BadUSB 취약점 분석 및 대응 방안
Analysis and Countermeasure for BadUSB Vulnerability
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
As the BadUSB is a vulnerability, in which a hacker tampers the firmware area of a USB flash drive. When the BadUSB device is plugged into the USB port of a host system, a malicious code acts automatically. The host system misunderstands the act of the malicious behavior as an normal behaviour for booting the USB device, so it is hard to detect the malicious code. Also, an antivirus software can’t detect the tampered firmware because it inspects not the firmware area but the storage area. Because a lot of computer peripherals (such as USB flash drive, keyboard) are connected to host system with the USB protocols, the vulnerability has a negative ripple effect. However, the countermeasure against the vulnerability is not known now. In this paper, we analyze the tampered area of the firmware when a normal USB device is changed to the BadUSB device and propose the countermeasure to verify the integrity of the area when the USB boots. The proposed method consists of two procedures. The first procedure is to verify the integrity of the area which should be fixed even if the firmware is updated. The verification method use hashes, and the target area includes descriptors. The second procedure is to verify the integrity of the changeable area when the firmware is updated. The verification method use code signing, and the target area includes the function area of the firmware. We also propose the update protocol for the proposed structure and verify it to be true through simulation.
Abstract
As the BadUSB is a vulnerability, in which a hacker tampers the firmware area of a USB flash drive. When the BadUSB device is plugged into the USB port of a host system, a malicious code acts automatically. The host system misunderstands the act of the malicious behavior as an normal behaviour for booting the USB device, so it is hard to detect the malicious code. Also, an antivirus software can’t detect the tampered firmware because it inspects not the firmware area but the storage area. Because a lot of computer peripherals (such as USB flash drive, keyboard) are connected to host system with the USB protocols, the vulnerability has a negative ripple effect. However, the countermeasure against the vulnerability is not known now. In this paper, we analyze the tampered area of the firmware when a normal USB device is changed to the BadUSB device and propose the countermeasure to verify the integrity of the area when the USB boots. The proposed method consists of two procedures. The first procedure is to verify the integrity of the area which should be fixed even if the firmware is updated. The verification method use hashes, and the target area includes descriptors. The second procedure is to verify the integrity of the changeable area when the firmware is updated. The verification method use code signing, and the target area includes the function area of the firmware. We also propose the update protocol for the proposed structure and verify it to be true through simulation.
참고문헌 (19)
- USB Deserves More Support, "S. L. Garfinkel", The Boston Globe, C4~ (1999)
- K. Nohl, "BadUSB-On Accessories That Turn Evil" (2014), Black Hat USA
- A. Caudill, "Making BadUSB Work for you" (1994), Derbycon
- "Phison 2251-03 (2303)Custom Firmware & Existing Firmware Patches (BadUSB)" (2014)[URL]
- "BadUSB Attack Prevention"[URL]
- 최병준, "키보드를 모방하는 BadUSB를 차단하기 위한 보안 프로그램", 정보보호학회논문지, 26(6), pp.1483~1492 (2016), 한국정보보호학회[DOI]
- Y. S. Lee, "Cognitive Countermeasures Against BAD USB", Proceedings of Springer International Conference on Broadband and Wireless Computing, Communication and Applications, pp.377~386 (2016)
- J. E. Boritz, "IS Practitioners' Views on Core Concepts of Information Integrity", International Journal of Accounting Information Systems, 6(4), pp.260~279 (2005)
- 최준, "BadUSB의 취약성 및 대응방안", 정보보호학회논문지, 25(3), pp.559~565 (2015), 한국정보보호학회[DOI]
- Axelson, Jan, "USB Complete: the Developer's Guide", Lakeview research LLC, ~ (2015)
- Bus Universal Serial, "Device Class Definition for Human Interface Devices (HID)", ~ (2001)
- Logic Beyond, "USB in a NutShell", ~ (2014)
- A. J. Menezes, "Handbook of applied cryptograph" (1996), CRC press
- Atmel Corporation, "Atmel AT02333: Safe and Secure Booltloader Implementation for SAM3", 4, 2013
- Y. Li, "VIPER:Verifying the Integrity of PERipherals'Firmware", Proceedings of the 18th ACM Conference on Computer and Communications Security (2011)
- Application Report : Secure In-Field Firmware Updates for MSP MCUs, "TEXAS INSTRUMENTS", ~ (2015)
- Intel Company, "MCSr 51 Microcontroller Family User's Manual", Intel, ~ (1994)
- "Introduction to Code Signing"[URL]
- software Introduction, "Embedded System Design: a Unified Hardware", pp.2002, F. Vahid