USBIPS Framework: Protecting Hosts from Malicious USB Peripherals

• URL: http://arxiv.org/abs/2409.12850v2
• Date: Thu, 03 Jul 2025 05:23:52 GMT
• Title: USBIPS Framework: Protecting Hosts from Malicious USB Peripherals
• Abstract summary: Universal Serial Bus (USB)-based attacks have increased in complexity in recent years.<n>This paper focuses on building a security framework called USBIPS within Windows OSs to defend against malicious USB peripherals.
• Score: 0.46040036610482665
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Universal Serial Bus (USB)-based attacks have increased in complexity in recent years. Modern attacks incorporate a wide range of attack vectors, from social engineering to signal injection. The security community is addressing these challenges using a growing set of fragmented defenses. Regardless of the vector of a USB-based attack, the most important risks concerning most people and enterprises are service crashes and data loss. The host OS manages USB peripherals, and malicious USB peripherals, such as those infected with BadUSB, can crash a service or steal data from the OS. Although USB firewalls have been proposed to thwart malicious USB peripherals, such as USBFilter and USBGuard, their effect is limited for preventing real-world intrusions. This paper focuses on building a security framework called USBIPS within Windows OSs to defend against malicious USB peripherals. This includes major efforts to explore the nature of malicious behavior and achieve persistent protection from USB-based intrusions. Herein, we first introduce an allowlisting-based method for USB access control. We then present a behavior-based detection mechanism focusing on attacks integrated into USB peripherals. Finally, we propose a novel approach that combines cross-layer methods to build the first generic security framework that thwarts USB-based intrusions. Within a centralized threat analysis framework, the approach provides persistent protection and may detect unknown malicious behavior. By addressing key security and performance challenges, these efforts help modern OSs against attacks from untrusted USB peripherals.

