Abstract:Due to its plug-and-play functionality and wide device support, the universal serial bus (USB) protocol has become one of the most widely used protocols. However, this widespread adoption has introduced a significant security concern: the implicit trust provided to USB devices, which has created a vast array of attack vectors. Malicious USB devices exploit this trust by disguising themselves as benign peripherals and covertly implanting malicious commands into connected host devices. Existing research employs supervised learning models to identify such malicious devices, but our study reveals a weakness in these models when faced with sophisticated data poisoning attacks. We propose, design and implement a sophisticated adversarial data poisoning attack to demonstrate how these models can be manipulated to misclassify an attack device as a benign device. Our method entails generating keystroke data using a microprogrammable keystroke attack device. We develop adversarial attacker by meticulously analyzing the data distribution of data features generated via USB keyboards from benign users. The initial training data is modified by exploiting firmware-level modifications within the attack device. Upon evaluating the models, our findings reveal a significant decrease from 99 to 53% in detection accuracy when an adversarial attacker is employed. This work highlights the critical need to reevaluate the dependability of machine learning-based USB threat detection mechanisms in the face of increasingly sophisticated attack methods. The vulnerabilities demonstrated highlight the importance of developing more robust and resilient detection strategies to protect against the evolution of malicious USB devices.

Defending against malicious peripherals with Cinch

USBIPS Framework: Protecting Hosts from Malicious USB Peripherals

LBM: A Security Framework for Peripherals within the Linux Kernel

Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

Fortress: Securing IoT Peripherals with Trusted Execution Environments

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

USBcat - Towards an Intrusion Surveillance Toolset

When eBPF Meets Machine Learning: On-the-fly OS Kernel Compartmentalization

SeCloak: ARM Trustzone-based Mobile Peripheral Control

IOTLB-SC: An Accelerator-Independent Leakage Source in Modern Cloud Systems

CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks

Practical Control Flow Integrity and Randomization for Binary Executables

Attack and Defence of Malicious USB Device in Highly-Protected Environment

Untrusted Code Compartmentalization for Bare Metal Embedded Devices

Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters

Efficient protection of kernel data structures via object partitioning

Security Protection and Checking in Embedded System Integration Against Buffer Overflow Attacks

Deceiving supervised machine learning models via adversarial data poisoning attacks: a case study with USB keyboards

Croth: Effective Process Protection and Monitoring with Hardware Virtualization

Physical Attack Protection Techniques for IC Chip Level Hardware Security

Preventing Your Faults From Telling Your Secrets: Defenses Against Pigeonhole Attacks