HubBub: Contention-Based Side-Channel Attacks on USB Hubs
summary
USB hub contention leaks high-resolution timing: attackers saturate hub with 4KB SSD I/Os to force congestion, probe I/O intervals via a host process, VM, webpage or a malicious USB peripheral, and feed traces to ML models. On a 100-site corpus with >500 traces/site the method classifies top‑100 websites at ~98% accuracy; camera activity and keystrokes are recovered too (reported 85–99%). Tested across 15 USB 3.x hubs, a USB 2.0 hub and an internal hub, most are vulnerable.
AI-written summary · about
related talks
26mUSB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs
34mDoes Dropping USB Drives in Parking Lots and Other Places Really Work?
25mDon't Trust Your USB! How to Find Bugs in USB Device Drivers
27mCracking With Automated USB Fuzz
51mA Measured Response to a Grain of Rice
36mUSB Arsenal for Masses
34mA new categorization system for Side-channel attacks on mo...
18mOwning the Smart Home with Logitech Harmony Hub