USB Attack Taxonomy

Summary

Since the upcoming of USB in 1995 , attackers have used USB peripherals to launch a variety of cyber-attacks, exploiting the vulnerabilities and properties of these devices [NYE17]. This article provides an overview of how the variety of existing USB attacks can be categorized through the USB attack taxonomy.

Goal of an USB Attack Taxonomy

Though there are plenty of publications, including threat models and analysis, attacks taxonomy hasn’t been much of a goal of investigations. Many of those investigations refer to cyber-attacks in whole, whereas USB-based attacks remain unreviewed. Providing a comprehensive classification in regard to USB attacks allows to assess the qualification and equipment level of the adversary or group of adversaries, predict potential consequences, estimate possible attack vectors and even identify adversary’s probable affiliation with a specific group/groups according to attack aspects. Furthermore it can be useful in developing appropriate security mechanisms - both prevention and detection - against these attacks[MS19, NYE17].

Categorization based on hardware required

2017 Nissim et.al. reviewed 29 different USB-based attacks and utilized a new taxonomy to classify them into four major categories. For each attack, the objective it achieves was addressed and the associated and vulnerable USB peripherals and hardware identified [NYE17]. In Fig. 2.1 and 2.2 the authors presented a taxonomy based on the USB hardware required for executing the attacks.

Three major categories were presented:

A. programmable microcontrollers (red) B. the common USB peripheral devices that can be found in most organizations and households (orange and blue) B1. devices whose firmware was maliciously modified in order to perform the attack (orange) B2. devices that do not require firmware modification (blue) C. crafted devices composed only from electrical hardware components (purple)

In Fig. 2.2 lists the 29 USB attacks covered by the survey, classified according to Fig. 2.1. In Fig. 2.3, column 1 lists the 29 surveyed attacks. Columns 2–6 refer to common USB devices that are associated with each attack. For some of the attacks, the devices must undergo malicious firmware modification. Columns 7–13 refer to the type of device emulated by a USB connected programmable microcontroller, often disguised by an external casing of an innocuous USB device. Summerizing these attacks into a table in Fig. 2.3 made it visible, that the peripheral by which more than 51% of the 29 attacks can be carried out is the USB storage device (i.e., USB flash drive), followed by the keyboard device and microcontrollers that impersonate a keyboard.

Step 2

In a third approach, Fu, Huang and Zhang considers the USB stack - Application Layer, Driver Layer, Port Layer (Interface Layer) and Device Layer - as a set of mutually dependent and hierarchical layers. In this case USB attacks are regarded as a method to break the layers integrity and interrupt the cross-layer functioning [FHZ17].

Used Hardware

2019 Mamchenko and Sabanov collected already existing taxonomy, see Fig. 2.4, and created a more complete, enhanced taxonomy in Fig. 2.5. Other than the taxonomy in Nissim [NYE17], each category reflects one way of categorizing a certain attack within that category.

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

Further Reading

• Chengzhi Sun, Jiyu Lu, and Yunqing Liu. Analysis and prevention of information security of usb. In 2021 International Conference on Electronic Information Engineering and Computer Science (EIECS), pages 25–32, 2021.
• Jianming Fu, Jianwei Huang, and Lanxin Zhang. Curtain: Keep your hosts away from usb attacks. In Phong Q. Nguyen and Jianying Zhou, editors, Information Security, pages 455–471, Cham, 2017. Springer International Publishing.
• Mark Mamchenko and Alexey Sabanov. Exploring the taxonomy of usb-based attacks. In 2019 Twelfth International Conference ”Management of large-scale system development” (MLSD), pages 1–4, 2019.
• Nir Nissim, Ran Yahalom, and Yuval Elovici. Usb-based attacks. Computers & Security, 70:675–688, 2017.