatively cheap and are being found from time to time in public places like libraries ⁷ or schools ⁸.
Second group involves not only listening but also modification of USB traffic and injection of additional messages. Recent example of such attacks may be BadUSB 2.0 introduced by David Kierznowski and described in ⁹.

USB device focused attacks
Third type of attacks is targeted at USB devices. Usually not those simple tiny device lie pendrive because people try to keep them safe but rather those more complicated like mobile phones and tablets. All those devices carry a lot of sensitive user data which can be accessed via USB. It’s worth to mention that the same USB port is often used for both data transfer and battery charging. Short battery life encourages user to connect mobile device to publicly available charging stations.
This leads to hazard of unauthorized access to private data like photos or contacts. More advanced attackers may event try to take over the control of device using for example ADB resource exhaustion attack ¹⁰.

Summary
USB is a extremely popular external interface. It has been adopted to various use case and incorporated by most devices on the market. Through being extremely usefully, USB should be also considered as a real security thread especially in high security environments.

References
¹ M.Hypponen, “The conficker mystery,” in Black Hat, Las Vegas, NV, USA, July 2009. [Online]. Available: http://www.blackhat.com/presentations/bh-usa-09/HYPPONEN/BHUSA09-Hypponen-ConfickerMystery-PAPER.pdf

² L. O. M. Nicolas Falliere and E. Chien, “W32.stuxnet dossier,” Feb. 2011. [Online]. Available: https://www.symantec.com/content/en/us/enterprise/media/security response/whitepapers/w32 stuxnet dossier.pdf

³ D. Barral and D. Dewey, “”plug and root,” the usb key to the kingdom,” in Black Hat, Las Vegas, NV, USA, July 2005. [Online]. Available: https://www.blackhat.com/presentations/bh-usa-05/BH US 05-Barrall-Dewey.pdf

⁴ “Facedancer21 (usb emulator/usb fuzzer).” [Online]. Available: https://int3.cc/products/facedancer21

⁵ “umap: The usb host security assessment tool.” [Online]. Available:
https://github.com/nccgroup/umap

⁶ S. K. Karsten Nohl and J. Lell, “Badusb – on accessories that turn evil,” in Black Hat, Las Vegas, NV, USA, July 2014. [Online]. Available: https://srlabs.de/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1.pdf

⁷ “Hardware keyloggers discovered at public libraries.” [Online].
Available: https://nakedsecurity.sophos.com/2011/02/14/hardware-keyloggers-discovered-public-libraries/

⁸ “Us school expels pupils for using hardware keyloggers to change grades,”
Feb. 2004. [Online]. Available: http://www.techworld.com/news/security/us-school-expels-pupils-for-using-hardware-keyloggers-change-grades-3500558/

⁹ D. Kierznowski, “BadUSB 2.0: USB man in the middle attacks,” Royal
Holloway University of London, Tech. Rep., 04 2016.

¹⁰ T. Vidas, D. Votipka, and N. Christin, “All your droid are belong to
us: A survey of current android attacks,” in Proceedings of the 5th
USENIX Conference on Offensive Technologies, ser. WOOT ́11. Berkeley,
CA, USA: USENIX Association, 2011, pp. 10–10. [Online]. Available:
http://dl.acm.org/citation.cfm?id=2028052.2028062