More Web Proxy on the site http://driver.im/

article

Compromise through USB-based Hardware Trojan Horse device

Authors:

Sylvain Leblanc,

Scott KnightAuthors Info & Claims

Future Generation Computer Systems, Volume 27, Issue 5

Pages 555 - 563

https://doi.org/10.1016/j.future.2010.04.008

Published: 01 May 2011 Publication History

Abstract

This paper continues the discussion of the risks posed by Hardware Trojan Horse devices by detailing research efforts to build such a Hardware Trojan Horse based on unintended USB channels. Because of the ubiquitousness of the USB protocol in contemporary computer systems, the research focused on identifying, characterizing and modeling unintended USB channels. The research demonstrated that such unintended USB channels can allow the creation of two way communications with a targeted network endpoint, thus violating the integrity and confidentiality of the data residing on the network endpoint. The work was validated through the design and implementation of a Proof of Concept Hardware Trojan that uses two such unintended USB channels to successfully interact with a target network endpoint to compromise and exfiltrate data from it.

References

[1]

Perez, M. and Xiao, B., Special section: security on grids and distributed systems. Future Generation Computer Systems. 774-775.

Digital Library

[2]

Smith, M., Schmidt, M., Fallenbeck, N., Dörnemann, T., Schridde, C. and Freisleben, B., Secure on-demand grid computing. Future Generation Computer Systems. 315-325.

Digital Library

[3]

Y. Jin, N. Kupp, Y. Makris, Experiences in Hardware Trojan design and implementation, in: IEEE Intl. Wkshop. on Hardware-Oriented Security and Trust, HOST'09, 2009, pp. 50-57.

Digital Library

[4]

USB implementers forum, USB 2.0 specification, 2001. http://www.usb.org/developers/docs.

[5]

S. Stasiukonis, Social engineering, The USB Way, 2006. http://www.darkreading.com/document.asp?doc/id=95556.

[6]

S. Stasiukonis, Social-engineering employees, 2007. http://www.darkreading.com/document.asp?doc/id=140433.

[7]

Kim, S., Kim, S. and Lee, G., Structure design and test of entreprise security management system with advanced internal security. Future Generation Computer Systems. 258-263.

Digital Library

[8]

Centenial Software, DeviceWall Home Page, 2009. http://www.devicewall.com.

[9]

Check point software, Pointsec Protector Homepage, 2009. http://www.checkpoint.com/products/datasecurity/protector.

[10]

J. Clark, An examination of endpoint security methods to regulate USB flash drives use, M.A.Sc. Depth Research Paper, Royal Military College of Canada, 2007.

[11]

DeviceLock Inc., DeviceLock Homepage, 2009. http://www.devicelock.com.

[12]

J. Clark, On unintended USB channels, M.A.Sc. Thesis, Royal Military College of Canada, 2009.

[13]

J. Clark, S. Leblanc, S. Knight, Hardware Trojan Horse device based on unintended USB channels, in: 3rd International Conference on Network and System Security, 2009, pp. 1-8.

Digital Library

[14]

H. Salmani, M. Tehranipoor, J. Plusquellic, New design strategy for improving hardware Trojan detection and reduction Trojan activation time, in: IEEE Intl. Wkshop. on Hardware-Oriented Security and Trust, HOST'09, 2009, pp. 66-73.

Digital Library

[15]

X. Wang, H. Salmani, M. Tehranipoor, J. Plusquellic, Hardware Trojan detection and isolation using current integration and localized current analysis, in: IEEE Intl. Wkshop. on Hardware-Oriented Security and Trust, HOST'09, 2009, pp. 87-95.

Digital Library

[16]

D. Barral, D. Dewey, Plug and root, The USB Key to the Kingdom, 2005. http://www.blackhat.com/presentations/bh-usa-05/BH/US/05-Barrall-Dewey.pdf.

[17]

M. Al-Zarouni, The reality of risks from consented use of USB devices, in: Proceedings of the 4th Australian Information Security Conference, 2006, pp. 5-15.

[18]

G. Shah, A. Molina, M. Blaze, Keyboards and covert channels, in: Proceedings of the 15th Conference on USENIX Security Symposium, 2006.

Digital Library

[19]

V. Calmette-Vallet, S. de Royer-Dupuis, E. Filiol, G. Le Bouter, Passive and active leakage of secret data from non networked computer, 2008. http://www.blackhat.com/presentations/bh-usa-08/Filiol/BH_USA_08_Filiol.zip.

[20]

Common criteria recognition agreement, Common Criteria for Information Technology Security Evaluation, Version 2.3, 2005. http://www.commoncriteriaportal.org/thecc.html.

[21]

USB implementers forum, USB Device Class Definition for Human Interface Devices (HID) 1.11, 2001. http://www.usb.org/developers/devclass_docs/HID1_11.pdf.

[22]

USB implementers forum, USB HID Usage Tables 1.12, 2004. http://www.usb.org/developers/devclass_docs/Hut1_12.pdf.

[23]

PLX technology, Net2280 Home Page, 2008. http://www.plxtech.com/products/net2000/net2280.asp.

[24]

USB implementers forum, Device Class Definition for Human Interface Devices, 2001. http://www.usb.org/developers/docs.

[25]

HHD software, USB Monitor Profession Homepage, 2009. http://www.hhdsoftware.com/Products/home/usb-monitor-pro.html.

