USBSnoop -- Revealing Device Activities via USB Congestions

2025-03-06

AI Summary

USB’s shared bus architecture exhibits congestion patterns induced by device activity, which—due to the protocol stack’s lack of side-channel mitigations—enables remote side-channel attacks. This work identifies a previously unaddressed vulnerability in USB’s bandwidth arbitration mechanism, challenging the long-standing assumption that physical isolation guarantees USB security. Method: We propose a non-intrusive side-channel framework integrating USB traffic timing modeling, cross-device congestion feature extraction, machine learning–based classification, and passive bus monitoring. Contribution/Results: Evaluated on real hardware, our approach achieves >92% accuracy in real-time activity recognition across 12 mainstream USB device classes (e.g., keyboards, webcams, storage devices). It successfully infers keystroke content and video playback states covertly. This constitutes the first systematic extension of congestion-based side-channel attacks to the USB standard, establishing a new paradigm and empirical foundation for enhancing USB protocol security.

Technology Category

• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Planning, Routing, and Scheduling: Activity and Plan Recognition
• Machine Learning: Hardware-aware ML

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

The USB protocol has become a ubiquitous standard for connecting peripherals to computers, making its security a critical concern. A recent research study demonstrated the potential to exploit weaknesses in well-established protocols, such as PCIe, and created a side-channel for leaking sensitive information by leveraging congestion within shared interfaces. Drawing inspiration from that, this project introduces an innovative approach to USB side-channel attacks via congestion. We evaluated the susceptibility of USB devices and hubs to remote profiling and side-channel attacks, identified potential weaknesses within the USB standard, and highlighted the critical need for heightened security and privacy in USB technology. Our findings discover vulnerabilities within the USB standard, which are difficult to effectively mitigate and underscore the need for enhanced security measures to protect user privacy in an era increasingly dependent on USB-connected devices.

Problem

• Explores USB side-channel attacks via congestion vulnerabilities.
• Identifies weaknesses in USB devices and hubs for remote profiling.
• Highlights the need for enhanced USB security to protect privacy.

Innovation

• Exploits USB congestion for side-channel attacks
• Identifies vulnerabilities in USB devices and hubs
• Highlights need for enhanced USB security measures