Plug and Power: Fingerprinting USB Powered Peripherals via Power Side-channel

Abstract

The literature and the news regularly report cases of exploiting Universal Serial Bus (USB) devices as attack tools for malware injections and private data exfiltration. To protect against such attacks, security researchers proposed different solutions to verify the identity of a USB device via sidechannel information (e.g., timing or electromagnetic emission). However, such solutions often make strong assumptions on the measurement (e.g., electromagnetic interference-free area around the device), on a device's state (e.g., only at the boot or during specific actions), or are limited to one particular type of USB device (e.g., flash drive or input devices).In this paper, we present PowerID, a novel method to fingerprint USB peripherals based on their power consumption. PowerID analyzes the power traces from a peripheral to infer its identity and properties. We evaluate the effectiveness of our method on an extensive power trace dataset collected from 82 USB peripherals, including 35 models and 8 types. Our experimental results show that PowerID accurately recognizes a peripheral type, model, activity, and identity.

To (US)Be or Not to (US)Be: Discovering Malicious USB Peripherals through Neural Network-Driven Power Analysis

“…We demonstrate that contrary to popular belief [11], the discriminative CNN-LSTM model can be trained fast with only a handful of signals and still provide perfect scores (F1 score, precision, and recall).…”

“…The evaluation in [11] indicates that shallow ML approaches can provide near-perfect accuracy for the tasks of both identification and authentication. Let us underline that the devices (and therefore the signals) considered in that work were different.…”

“…A side channel analysis involves the study of the unintended leakage of a system's physical characteristics. The physical characteristics are often in the form of electromagnetic emissions [39,40], electrical power [11], timing [41], sounds [42], and temperature [43]. The analysis can either be offensive or defensive.…”

“…The following ML classifiers from the scikit-learn Python library were used in the experiments: Random Forest, Decision Tree, K-Nearest Neighbors (KNNs), Support Vector Machine (SVM), and Gradient Boosting. The choice to compare against these approaches was made in an effort to provide a close comparison against the results presented in [11], which also considers shallow ML approaches exclusively. Both DNN models were implemented in Pytorch and trained using the PyTorch Lightning framework with early stopping based on the validation monitor_metric, e.g., validation loss.…”

“…In the first experiment, raw signals were fed directly to the alternative discriminative models. In the second, features were extracted via TsFresh in a way similar to [11]. The method yielded a total of 777 features.…”