Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

USBSnoop -- Revealing Device Activities via USB Congestions

Davis Ranney, Yufei Wang, A. Adam Ding, Yunsi Fei

TL;DR

The paper identifies a novel congestion-based side-channel on USB hubs that leaks sensitive information by observing bus contention. It adapts the PCIe Invisible Probe methodology to USB, demonstrating keystroke recovery and website fingerprinting via hub-level timing. Using Hidden Markov Models and BiLSTM classifiers, it achieves non-trivial accuracy across USB2.0, USB3.x, and USB-C configurations, indicating practical risk for real-world users. The work emphasizes the need for new security measures, including hardware partitioning, traffic-arbitration changes, and potential USB-IF guidance, to mitigate these risks and suggests exploring USB in broader hardware and wireless contexts.

Abstract

The USB protocol has become a ubiquitous standard for connecting peripherals to computers, making its security a critical concern. A recent research study demonstrated the potential to exploit weaknesses in well-established protocols, such as PCIe, and created a side-channel for leaking sensitive information by leveraging congestion within shared interfaces. Drawing inspiration from that, this project introduces an innovative approach to USB side-channel attacks via congestion. We evaluated the susceptibility of USB devices and hubs to remote profiling and side-channel attacks, identified potential weaknesses within the USB standard, and highlighted the critical need for heightened security and privacy in USB technology. Our findings discover vulnerabilities within the USB standard, which are difficult to effectively mitigate and underscore the need for enhanced security measures to protect user privacy in an era increasingly dependent on USB-connected devices.

USBSnoop -- Revealing Device Activities via USB Congestions

TL;DR

The paper identifies a novel congestion-based side-channel on USB hubs that leaks sensitive information by observing bus contention. It adapts the PCIe Invisible Probe methodology to USB, demonstrating keystroke recovery and website fingerprinting via hub-level timing. Using Hidden Markov Models and BiLSTM classifiers, it achieves non-trivial accuracy across USB2.0, USB3.x, and USB-C configurations, indicating practical risk for real-world users. The work emphasizes the need for new security measures, including hardware partitioning, traffic-arbitration changes, and potential USB-IF guidance, to mitigate these risks and suggests exploring USB in broader hardware and wireless contexts.

Abstract

The USB protocol has become a ubiquitous standard for connecting peripherals to computers, making its security a critical concern. A recent research study demonstrated the potential to exploit weaknesses in well-established protocols, such as PCIe, and created a side-channel for leaking sensitive information by leveraging congestion within shared interfaces. Drawing inspiration from that, this project introduces an innovative approach to USB side-channel attacks via congestion. We evaluated the susceptibility of USB devices and hubs to remote profiling and side-channel attacks, identified potential weaknesses within the USB standard, and highlighted the critical need for heightened security and privacy in USB technology. Our findings discover vulnerabilities within the USB standard, which are difficult to effectively mitigate and underscore the need for enhanced security measures to protect user privacy in an era increasingly dependent on USB-connected devices.

Paper Structure

This paper contains 24 sections, 9 figures, 3 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. USB Specification
  4. Invisible Probe: Timing Attacks with PCIe Congestion Side-Channel
  5. Proposed Approach
  6. Motivations
  7. Keystroke Attack Threat Model
  8. Methodology for Recovering Keystroke Data
  9. Website Recovery Attack Threat Model
  10. Methodology for Recovering Web Traffic Information
  11. Experimental Results of Attack 1 - Keystroke Recovery
  12. Keystroke Timing Accuracy
  13. Keystroke Recovery via Timing Information
  14. Experimental Results of Attack 2 - Website Fingerprinting
  15. Resolution of USB Disk/Bulk Transfer Spy
  16. ...and 9 more sections

Figures (9)

  • Figure 1: USB 3.X Hub Logical Architecture, from noauthor_usb_nodate-1
  • Figure 2: Congestion on the shared bus and the side-channel observable by the spy device
  • Figure 3: Collected mouse latency measurements and key presses
  • Figure 4: Cumulative distribution curves for delays between overlapping and distinguished keystrokes
  • Figure 5: Simplified visualization of the HMM. It processes sequential keystroke timings and determines the most likely sequence of pairs/characters matching the observed timing information. Each edge is a probability of transitioning from one state to another.
  • ...and 4 more figures