SoK: "Plug & Pray" Today – Understanding USB Insecurity in Versions 1 Through C
SoK: "Plug & Pray" Today – Understanding USB Insecurity in Versions 1 Through C
复制标题
DOI：
10.1109/sp.2018.00037
复制
发表时间：
2018-05
期刊：
影响因子：
--
通讯作者：
Jing Tian;Nolen Scaife;Deepak Kumar;Michael Bailey;Adam Bates;Kevin R. B. Butler
中科院分区：
文献类型：
--
作者：
Jing Tian;Nolen Scaife;Deepak Kumar;Michael Bailey;Adam Bates;Kevin R. B. Butler
近年来，基于USB的攻击的复杂性有所增加。现代攻击现在包含了广泛的攻击载体，从社会工程到信号注入。为了应对这些挑战，安全社区已经通过越来越多的分散防御来应对。在这项工作中，我们对USB攻击和防御进行了调查和分类，统一了来自同行评审研究和行业的观察结果。我们的系统化提取了USB生态系统中跨通信层操作的攻击和防御原语。基于我们的分类，我们发现USB攻击经常滥用生态系统的默认信任性质，并超越软件堆栈中的不同层;现有的防御措施都不能提供完整的解决方案，扩展多个层的解决方案是最有效的。然后，我们对最近发布的USB Type-C认证规范进行了首次正式验证，并发现了该规范设计中的根本缺陷。根据我们系统化的发现，我们观察到，虽然规范成功地指出了解决USB安全问题的迫切需要，但它的缺陷使这些目标无法实现。最后，我们概述了未来的研究方向，以确保更安全的USB计算体验。
USB-based attacks have increased in complexity in recent years. Modern attacks now incorporate a wide range of attack vectors, from social engineering to signal injection. To address these challenges, the security community has responded with a growing set of fragmented defenses. In this work, we survey and categorize USB attacks and defenses, unifying observations from both peer-reviewed research and industry. Our systematization extracts offensive and defensive primitives that operate across layers of communication within the USB ecosystem. Based on our taxonomy, we discover that USB attacks often abuse the trust-by-default nature of the ecosystem, and transcend different layers within a software stack; none of the existing defenses provide a complete solution, and solutions expanding multiple layers are most effective. We then develop the first formal verification of the recently released USB Type-C Authentication specification, and uncover fundamental flaws in the specification's design. Based on the findings from our systematization, we observe that while the spec has successfully pinpointed an urgent need to solve the USB security problem, its flaws render these goals unattainable. We conclude by outlining future research directions to ensure a safer computing experience with USB.