Categories: News

USB Connections Vulnerable to Data Leakage

It seems USB is not as secure as previously thought. New research shows that USB connections are vulnerable to data leakage. The study, run by University of Adelaide researchers, demonstrated over 90% of 50 tested external USB devices are at risk. The researchers collected this leaked data remotely. In other words, they did not intercept data directly from the USB connection. Instead, they gathered information through a modified USB lamp placed adjacent to the target device. Furthermore, the snooping device transmitted the stolen data to another computer.

USB Data Leakage

Dr Yuval Yarom, a Research Associate with the University of Adelaide’s School of Computer Science, compares the process to leaking water pipes. Data becomes vulnerable to “channel-to-channel crosstalk leakage.” He explains:

“Electricity flows like water along pipes – and it can leak out.”

Yarom led the research in collaboration with student Yang Su, Dr. Daniel Genkin from the University of Pennsylvania, and University of Maryland, and Dr. Damith Ranasinghe of University of Adelaide’s Auto-ID Lab. The team measured voltage fluctuations from USB port data lines through an adjacent port in a USB hub. The adjacent USB lamp read keystrokes through the leaky connection. Finally, the snooping device transferred the data to another computer via Bluetooth.

USB Not as Safe as Previously Thought

Until now, researchers USB connections considered safe from such leakage. However, these tests demonstrate a worrying vulnerability with USB connections. Dr Yarom explains:

“USB-connected devices include keyboards, cardswipers and fingerprint readers which often send sensitive information to the computer.

It has been thought that because that information is only sent along the direct communication path to the computer, it is protected from potentially compromised devices.

But our research showed that if a malicious device or one that’s been tampered with is plugged into adjacent ports on the same external or internal USB hub, this sensitive information can be captured. That means keystrokes showing passwords or other private information can be easily stolen.”

USB Security Needs Fixing

The results prove that USB requires new security standards, Dr Yarom asserts:

“The main take-home message is that people should not connect anything to USB unless they can fully trust it. For users it usually means not to connect to other people’s devices.”

The team from the University of Adelaide will present the results at this year’s USENIX security symposium in Canada.

Ashley Allen

Disqus Comments Loading...

Recent Posts

Silverstone SUGO 14 Mini-ITX Cube Case Review

There are a lot of incredible PC cases on the market, and I actually think…

15 hours ago

Nvidia Will NOT Launch a 3060 Founders Edition GPU

With it undoubtedly representing one of the biggest product announcements made at CES 2021, Nvidia's…

20 hours ago

TerraMaster Unveils its F5-422 NAS

TerraMaster has today announced the expansion of its 10GbE Series with the F5-422 5-bay quad-core…

20 hours ago

Biostar Launches its flagship Z590 VALKYRIE Motherboards

BIOSTAR has today announced the launch of their latest Z590 VALKYRIE series motherboard range engineered…

20 hours ago

Game UK Denies Scalpers Just Claimed 2,000 PS5’s

Since their launch in November last year, even despite the fact that we're now over…

20 hours ago

Arctic’s New MX-5 Thermal Compound is Listed for Preorder

It has, at least at the time of writing, been around 10-years now since Arctic…

20 hours ago