BAD USB-C: Revisiting BadUSB with Type-C
Hongyi Lu1,* , Yechang Wu1,* , Shuqing Li1,* , You Lin1 , Chaozu Zhang1 , Fengwei Zhang1,2,
1

2

Department of Computer Science and Engineering, Southern University of Science and Technology
Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology{11712009,11711918,lisq2017,11711809,11712021}@mail.sustech.edu.cn,zhangfw@sustech.edu.cn

by traditional anti-virus software since it is hard to distinguishthem from ordinary USB devices.
Despite the advantageous features of BadUSB, there exist
several limitations as follows. (1) Attackers cannot conductattacks precisely, which decreases the capabilities of BadUSB
attacks. When performing attacks on another host, the attackers cannot obtain the current User Interface (UI) status,
limiting them from taking subsequent moves. For example, it
is hard for attackers to locate speciﬁc functional UI patterns
such as buttons and links on victim’s computers by disguising
USB devices, e.g., mice. This explains why typical BadUSB
attacks often only stay in the command line, using commands
to download malicious scripts for execution. However, these
attacks may be intercepted by anti-virus software or ﬁrewall
due to the host network usage. (2) To our best knowledge,
existing BadUSB attacks only utilize the features of USB 2.0.
The release of USB 3.0 makes USB more powerful, witha higher transmission rate for data and the support towards
a more extensive range of peripherals such as DisplayPort,HDMI and PowerDelivery. BadUSB attacks can become more
effective with the help of newly supported features in USB 3.x.
(3) There have emerged multiple efﬁcacious countermeasures
after the appearance of BadUSB. For example, GoodUSB
offers a defense method by limiting the functions of USB
devices to users’ expectations [5]. It provides a Graphical User
Interface (GUI) for users to describe the functionalities or rolesof the USB device and reject any usage beyond the description.
In this work, we addressed the limitations mentioned
above and implemented a multi-mode attack model of USB,
named BAD USB-C. BAD USB-C extends BadUSB to support
the features of USB Type-C. Although many smartphones
equipped with USB-C connectors do not support USB 3.x
protocol, such as products of Xiaomi, however, vendors like
HUAWEI and Samsung tend to support USB 3.x protocolin their high-end smartphones [6]. Since USB Type-C cantransfer video stream data, BAD USB-C could obtain theinformation of the victim’s GUI during attacks. Combining
it with the emulation of traditional HIDs, e.g., keyboards andmice, attackers are capable of performing precise attacks.
Moreover, we implemented multiple attacking modes of
USB attacks based on our approach to verify its effectiveness,
including HID emulation mode, video capture mode, and fullcontrol mode. To improve the efﬁciency and performance of
BAD USB-C, we designed a ﬁltering algorithm to preprocess
the video data before network transmission. We conducted aseries of experiments for each attack mode as well as for

Abstract—The security of the Universal Serial Bus (USB)protocol has been paid extensive attention to because of its
wide usage. Due to the trust-by-default characteristics, USB
security has caused severe problems. For example, a well-known
ﬁrmware attack, BadUSB, performs malicious operations on thevictim hosts through disguising ordinary USB devices as humaninterface devices like keyboards and mice. However, BadUSB
suffers from several limitations. Attackers cannot obtain thestatus of User Interface (UI) to conduct precise attacks and get
the visual feedback of their attacks. In this work, we extended
BadUSB to support the new USB Type-C features and proposeda multi-mode attack model, BAD USB-C. This obtains UI status
to make attacks more precise and effective. To the best of ourknowledge, BAD USB-C is the ﬁrst attack model utilizing USB
Type-C. To validate the usability and effectiveness, we conducted
extensive experiments to simulate daily usage and summarized
the private information collected. We also discussed the recommended countermeasures for our attack model, including isolated
UI rendering, which may be inspiring for future research on
defense methods.
Index Terms—USB; BadUSB; Type-C; Attack

