USB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs
summary
Tests cover over 50 computers and hubs and find 90% vulnerable to analog crosstalk that leaks USB traffic over adjacent ports and even the power line. The attack captures correlated waveforms with an oscilloscope and cheap USB devkits, reconstructs keystrokes, fingerprints and card data, and a modified USB-powered lamp exfiltrates traffic live. It reliably works on USB 1.0 and often on USB 2.0, fails on USB 3.0, and mitigation requires silicon redesign or voltage regulation on power lines.
AI-written summary · about
chapters (12)
- 0:00Introduction to USB
- 1:35USB security and topology
- 3:55Crosstalk leakage concept
- 5:06Snooping demonstration
- 7:25Root cause analysis
- 9:04Real-world attack scenarios
- 10:38Malicious LAN attack demo
- 12:01Attacking USB 2.0
- 13:48Power line leakage
- 16:20Countermeasures
- 18:02Limitations and conclusion
- 19:14Q&A session
related talks
08mHubBub: Contention-Based Side-Channel Attacks on USB Hubs
36mUSB Arsenal for Masses
34mA new categorization system for Side-channel attacks on mo...
47mTrojanizing Hardware: Be Careful What (USB) You Plug In and Where
45mBadUSB - On Accessories that Turn Evil
51mA Measured Response to a Grain of Rice
27mCracking With Automated USB Fuzz
46mAttacking Hardware Systems Using Resonance and the Laws of Physics