News

USB Connections Vulnerable to Data Leakage

It seems USB is not as secure as previously thought. New research shows that USB connections are vulnerable to data leakage. The study, run by University of Adelaide researchers, demonstrated over 90% of 50 tested external USB devices are at risk. The researchers collected this leaked data remotely. In other words, they did not intercept data directly from the USB connection. Instead, they gathered information through a modified USB lamp placed adjacent to the target device. Furthermore, the snooping device transmitted the stolen data to another computer.

USB Data Leakage

Dr Yuval Yarom, a Research Associate with the University of Adelaide’s School of Computer Science, compares the process to leaking water pipes. Data becomes vulnerable to “channel-to-channel crosstalk leakage.” He explains:

“Electricity flows like water along pipes – and it can leak out.”

Yarom led the research in collaboration with student Yang Su, Dr. Daniel Genkin from the University of Pennsylvania, and University of Maryland, and Dr. Damith Ranasinghe of University of Adelaide’s Auto-ID Lab. The team measured voltage fluctuations from USB port data lines through an adjacent port in a USB hub. The adjacent USB lamp read keystrokes through the leaky connection. Finally, the snooping device transferred the data to another computer via Bluetooth.

USB Not as Safe as Previously Thought

Until now, researchers USB connections considered safe from such leakage. However, these tests demonstrate a worrying vulnerability with USB connections. Dr Yarom explains:

“USB-connected devices include keyboards, cardswipers and fingerprint readers which often send sensitive information to the computer.

It has been thought that because that information is only sent along the direct communication path to the computer, it is protected from potentially compromised devices.

But our research showed that if a malicious device or one that’s been tampered with is plugged into adjacent ports on the same external or internal USB hub, this sensitive information can be captured. That means keystrokes showing passwords or other private information can be easily stolen.”

USB Security Needs Fixing

The results prove that USB requires new security standards, Dr Yarom asserts:

“The main take-home message is that people should not connect anything to USB unless they can fully trust it. For users it usually means not to connect to other people’s devices.”

The team from the University of Adelaide will present the results at this year’s USENIX security symposium in Canada.

Ashley Allen

Disqus Comments Loading...

Recent Posts

Cities Skylines 2 Modding Finally Coming March 25th

At long last modding for Cities Skylines 2 will be arriving on March 25th alongside…

1 hour ago

Specs For Upcoming PS5 Pro Have Been Leaked

It's no secret that Sony is planning on releasing a Pro model of the PlayStation…

1 hour ago

Elgato Premium 1080p HD Facecam

Studio quality f/2.4 24 mm* all-glass Elgato Prime Lens Sony® STARVIS™ Sensor optimized for indoor…

20 hours ago

Cryorig R5 Performance CPU Cooler with 140mm – Black / White

The large tower cooler relies on two 140 mm fans, six 6 mm heat pipes…

20 hours ago

Cryorig Crona S ARGB 120mm PWM Triple Fan Pack with Controller

An Alternative to Convention - With the Low-key black back frame, Crona S features the…

20 hours ago

Asetek SimSports Pagani Huayra R Sim Racing Pedals

Expand your setup with real Pagani genes - With the Asetek SimSports Pagani Huayra R…

20 hours ago