I. I NTRODUCTIONThe Universal Serial Bus (USB) protocol has become popular worldwide since its appearance in 1996, as it provides
a uniﬁed and easy-to-use approach for an extensive range of
devices to communicate with each other. From version 1.0
till now, USB speciﬁcation has evolved rapidly and offered
more and more functionalities. Nowadays, devices with USB
support are ubiquitous.
Conversely, the security of USB has caused severe problems. Recent research of all USB speciﬁcations indicates that
security has not been taken into consideration [1]. There are
more than 400 vulnerabilities related to USB on CVE list [2].
As a result, many attackers exploit these vulnerabilities andthe trust-by-default characteristics of USB to conduct attacks,
which puts the privacy and ﬁnancial security of USB users indanger [1].
BadUSB is a well-known class of ﬁrmware attacks [3].
These attacks are conducted by modifying the device ﬁrmware,
which are disguised as ordinary USB devices as other typesof devices that are trust-by-default by the hosts. Typically,
simulated devices include Human Interface Device (HID) [4]and disks. Utilizing BadUSB, attackers can pretend to be regular users, typing malicious commands to victims’ computers,
downloading and executing malicious scripts, and copying out
private data from disks. Such attacks can easily avoid detection∗ The ﬁrst three authors contributed equally to this work.

Fengwei Zhang is the corresponding author.

1different types of devices, including smartphones, personal
computers, and tablet computers, to validate the usability of
BAD USB-C. We also conducted a case study for attacks
in sharing power banks, one of the application scenarios of
BAD USB-C. After the validation of our attack model, we
proposed several defense methods as countermeasures, including external hardware authorization, distrust-by-default, etc. It
is worth noting that we designed a method, called isolated
UI rendering, to separate the user interface into sensitive andinsensitive layers. Only the insensitive layer’s content would
be passed to the insecure driver and thus rendered on theexternal display, protecting the sensitive layer’s content.
We summarize our key contributions as follows:• To our best knowledge, this is the ﬁrst work to utilize
new features of USB Type-C. The combination of new
support with conventional BadUSB makes attacks more
precise and effective.
• We conducted a case study and multiple experiments tovalidate the usability and effectiveness of BAD USB-C.
We also proposed several countermeasures for our attack
model, which are reasonable and insightful.
The rest of this paper is structured as follows. Section II
provides the background of USB speciﬁcation. Section III
introduces the existing works of USB security from the aspects
of attacking and defense, respectively. In Section IV, we
present the threat model and the overall implementation of
BAD USB-C in three different modes. The experiments we
conducted are featured in Section V. We present some possible
countermeasures of BAD USB-C in Section VI. The limits andimpacts of our approach are discussed in Section VII, and theconclusion lies in Section VIII.

Fig. 1: USB 1.x & 2.x Connector.

Fig. 2: USB Type-C Connector.

point, due to the transfer limitation, it only supports limited
types of devices like keyboards, mice, etc.
In 2000, the USB 2.0 [9] speciﬁcation was released. Withhigh speed (480 Mbit/s) mode introduced, printers, cameras,
CD-ROM drives, and network cards are supported in thisrevision. Such a high data transfer rate also give rise to
the popularity of “ﬂash drive”, a portable device that allows
physically transferring data around [1]. Although various peripherals are supported in USB 2.0, there is no reliable way toidentify the type of device. This security ﬂaw allows attacks
like BadUSB [3], [10].
USB 3.0 [11] was introduced in 2008, with a super speed(5 Gbit/s) data transfer rate. Like its predecessor, more classesof peripherals are supported in this revision. In 2013, the USB
Type-C connector standard was introduced as a part of USB
3.1 [12], providing a uniﬁed connector type for PowerDelivery,
Thunderbolt, DisplayPort, and HDMI. Yet no improvement of
security is introduced in 3.x revisions, meaning any device
claiming itself as a monitor can capture the video stream fromthe host. Exposing such a multi-purpose connector unprotected
is insecure and allows attacks similar to BAD USB-C. In 2017,
USB 3.2 [13] was released, doubling the data transfer rate (20Gbit/s).
As illustrated in Figure 1, the original USB 1.x &2.x connector only has two pins for data transferring(D+ & D-), which has signiﬁcantly limited data transfer rate
(5 Gbits/s Max) and cannot support peripherals like DisplayPort (10.8 Gbit/s Min). Apart from that, support for otherperipherals also requires dedicated transferring lanes as theirstandards are not compatible with USB in most cases.
Thus, to provide support towards a wider range of peripherals, a 24-pins standard called USB Type-C [14] was introduced
in 2013 by USB-IF [15]. As it is designed to be double-sided,
the number of actually usable pins is halved. Nevertheless, thisstandard has largely enhanced the capability of the USB 3.x
protocol. As presented in Figure 2, Type-C add two high-speed
data lanes (TRX1 & TRX2) and keep the original data lane

