BADUSB-C: Revisiting BadUSB with Type-C

Abstract

The security of the USB protocol has been paid extensive attention to because of its wide usage. Due to the trust-by-default characteristics, USB security has caused severe problems. For example, a well-known firmware attack, BadUSB, performs malicious operations on the victim hosts through disguising ordinary USB devices as human interface devices like keyboards and mice. However, BadUSB suffers from several limitations. Attackers cannot obtain the status of UI to conduct precise attacks and get the visual feedback of their attacks. In this work, we extended BadUSB to support the new USB Type-C features and proposed a multi-mode attack model, BADUSB-C. This obtains UI status to make attacks more precise and effective. To the best of our knowledge, BADUSB-C is the first attack model utilizing USB Type-C. To validate the usability and effectiveness, we conducted extensive experiments to simulate daily usage and summarized the private information collected. We also discussed the recommended countermeasures for our attack model, including isolated UI rendering, which may be inspiring for future research on defense methods.

Publication
15th IEEE Workshop on Offensive Technologies, co-located with IEEE S&P