%0 Conference Proceedings
%T USBlock: Blocking USB-Based Keypress Injection Attacks
%+ SBA Research
%+ University of Patras
%+ mulliner.org
%A Neuner, Sebastian
%A Voyiatzis, Artemios, G.
%A Fotopoulos, Spiros
%A Mulliner, Collin
%A Weippl, Edgar, R.
%Z Part 6: Fixing Vulnerabilities
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 32th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec)
%C Bergamo, Italy
%Y Florian Kerschbaum
%Y Stefano Paraboschi
%I Springer International Publishing
%3 Data and Applications Security and Privacy XXXII
%V LNCS-10980
%P 278-295
%8 2018-07-16
%D 2018
%R 10.1007/978-3-319-95729-6_18
%K Security
%K USB
%K BadUSB
%K Linux kernel
%K System security
%Z Computer Science [cs]Conference papers
%X The Universal Serial Bus (USB) is becoming a prevalent attack vector. Rubber Ducky and BadUSB are two recent classes of a whole spectrum of attacks carried out using fully-automated keypress injections through innocent-looking USB devices. So far, defense mechanisms are insufficient and rely on user participation in the trust decision.We propose USBlock, a novel approach to detect suspicious USB devices by analyzing the temporal characteristics of the USB packet traffic they generate, similarly to intrusion detection approaches in networked systems.Our approach is unique in that it does not to involve at all the user in the trust decision. We describe a proof-of-concept implementation for Linux and we assess the effectiveness and efficiency of our approach to cope with temporal variations in typing habits and dynamics of legitimate users.
%G English
%Z TC 11
%Z WG 11.3
%2 https://inria.hal.science/hal-01954405/document
%2 https://inria.hal.science/hal-01954405/file/470961_1_En_18_Chapter.pdf
%L hal-01954405
%U https://inria.hal.science/hal-01954405
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-WG
%~ IFIP-TC11
%~ IFIP-WG11-3
%~ IFIP-DBSEC
%~ IFIP-LNCS-10980