II. BACKGROUND
We ﬁrst introduce the development of USB speciﬁcationand emphasize the key points adopted in this work. We alsoorganize a brief timeline for introducing key points of each
protocol in Table I.
Proposed in 1996, USB 1.0 [7] was developed to provide a
uniﬁed interface and thus reducing the cost of reconﬁguring
the software. It is worth mentioning that as a polled-bus
interface, all data transfers are initiated by the host.
Right after one year of the appearance of USB 1.0, a standard named Human Interface Device (HID) [4] was designed
based on USB. HID is designed to unify the implementation
for devices like keyboards, mice, etc. Before its appearance,
the standard is divided among manufacturers, for example, themouse of Company A may use X-Y coordinates to represent
its location while the mouse of Company B uses relative
displacement. This means every device needs its own driver
to work. After HID, users only need to write one driver foran entire class of HIDs. Furthermore, the HID standard also
requires all devices to be Plug-and-Play (PnP), which is indeed
convenient but insecure too.
In 1998, the ﬁrst widely supported USB protocol was
designed. USB 1.1 [8] provides two data transfer rates which
are low speed (1.5 Mbit/s) and full speed (12 MBit/s). At this2(D+ & D-). The added lanes are used exclusively to support
peripherals like DisplayPort while the kept data lane transfers
USB packets.
During the development of the USB speciﬁcation, security
was insufﬁciently considered [1]. The USB-IF believes it is theduty of Original Equipment Manufacturers (OEMs) to decide
whether security features should be implemented [16]. But
the divergent implementations give a chance for attacks like
BadUSB [10] and our BAD USB-C.

ofﬁcial list of MHL Devices [26] shows that the latest mobile
devices supporting MHL were released in 2015, which indicates the lack of support of MHL and limits the attack rangeof JFA. BAD USB-C attacks the victim’s device over USB
Type-C interface, the latest USB connector designed to replace
all previous USB connectors including MicroUSB [27]. So
BAD USB-C has a wider attack range.
Besides attacking from the protocol perspective, previous
works use a USB device as a payload delivery means.
Duqu [17] uses a user-mode rootkit to hide malicious ﬁleson the USB storage device, Flame [28] uses a zero-day
exploit and malicious autorun.inf to execute the malware
automatically. There are also works [29]–[31] following thesame paradigm and performing code-injection attacks. These
attacks are much more damaging and ﬂexible, but they require
certain existing ﬂaws like a zero-day vulnerability [32] andUSB is merely a payload delivery method.
As a data transmission protocol, USB inevitably leaks
electromagnetic signals to the environment which may containsensitive information. Leveraging this physical phenomenon,
previous works [25], [33]–[41] eavesdrop on the leaked signals
and recover the sensitive data. In a similar fashion, USBee [42]and TURNIPSCHOOL [43] emit electromagnetic emissions
by data injection on the bus with the connected USB devices
as an RF transmitter and USBKiller [44] injects analog power
to cause physical damage to the host machine. Even though thedata, including the video data, could be recovered in this way,these attacks for executing malicious code are too difﬁcult towork, and invisibility is a problem that cannot be ignored dueto the spatial locality of radio frequency.
Since USB 3.1 [12] was introduced with USB Type-C in
2013, DisplayPort and HDMI connectors have been provided
by USB Type-C, transferring of video data can be combinedwith the other attacks, like protocol masquerading, protocol
corruption, and code injection. This has paved the path for
our BAD USB-C.

