Defending against Malicious Peripherals with Cinch
summary
Cinch virtualizes the USB bus into a sacrificial VM and inserts a modular enforcer between that VM and the protected system, implemented as a Rust user process running on Linux KVM with an ARM-based TLS adapter and a USB-emulation test device. The prototype blocks 16 of 18 exploits out of the box, adds about 38% throughput drop and ~200 MB RAM overhead with CPU cost ~8x in relative terms, and increases ping RTT by +2 ms while enabling protocol validation, signature matching, and TLS-authenticated device policies.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:18USB architecture from 30,000 feet
- 1:12Peripherals can exploit driver vulnerabilities
- 1:37Peripherals can leverage DMA to attack OSes
- 1:57Peripherals can lie about their identity
- 6:25An IOMMU can be used to restrict where in memory a device may write
- 8:28Enforcing allowed device behavior
- 9:25Filtering known exploits
- 10:46authentication and encryption
- 12:26Summary of defenses
- 13:03Implementation details
- 13:53We implement exploits for existing USB driver vulnerabilities
- 14:41We carry out a 3-phase penetration testing exercise
- 15:52Performance evaluation highlights
- 17:20Cinch brings network defenses to USB...
- 18:03Related work
related talks
51mA Measured Response to a Grain of Rice
37mThe Hacker’s Perspective: Zephyr OS and On-Device Runtime Protection
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
24mShielding Software From Privileged Side-Channel Attacks
18mμUSB: Practical and Safe USB Driver Reuse for Arm TrustZone
48mBetrusted: Better Security Through Physical Partitioning
12mSecurity and Performance in the Delegated User-level Virtualization
41mProtecting Your System from the Scum of the Universe