2024-12-02T22:37:38Z

TLee: /* Categorization based on Attack Characteristics */

== Summary ==

Since the upcoming of USB in 1995 <ref>{{cite web |url=https://spectrum.ieee.org/how-usb-came-to-be |title=How USB Came to Be Intel’s 26-year-old plug-and-play tech made it easy to connect everything v2.0 |date=Februar 22, 2022 |publisher=IEEE Spektrum |access-date=22 September 2023}}</ref>, attackers have used USB peripherals to launch a variety of cyber-attacks, exploiting the vulnerabilities and properties of these devices [NYE17]. This article provides an overview of how the variety of existing USB attacks can be categorized through the USB attack taxonomy.

== Goal of an USB Attack Taxonomy ==

Though there are plenty of publications, including threat models and analysis, attacks taxonomy hasn’t been much of a goal of investigations. Many of those investigations refer to cyber-attacks in whole, whereas USB-based attacks remain unreviewed. Providing a comprehensive classification in regard to USB attacks allows to assess the qualification and equipment level of the adversary or group of adversaries, predict potential consequences, estimate possible attack vectors and even identify adversary’s probable affiliation with a specific group/groups according to attack aspects. Furthermore it can be useful in developing appropriate security mechanisms - both prevention and detection - against these attacks[MS19, NYE17].

== Categorization based on the hardware required ==

2017 Nissim et.al. reviewed 29 different USB-based attacks and utilized a new taxonomy to classify them into four major categories. For each attack, the objective it achieves was addressed and the associated and vulnerable USB peripherals and hardware identified [NYE17]. In Fig. 1 and 2 the authors presented a taxonomy based on the USB hardware required for executing the attacks.

[[File:Nissim_4categories.jpg|thumb|Fig.1: A taxonomy of USB-based attacks, categorized based on the hardware
required to execute the attacks]]

Fig. 1 presents three major categories:

A. programmable microcontrollers<br />
B. the common USB peripheral devices that can be found in most organizations and households<br />
B1. devices whose firmware was maliciously modified in order to perform the attack<br />
B2. devices that do not require firmware modification<br />
C. crafted devices composed only from electrical hardware components

The following lists the attacks covered by Nissim et.al.’s survey, their year of publication and relevance to the categories and taxonomy presented in Fig.1:

A. Programmable microcontrollers:
# Rubber Ducky - 2010
# PHUKD/URFUKED - 2010
# USBdriveby - 2014
# Evilduino - 2014
# Unintended USB channels - 2011
# TURNIPSCHOOL (COTTONMOUTH-1) - 2015
# RIT attack via USB mass storage - 2012
# Attackson wireless USB dongles - 2015
# Default gateway override - 2014
B1. Devices whose firmware was maliciously modified in order to perform the attack:
# Smartphone based HID attacks - 2010
# DNS override by modified USB firmware - 2014
# Keyboard emulation by modified USB firmware - 2014
# Hidden partition patch - 2014
# Password protection bypass patch - 2014
# Virtual machine break-out -2014
# Bootsectorvirus - 2014
# iSeeYou: Disabling the MacBook webcam indicator LED - 2014
B2. Devices that do not require firmware modification:
# .LNK Stuxnet/Fanny USB flash drive exploit (Shell extension exploits) - 2010
# USB Backdoor into air-gapped hosts - 2014
# Data hiding on USB mass storage - 2010
# Autorun exploits - 2005
# Cold boot - 2008
# Buffer overflow - 2005
# Driver update - 2011
# Device firmware upgrade (DFU) - 2014
# USB Thief - 2016
# Attacks on smartphones via the USB port - 2010
# USBee attack - 2016
C. Crafted devices composed only from electrical hardware components:
# USB Killer

Furtheron, the attacks were summerzied in a table, weather each was associated to:
* "USB Peripheral (keyboard, mouse, storage, smartphone, speaker, camera)", were some devices underwent malicious firmware modification, and/or
* "Persona of USB Connected Microcontroller (keyboard, mouse, storage, smartphone, speaker, network adapter, cable)", refering to the type of device emulated by a USB connected programmable microcontroller, often disguised by an external casing of an innocuous USB device

The table made visible, that the peripheral by which more than 51% of the 29 attacks can be carried out is the USB storage device, followed by the keyboard device and microcontrollers that impersonate a keyboard.

== Categorization based on Attack Characteristics ==

2019 Mamchenko and Sabanov collected already existing taxonomy, based on general cyberthreat models, some of them including USB, see Fig.3.
[[File:Machenko.jpg|500px|thumb|center|Fig.3: Analyzed cyberattacks and USB-based attacks taxonomies by Mamchenko and Sabanov (2019)]]

Based on their collection shown in the picture, they created a more complete, enhanced taxonomy. Other than the taxonomy in Nissim et.al., each category reflects one way of categorizing a certain attack within that given category:<br />
Attack:
<div style="columns: 4;>
# Source of Threat
## outsider threats;
## insider threats.
# Level of Complexity
## no special training required;
## of intermediate complexity;
## complex.
# Level of Secrecy
## very hard to be detected;
## covert;
## not-to-be-hidden.
# Attack Mechanism
## code injection;
## data extraction;
## protocol masquerading;
## protocol corruption
## signal eavesdropping;
## signal injection.
# Object of Impact
## operation systems and system software/drivers;
## servers;
## hardware;
## applications;
## mobile technology devices;
## user data;
## networks.
# Adversary Intensions
## to steal data;
## to modify data;
## to delete information;
## to destroy hardware;
## to gain access to system resources;
## to cause malfunctions/DOS.
# Impact Layer
## human;
## application;
## transport;
## physical.
# Assets
## programmable microcontrollers;
## maliciously reprogrammed peripherals;
## not re-programmed peripherals;
## electrical devices;
## special hardware;
## malicious programs.
# Actions
## probe;
## scan;
## flood;
## authenticate;
## bypass;
## spoof;
## read;
## copy;
## steal;
## modfy;
## delete;
## destroy hardware;
## eavesdrop;
## cause malfunction/DOS.
#Severity of Consequences
## disastrous effects;
## severe;
## intermedeate severity;
## irresponsible.
# Type of Damage from Attack
## physical;
## psychological;
## economic;
## political;
## reputational.
</div>

== Further Reading ==

* Chengzhi Sun, Jiyu Lu, and Yunqing Liu. Analysis and prevention of information security of usb. In 2021 International Conference on Electronic Information Engineering and Computer Science (EIECS), pages 25–32, 2021.
* Jianming Fu, Jianwei Huang, and Lanxin Zhang. Curtain: Keep your hosts away from usb attacks. In Phong Q. Nguyen and Jianying Zhou, editors, Information Security, pages 455–471, Cham, 2017. Springer International Publishing.
* Mark Mamchenko and Alexey Sabanov. Exploring the taxonomy of usb-based attacks. In 2019 Twelfth International Conference ”Management of large-scale system development” (MLSD), pages 1–4, 2019.
* Nir Nissim, Ran Yahalom, and Yuval Elovici. Usb-based attacks. Computers & Security, 70:675–688, 2017.

== References ==
{{Reflist}}

[[Category:Documentation]]