III. R ELATED W ORK
We surveyed related works on USB attacks in Section III-A
and USB security defense in Section III-B, respectively.
A. USB Attacks
During the development of the USB protocol, many
USB-based attacks were proposed, ranging from Denial ofService (DoS) to protocol masquerading.
From the kernel perspective, its USB software stack generally expects devices to follow the USB standard and may
not consider corner cases of malformed USB packets. Basedon this, Facedancer [20] and Syzkaller [21] use fuzzing
techniques to uncover the bugs lying in the kernel drivers.
These bugs can cause kernel crashes and lead to a DoS attack.
Though this poses a great challenge to the availability of asystem, this attack still requires physical access to the victim’s
device and is unable to cause more damage other than DoS.
In the ﬁeld of USB security, protocol masquerading is also awidely used attack scheme. Due to the lack of authenticationin the USB protocol, malicious devices can hide their realfunctionality with re-written ﬁrmware [3], [10], [22]–[25].
These works rewrite the ﬁrmware of a normal-looking ﬂash
drive, which allows it to act like other devices. When these
modiﬁed drives are connected to the victim’s device, they
could be recognized as a keyboard or mouse. Then attackers
can execute malicious payloads as they are using the victim’s
device. Due to the limitation of USB 2.0 [9] protocol, these
BadUSB attacks [3] are unable to obtain video feedback fromthe victim’s device as video stream was not supported until
USB 3.0 [11].
Mobile High-Deﬁnition Link (MHL) extends the USB standard and allows the video signal to be transmitted throughthe USB interface even for USB 2.0 protocol. Juice Filming
Attacks (JFA) [18], abuses this standard and monitors thevictim’s device utilizing USB 2.0 protocol. Although JFA [18]
could exﬁltrates video data from the victim’s device without
permission, there are two main limitations compared withBAD USB-C: (1) JFA [18] can only exﬁltrate video datapassively from the victim’s device, while BAD USB-C cancontrol the victim’s device at the same time as monitoring
the screen. The data can only be collected by JFA after thevictim’s interaction, while BAD USB-C can gather sensitive
data actively through HID injections. For example, if a victim
leaves his/her phone charging without locking it, JFA cannot
conduct attacks in this case, while BAD USB-C can actively
control his/her device and gather sensitive information. (2) The

B. USB Security Defenses
Many defenses have been proposed to defend against
BadUSB attacks [1].
From the hardware perspective, the BadUSB attack requires(D+ & D-) pins which are deﬁned by the protocol to transmit
data. Without these pins, data cannot be transferred via a USB
cable. Based on this fact, USB Condom [45] is a hardware
solution to block data channels by adding a blocker in theconnector. This blocker can cut off the (D+ & D-) connection
while leaving the power pins intact. However, this method
poses a great challenge to the PnP property of USB, as once it
is deployed, it will stop all USB functions other than charging.
Under the premise of ensuring the full functionality of USB
devices, some works improve the security while establishing aconnection. Windows Defender ATP [46] maintains a whitelistof USB devices, only devices on the whitelist are allowed
to communicate with the host. This prevents all potential
attacks from untrusted devices, however, this requires users tohave a certain security awareness and technical background

3

Year

Protocol Version

Supported Peripherals

Transfer Speed

Attacks

1996

USB 1.x [7], [8]Keyboard, Mouse...

1.5 Mbit/s or 12 Mbit/s

HID Emulation (BadUSB) [3]2000

USB 2.0 [9]Flash Drive, High-Deﬁnition Link, CD Driver...

480 Mbit/s

Autorun Attack [17], Juice Filming [18], [19]2008

USB 3.0 [11]/5 Gbit/s/

2013

USB 3.1 [12]HDMI, DisplayPort, ThunderBolt...

