SigUSB: Fingerprinting USB Devices using Distinctive Characteristics of Electrical Signals

SigUSB: Fingerprinting USB Devices using Distinctive Characteristics of Electrical Signals === Keywords: fingerprint, authenticate, identify, usb, devices, voltage, signals ## Introduction * USB protocol and devices * Insecurity of USB protocol * Challenges of USB device identification * Our approach * Robustness (two graphs in a figure showing variations across devices of different models and consistency of the same devices across different runs) * System design and result highlights * Contributions * The rest of this paper is... ## Background and Motivation * Signals -> packets (figure) * Initialization sequence * Motivation ## Threat Model * Attacker is able to: * Fabricate a USB device that impersonates a benign device * E.g., BadUSB, FaceDancer, BashBunny * USBee [X] * Attacker is not able to: * Steal an authenticated device and change the firmware * We trust known devices * Our focus: authenticating a USB devices when plugged-in (but not monitoring their behaviors after that) * Compromise our authentication mechanism * There exist solutions [DeviceVeil, FPGA] * Host machine has only one USB port available for SigUSB ## Design * Overview [Figure] * Logic analysis -> Noise filtering -> Sequence aligning -> Feature extraction -> ML classification -> Device authentication * Logic analysis & noise filtering * Sequence aligning * Feature extraction * What features are most effective? * ML classification * Device authentication ## Implementation ## Evaluation * Questions * Q1: How accurate is this device fingerprinting? * \# of devices in training and accuracy * With a small # of devices in training, can SigUSB detect many unknown devices? * \# of samples in training and accuracy * How does # of samples in training and testing affect the accuracy? * What classifiers give better accuracy? * Q2: Is this robust against an impersonating device (1) of the same model, (2) across models, (3) consistent across plug-in times? * Q3: Is SigUSB effective against real impersonating devices? * Q4: What is the performance impact of SigUSB? * Setup * Machine spec., experimented with XXX devices (models, types, etc.) * Focus on keyboards and mice because... * Biggest targets for impersonating devices [CITE] * The mechanism is general and can be applied to other types of USB devices * Accuracy of USB device fingerprinting * Robustness of using electrical signals * Experiments with real-world attacks * Performance impact ## Related Work * USB attacks & device authentication * Attacks * BadUSB ... * Authentication * DeviceVeil (closest) * Dave Tian's work: USBFilter, etc. * Figerprinting devices based on electical signals * Automotive ECU fingerprinting * XXX ## Discussion and Future Work * Source of small inaccuracy * Stealing and reprogramming an authenticated device * Retraining after degradation of hardware * Protection of our mechanism ## Conclusion