[26]

USB implementers forum, USB Device Class Definition for Audio Devices 2.0, 2006. http://www.usb.org/developers/devclass/docs/Audio2.0/final.zip.

[27]

Microsoft, windows media: WAVEFORMATEXTENSIBLE, 2008. http://msdn.microsoft.com/en-us/library/aa391547(VS.85).aspx.

[28]

Microsoft, windows driver kit: audio devices wavecyclic latency, 2009. http://msdn.microsoft.com/en-us/library/ms790342.aspx.

[29]

Laccetti, G. and Schmid, G., A framework model for grid security. Future Generation Computer Systems. 702-713.

Digital Library

[30]

Tarako, EXE2VBS, 2003. http://www.haxorcitos.com/ficheros.html.

[31]

Information Science Institute-University of Southern California, RFC 791-Internet Protocol-DARPA Internet Program-Protocol Specification, 1981. http://tools.ietf.org/html/rfc791.

[32]

The Internet Society, RFC 2411-IP Security Document Roadmap, 1998. http://tools.ietf.org/html/rfc2411.

[33]

Smith, R. and Knight, S., Predictable design of network-based covert communication systems. IEEE Symposium on Security and Privacy. 311-321.

Digital Library

Cited By

Chillara ASaxena PMaiti RGupta MKondapalli RZhang ZKesavan K(2024)Deceiving supervised machine learning models via adversarial data poisoning attacks: a case study with USB keyboardsInternational Journal of Information Security10.1007/s10207-024-00834-y23:3(2043-2061)Online publication date: 1-Jun-2024
https://dl.acm.org/doi/10.1007/s10207-024-00834-y
Dumitru RGenkin DWabnitz AYarom YCalandrino JTroncoso C(2023)The impostor among US(B)Proceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620565(5863-5880)Online publication date: 9-Aug-2023
https://dl.acm.org/doi/10.5555/3620237.3620565
Khalfaoui SLeneutre JVillard AMa JUrien P(2021)Security Analysis of Out-of-Band Device Pairing ProtocolsWireless Communications & Mobile Computing10.1155/2021/88874722021Online publication date: 1-Jan-2021
https://dl.acm.org/doi/10.1155/2021/8887472
Show More Cited By

Compromise through USB-based Hardware Trojan Horse device
1. Social and professional topics
  1. Computing / technology policy

Recommendations

Hardware Trojan Horse Device Based on Unintended USB Channels
NSS '09: Proceedings of the 2009 Third International Conference on Network and System Security

This paper discusses research activities that investigated the risk associated with USB devices. The research focused on identifying, characterizing and modelling unintended USB channels in contemporary computer systems. Such unintended channels can be ...
Evaluating coherence-exploiting hardware trojan
DATE '17: Proceedings of the Conference on Design, Automation & Test in Europe

Increasing complexity of integrated circuits and IP-based hardware designs have created the risk of hardware Trojans. This paper introduces a new type of threat, a coherence-exploiting hardware Trojan. This Trojan can be maliciously implanted in master ...
Mitigation of Hardware Trojan based Denial-of-Service attack for secure NoCs

As Multiprocessor System-on-Chips (MPSoCs) continue to scale, security for Network-on-Chips (NoCs) is a growing concern as rogue agents threaten to infringe on the hardwares trust and maliciously implant Hardware Trojans (HTs) to undermine their ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image Future Generation Computer Systems

Future Generation Computer Systems Volume 27, Issue 5

May, 2011

225 pages

ISSN:0167-739X

Issue’s Table of Contents

Copyright © © 2010.

Publisher

Elsevier Science Publishers B. V.

Netherlands

Publication History

Published: 01 May 2011

Author Tags

Qualifiers

Article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

7
Total Citations
View Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 19 Dec 2024

Other Metrics

View Author Metrics

Citations

Cited By

Chillara ASaxena PMaiti RGupta MKondapalli RZhang ZKesavan K(2024)Deceiving supervised machine learning models via adversarial data poisoning attacks: a case study with USB keyboardsInternational Journal of Information Security10.1007/s10207-024-00834-y23:3(2043-2061)Online publication date: 1-Jun-2024
Dumitru RGenkin DWabnitz AYarom YCalandrino JTroncoso C(2023)The impostor among US(B)Proceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620565(5863-5880)Online publication date: 9-Aug-2023
Khalfaoui SLeneutre JVillard AMa JUrien P(2021)Security Analysis of Out-of-Band Device Pairing ProtocolsWireless Communications & Mobile Computing10.1155/2021/88874722021Online publication date: 1-Jan-2021
García BGómez AConde RHernández YValero M(2015)Breaking the web barriers of the e-Administration using an accessible digital certificate based on a cryptographic tokenAdvances in Software Engineering10.1155/2015/5680872015(3-3)Online publication date: 1-Jan-2015
Leito PKarnouskos S(2015)Industrial AgentsundefinedOnline publication date: 26-Mar-2015
Alexander JDean TKnight SNg JCouturier CLitoiu MStroulia E(2011)Spy vs. SpyProceedings of the 2011 Conference of the Center for Advanced Studies on Collaborative Research10.5555/2093889.2093891(1-14)Online publication date: 7-Nov-2011
Xiang YZhou W(2011)EditorialFuture Generation Computer Systems10.1016/j.future.2010.11.01627:5(527-528)Online publication date: 1-May-2011

View Options

View options

Media

Figures

Other

Tables

View Issue’s Table of Contents