Related papers

• Auditable and Transparent Fully Authenticated Disk Encryption via USB Storage Interposition [0.0]
  Full Disk Encryption (FDE) has become increasingly important in the last decades due to the evident confidentiality concerns.<n>In most systems, encryption is provided by an operating system driver, through which the user can transparently access the encrypted disk.<n>We explore an alternative approach: the use of an intermediate USB device placed between the host system and the external hard disk.
  arXiv  Detail & Related papers  (2026-07-14T12:42:17Z)
• QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection [60.105690843777666]
  We show that robust, privacy-preserving detection is achievable using lightweight models operating solely on timing features.<n>Our analysis reveals that attacker sophistication does not monotonically translate into improved evasion.
  arXiv  Detail & Related papers  (2026-04-17T08:53:24Z)
• The Reverse File System: Towards open cost-effective secure WORM storage devices for logging [0.0]
  Write Once Read Many (WORM) properties for storage devices are desirable to ensure data immutability.<n>We introduce Socarrat, a novel, cost-effective, and local WORM storage solution that leverages a simple external USB device.<n>Socarrat significantly reduces the attack surface and ensures that even privileged attackers cannot modify or erase stored data.
  arXiv  Detail & Related papers  (2025-09-22T16:19:08Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• Virtual local area network over HTTP for launching an insider attack [0.0]
  This paper demonstrates how an external machine can gain access to a LAN by exploiting an unused secondary IP address.<n>Despite the presence of robust external protections, such as firewalls and IDS, this form of insider attack reveals significant vulnerabilities in the way internal threats are addressed.
  arXiv  Detail & Related papers  (2025-07-25T08:16:19Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading Attacks [16.54210795506388]
  We show that popular real-time operating systems (RTOSs) lack essential security protections.<n>We identify a performance optimization practice in ThreadX that introduces security vulnerabilities, allowing for the circumvention of parameter sanitization processes.<n>We introduce an automated approach involving under-constrained symbolic execution to identify the Kernel Object Masquerading (KOM) Attack.
  arXiv  Detail & Related papers  (2025-04-28T05:01:35Z)
• USBSnoop -- Revealing Device Activities via USB Congestions [8.24901413716099]
  This project introduces an innovative approach to USB side-channel attacks via congestion. We evaluated the susceptibility of USB devices and hubs to remote profiling and side-channel attacks. Our findings underscore the need for enhanced security measures to protect user privacy in an era increasingly dependent on USB-connected devices.
  arXiv  Detail & Related papers  (2025-03-06T00:06:02Z)
• Exploiting HDMI and USB Ports for GPU Side-Channel Insights [0.9208007322096533]
  This paper presents a new class of attacks that exploit power consumption patterns at USB and HDMI ports to infer GPU activities. We develop a custom device that plugs into these ports and demonstrate that its high-resolution power measurements can drive successful inferences about GPU processes. Our findings underscore the need to reevaluate and strengthen the current generation of HDMI and USB port security defenses.
  arXiv  Detail & Related papers  (2024-10-03T14:44:15Z)
• MASKDROID: Robust Android Malware Detection with Masked Graph Representations [56.09270390096083]
  We propose MASKDROID, a powerful detector with a strong discriminative ability to identify malware. We introduce a masking mechanism into the Graph Neural Network based framework, forcing MASKDROID to recover the whole input graph. This strategy enables the model to understand the malicious semantics and learn more stable representations, enhancing its robustness against adversarial attacks.
  arXiv  Detail & Related papers  (2024-09-29T07:22:47Z)
• Towards Practical Fabrication Stage Attacks Using Interrupt-Resilient Hardware Trojans [4.549209593575401]
  We introduce a new class of hardware trojans called interrupt-resilient trojans (IRTs) IRTs can successfully address the problem of non-deterministic triggering in CPUs. We show that our design allows for seamless integration during fabrication stage attacks.
  arXiv  Detail & Related papers  (2024-03-15T19:55:23Z)
• Leveraging AI Planning For Detecting Cloud Security Vulnerabilities [15.503757553097387]
  Cloud computing services provide scalable and cost-effective solutions for data storage, processing, and collaboration. Access control misconfigurations are often the primary driver for cloud attacks. We develop a PDDL model for detecting security vulnerabilities which can for example lead to widespread attacks such as ransomware.
  arXiv  Detail & Related papers  (2024-02-16T03:28:02Z)
• When Authentication Is Not Enough: On the Security of Behavioral-Based Driver Authentication Systems [53.2306792009435]
  We develop two lightweight driver authentication systems based on Random Forest and Recurrent Neural Network architectures. We are the first to propose attacks against these systems by developing two novel evasion attacks, SMARTCAN and GANCAN. Through our contributions, we aid practitioners in safely adopting these systems, help reduce car thefts, and enhance driver security.
  arXiv  Detail & Related papers  (2023-06-09T14:33:26Z)
• Evil from Within: Machine Learning Backdoors through Hardware Trojans [72.99519529521919]
  Backdoors pose a serious threat to machine learning, as they can compromise the integrity of security-critical systems, such as self-driving cars. We introduce a backdoor attack that completely resides within a common hardware accelerator for machine learning. We demonstrate the practical feasibility of our attack by implanting our hardware trojan into the Xilinx Vitis AI DPU.
  arXiv  Detail & Related papers  (2023-04-17T16:24:48Z)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness [58.23214712926585]
  We develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the de-randomized smoothing technique for the domain of malware detection. Specifically, we propose a window ablation scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. We are the first to offer certified robustness in the realm of static detection of malware executables.
  arXiv  Detail & Related papers  (2023-03-20T17:25:22Z)
• Enhancing the Security & Privacy of Wearable Brain-Computer Interfaces [7.972396153788745]
  Brain computing interfaces (BCI) are used in a plethora of safety/privacy-critical applications. They are susceptible to a multiplicity of attacks across the hardware, software, and networking stacks used. We introduce Argus, the first information flow control system for wearable BCI applications that mitigates these attacks.
  arXiv  Detail & Related papers  (2022-01-19T16:51:18Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)
• Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain [58.30296637276011]
  This paper summarizes the latest research on adversarial attacks against security solutions based on machine learning techniques. It is the first to discuss the unique challenges of implementing end-to-end adversarial attacks in the cyber security domain.
  arXiv  Detail & Related papers  (2020-07-05T18:22:40Z)
• MAGNETO: Fingerprinting USB Flash Drives via Unintentional Magnetic Emissions [4.588028371034406]
  USB flash drives are one of the most common attack vectors used to gain unauthorized access to host devices. In such a way, an attacker can steal sensitive information via the USB-connected devices, as well as inject any kind of malicious software into the host. We propose a framework to verify the authenticity of a USB flash drive, rooted in the analysis of its unintentional magnetic emissions.
  arXiv  Detail & Related papers  (2020-02-14T08:09:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.