Star 0

Abstract

For a number of years I have been interested in USB host security, which can only be comprehensively tested using a combination of software and bespoke hardware to emulate various USB devices. After developing several different approaches to testing USB (which I've publicly discussed at various conferences), I have identified over 100 bugs covering all the major operating systems. The response from the vendors has often been along these lines: "thank you for the bug, but as you need physical access to plug in your rogue device, the impact is actually quite low." However, due to recent advances in a number of remoting technologies, USB attacks can now be launched over a network. The talk will describe how these technologies work, the resulting impact on the world of USB bugs and show a live demo remotely triggering a USB kernel bug in Windows 2012 server.