Alright, I finally decided on my practicum subject. Together with my supervisor, we came up with the following exposé. I either wanted to do that or to do something in Mobile (Phone) OS security.
USB is omnipresent and so far, mostly Operating System behaviour has been exploited, i.e. automatically run an application off a CDROM. USB-Stack, USB-Driver or application security has not yet been in the focus of security research, probably because it is infeasible to create many USB test devices.
If various USB behaviour could be implemented easily and cheaply, a great diversity of maliciously acting USB devices could be tested with little effort.
The goal is to implement a USB fuzzing framework using a virtualisation software that allows to automatically test different USB behaviour to stress-test USB-Stacks, drivers and applications.
While hardware approaches would be possible, a virtual approach using virtualisation software will be taken. That allows any guest Operating System, including Windows and Linux, to be tested, as well as cheap and quick creation of tests and reliable reproduction of the obtained results.
Ideally, this results in exploits for each of the three identified vulnerable layers:
- USB Stack in the Operating System
- USB Driver for the attached device (i.e. Webcam)
- Application using data from the USB device
Thus following questions will be addressed:
- How secure are USB stacks when it comes to weird devices?
- How resistant are drivers when specially crafted payload is sent?
- How good are applications that act upon a new USB device and read its data?
I’m working on a similiar thing. But I wanted to use a mobile phone like to fuzz the usb-stack of Windows or linux. I’ve thought about porting libusb to android and send some weird data over usb. Do you have any luck so far with your framework?