USB Attack Taxonomy

Introduction

Since the upcoming of USB in 1995 , attackers have used USB peripherals to launch a variety of cyber-attacks, exploiting the vulnerabilities and properties of these devices . This article provides an overview of how the variety of existing USB attacks can be categorized by the USB attack taxonomy. For indepth details, please refer to the respective work. The graphics are a reconstruction of the original graphics in the respective papers.

Goal of an USB Attack Taxonomy

Though there are plenty of publications including threat models and analysis, attacks taxonomy hasn’t been much of a goal of investigations. Many of those investigations refer to cyber-attacks in whole, whereas USB-based attacks remain unreviewed. Providing a comprehensive classification in regard to USB attacks allows to assess the qualification and equipment level of the adversary or group of adversaries, predict potential consequences, estimate possible attack vectors and even identify adversary’s probable affiliation with a specific group/groups according to attack aspects. Furthermore it can be useful in developing appropriate security mechanisms - both prevention and detection - against these attacks

</references>

Further Reading

• Chengzhi Sun, Jiyu Lu, and Yunqing Liu. Analysis and prevention of information security of usb. In 2021 International Conference on Electronic Information Engineering and Computer Science (EIECS), pages 25–32, 2021.
• Jianming Fu, Jianwei Huang, and Lanxin Zhang. Curtain: Keep your hosts away from usb attacks. In Phong Q. Nguyen and Jianying Zhou, editors, Information Security, pages 455–471, Cham, 2017. Springer International Publishing.
• Mark Mamchenko and Alexey Sabanov. Exploring the taxonomy of usb-based attacks. In 2019 Twelfth International Conference ”Management of large-scale system development” (MLSD), pages 1–4, 2019.
• Nir Nissim, Ran Yahalom, and Yuval Elovici. Usb-based attacks. Computers & Security, 70:675–688, 2017.