SandUSB: An installation-free sandbox for USB peripherals

Abstract

This work investigates two emerging attacks — Human Interface Device (HID) attack and Juice Jacking attack — that leverage USB peripherals, and proposes countermeasures to defend against them. These attacks can be easily reproduced using low-cost IoT prototyping boards (e.g., Raspberry Pi) and can bypass commercial antivirus tools. Although several research prototypes can effectively mitigate Juice Jacking and HID attacks, these prototypes encounter two challenges with respect to deployability: 1) Some require installation on host computers, which is inconvenient and users may lack permission to install software; 2) Some assume cryptographic keys for authentication, but such cryptographic operations may not be supported by legacy USB peripherals and hosts. To address these challenges, this paper presents the design and implementation of SandUSB, an installation-free and user-controllable security gadget for USB peripherals. Since SandUSB acts as an intermediary between the USB host and device, SandUSB can perform efficient scanning and analysis without changing USB devices or hosts. In addition, SandUSB provides a simple user interface (UI) to control and monitor connected USB devices, enabling users to identify malicious peripherals that masquerade as another type. This UI is complementary to the automatic defensive measures that SandUSB supports or cryptographic-based authentication. Our evaluation demonstrates that SandUSB can effectively defend against various USB attacks, including the HID attack and Juice Jacking, using affordable and easily accessible hardware.