TMSUI: A Trust Management Scheme of USB Storage Devices for Industrial Control Systems

Yang, Bo; Qin, Yu; Zhang, Yingjun; Wang, Weijin; Feng, Dan

doi:10.1007/978-3-319-29814-6_13

Cited by 7 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…USB tools based on cryptographic schemes and hardware security chips aim to authenticate USB peripherals and authorize their usage. The work in [26] developed a Trust Management Scheme, namely TSMUI, for USB storage devices in Industrial Control Systems (ICS) environments. The approach uses a digital signature and a hardware security chip to authenticate USB storage devices and authorize their limited usage in some protected ICS hosts.…”

Section: Usb Defensesmentioning

confidence: 99%

To (US)Be or Not to (US)Be: Discovering Malicious USB Peripherals through Neural Network-Driven Power Analysis

Koffi,

Smiliotopoulos,

Kolias

et al. 2024

Electronics

View full text Add to dashboard Cite

Nowadays, The Universal Serial Bus (USB) is one of the most adopted communication standards. However, the ubiquity of this technology has attracted the interest of attackers. This situation is alarming, considering that the USB protocol has penetrated even into critical infrastructures. Unfortunately, the majority of the contemporary security detection and prevention mechanisms against USB-specific attacks work at the application layer of the USB protocol stack and, therefore, can only provide partial protection, assuming that the host is not itself compromised. Toward this end, we propose a USB authentication system designed to identify (and possibly block) heterogeneous USB-based attacks directly from the physical layer. Empirical observations demonstrate that any extraneous/malicious activity initiated by malicious/compromised USB peripherals tends to consume additional electrical power. Driven by this observation, our proposed solution is based on the analysis of the USB power consumption patterns. Valuable power readings can easily be obtained directly by the power lines of the USB connector with low-cost, off-the-shelf equipment. Our experiments demonstrate the ability to effectively distinguish benign from malicious USB devices, as well as USB peripherals from each other, relying on the power side channel. At the core of our analysis lies an Autoencoder model that handles the feature extraction process; this process is paired with a long short-term memory (LSTM) and a convolutional neural network (CNN) model for detecting malicious peripherals. We meticulously evaluated the effectiveness of our approach and compared its effectiveness against various other shallow machine learning (ML) methods. The results indicate that the proposed scheme can identify USB devices as benign or malicious/counterfeit with a perfect F1-score.

show abstract

Section: Usb Defensesmentioning

confidence: 99%

To (US)Be or Not to (US)Be: Discovering Malicious USB Peripherals through Neural Network-Driven Power Analysis

Koffi,

Smiliotopoulos,

Kolias

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

“…These kiosks are commonly deployed near the entrances of security-sensitive organizations to prevent infected peripherals from entering the facility. The Windows Embedded platform [80], TMSUI [133] and USB Unix Smart Blocker [40] attempt to mediate USB connectivity for Windows CE, Industrial Control and GNU/Linux Systems respectively, but all base their device recognition mechanism on potentially unreliable information reported by the device during enumeration. USBFILTER [116] instruments the upper layers of the USB stack, modifying device drivers in order to identify the processes interactive with the device.…”

Section: B Defense Of Application Layermentioning

confidence: 99%

SoK: "Plug & Pray" Today – Understanding USB Insecurity in Versions 1 Through C

Tian

Scaife

Kumar

et al. 2018

2018 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

USB-based attacks have increased in complexity in recent years. Modern attacks now incorporate a wide range of attack vectors, from social engineering to signal injection. To address these challenges, the security community has responded with a growing set of fragmented defenses. In this work, we survey and categorize USB attacks and defenses, unifying observations from both peer-reviewed research and industry. Our systematization extracts offensive and defensive primitives that operate across layers of communication within the USB ecosystem. Based on our taxonomy, we discover that USB attacks often abuse the trust-by-default nature of the ecosystem, and transcend different layers within a software stack; none of the existing defenses provide a complete solution, and solutions expanding multiple layers are most effective. We then develop the first formal verification of the recently released USB Type-C Authentication specification, and uncover fundamental flaws in the specification's design. Based on the findings from our systematization, we observe that while the spec has successfully pinpointed an urgent need to solve the USB security problem, its flaws render these goals unattainable. We conclude by outlining future research directions to ensure a safer computing experience with USB.

show abstract

“…There have been proposals in the literature for defending against USB-based attacks, especially after the Stuxnet malware, which spread via infected USB drives and penetrated air-gapped systems [10,6]. A first attempt towards more organizational security of USB device security is described in [22]. There, a trust management scheme, namely TMSUI, is proposed.…”

Section: Defenses Against Usb-based Attacksmentioning

confidence: 99%

USBlock: Blocking USB-Based Keypress Injection Attacks

Neuner

Voyiatzis

Fotopoulos

et al. 2018

Data and Applications Security and Privacy XXXII

View full text Add to dashboard Cite

The Universal Serial Bus (USB) is becoming a prevalent attack vector. Rubber Ducky and BadUSB are two recent classes of a whole spectrum of attacks carried out using fully-automated keypress injections through innocent-looking USB devices. So far, defense mechanisms are insufficient and rely on user participation in the trust decision. We propose USBlock, a novel approach to detect suspicious USB devices by analyzing the temporal characteristics of the USB packet traffic they generate, similarly to intrusion detection approaches in networked systems. Our approach is unique in that it does not to involve at all the user in the trust decision. We describe a proof-of-concept implementation for Linux and we assess the effectiveness and efficiency of our approach to cope with temporal variations in typing habits and dynamics of legitimate users.

show abstract

TMSUI: A Trust Management Scheme of USB Storage Devices for Industrial Control Systems

Cited by 7 publications

References 11 publications

To (US)Be or Not to (US)Be: Discovering Malicious USB Peripherals through Neural Network-Driven Power Analysis

To (US)Be or Not to (US)Be: Discovering Malicious USB Peripherals through Neural Network-Driven Power Analysis

SoK: "Plug & Pray" Today – Understanding USB Insecurity in Versions 1 Through C

USBlock: Blocking USB-Based Keypress Injection Attacks

Contact Info

Product

Resources

About