SandUSB: An Installation-Free and User-Controllable Sandbox For USB Peripherals
Date Issued
2016
Date
2016
Author(s)
Loe, Edwin Lupito
Abstract
This thesis investigates two emerging attacks—HID attack and Juice Jacking attack—that leverage USB peripherals, and proposes countermeasures to defend against them.These attacks can be easily reproduced using low-cost prototyping boards (e.g., Raspberry Pi) and can bypass commercial antivirus tools, as confirmed by our study. Although several research prototypes can effectively mitigate Juice Jacking and HID attacks, these prototypes suffer from two limitations: 1) they require installation on host computers, which is inconvenient and users may lack the permission to install software; 2) they assume a public key infrastructure for authentication, but such cryptographic operations may not be supported by legacy USB peripherals and hosts. To address these limitations, this thesis presents the design and implementation of SandUSB, an installation-free and user-controllable security gadget for USB peripherals. Since SandUSB acts as an intermediary between the USB host and device, it can perform efficient scanning and analysis without changing USB devices or hosts. In addition, SandUSB provides users with a simple GUI to control and monitor connected USB devices, thereby empowering users to identify malicious peripherals that masquerade as another type. This is complementary to the automatic defensive measures programmed inside SandUSB, and can improve user awareness of the connected USB peripherals. Our evaluation demonstrates that SandUSB can effectively defend against various USB attacks, including HID and Juice Jacking attacks. SandUSB is implemented using affordable and easy-to-access hardware. We hope this study can raise user awareness of possible threats that leverage USBs.
Subjects
USB Security
HID Attack
Embedded Device
Sandbox
SDGs
Type
thesis
File(s)![Thumbnail Image]()
Loading...
Name
ntu-105-R03944043-1.pdf
Size
23.32 KB
Format
Adobe PDF
Checksum
(MD5):cc6ef2c3e1f595f3902ba98f0a6b9192