10 Gbit/s

BAD USB-C

2017

USB 3.2 [13]/20 Gbit/s/

TABLE I: USB Protocol Timeline.

to maintain a valid whitelist. For example, a naive user
may add the USB device from unknown sources to his/herwhitelist without precaution. Fortunately, some designs havebeen proposed to overcome this drawback. For instance,
Mohammadmoradi et al. [47] propose a strategy to generatesuch a whitelist automatically. This strategy ﬁrst generates aunique ﬁngerprint for each device based on its functionality.
Then these ﬁngerprints are used to maintain a secure and valid
whitelist of USB devices. There is another work mediating
USB connectivity for industrial control. TMSUI [48] relieson the rich experience of administrators to build a whitelist.
However, some modiﬁed USB devices may hide their realfunctionality from the user.
To solve this ﬂaw, GoodUSB [5] reports the functionality
claimed by the USB device to the user and lets the user
decide whether to authorize. When a device is plugged in,
GoodUSB blocks its functionality before enumeration until
a series of authorizations are completed. These authorizations
are designed to be performed manually, thus the malicious devices will be detected if they make a different claim that does
not match the authorization results. USBeSafe [49] analyses
the feature vector constructed with the data collected fromUSB Request Blocks, detects the novel USB packets basedon the machine learning algorithm and sends an alert to theuser before enumeration. As BadUSB attacks normally request
privileged interfaces during enumerating, these defenses are
sufﬁcient for these attacks. Moreover, Mueller et al. [50]improve the security without changing the user experience.
It can detect the presence of the user, block malicious devices
in the user’s absence until the session is unlocked.
After the USB enumeration and driver loading, some related
works follow the defense in depth approach to defend against
BadUSB attacks. Neuner et al. [51] prevent BadUSB attacks
from the malicious ﬂash drive by analyzing the temporal characteristics of BadUSB-like attacks. This defense mechanism
is effective because the attacker cannot obtain the screen of
the victim’s device using BadUSB. In this case, the malicious
device can only inject keystrokes in a very short time to
reduce the risk of being discovered. This property causes thetyping characteristics of BadUSB to be detectable. Pham etal. [52] optimize Windows security features, which can block
the execution of unsigned ﬁles and the installation of unsigned
drivers carried on portable media. Moreover, in GoodUSB, a
VM is deployed in the host as a honeypot to detect and stop
malicious behavior of USB devices.
In addition to injection attacks, data theft attack is also oneof the focuses of the academic community. As mentioned in
Section III-A, there exists an attack called JFA [18] which
abuses the MHL standard to steal the video stream from thevictim’s mobile phone. In order to mitigate this issue, Meng etal. [53] propose a statistical model using status like GPU/CPU
usage to detect JFA attacks.
Therefore, there exists a clear trade-off between the effectiveness and the PnP property. Although hardware disabling
solutions like USB Condom achieve almost absolute security,
the functionality of USB is sacriﬁced. Other solutions likewhitelist are either bypassable or insufﬁcient under certain
scenarios. Vendors may sacriﬁce complete security to improveusability, which allows attackers to take advantage of.
We summarize the former efforts on USB attacks anddefenses in Table II. [25], [33]–[44], [54] are not included inthis table, because these works are all recovering or injecting
signal on the physical layer, we only illustrate the effectiveness of each defense against various attacks, including our
BAD USB-C, on the software layer in Table II.
IV. BAD USB-C
A. Threat Model
We build our threat model on a basic assumption that
common users without technical background would not treat
a normal-looking USB device as malicious and be cautious about them. This assumption is consistent with existing
works [19]. Moreover, we omit the effect of notiﬁcations fromUSB devices, as users may not have the knowledge to fully
understand such notiﬁcations.
We also assume the victim’s device is equipped with fully
functional USB 3.x protocol and USB Type-C connector. As
the USB 3.x standard is common nowadays, this assumption
can be fulﬁlled in recent devices.
B. Implementation
As introduced in Section III, existing works [3], [10], [22]–[25] focus on BadUSB attacks. Many of these take advantageof the trust-by-default policy of PC, pretend to be normal
HID devices and utilize the USB protocol to perform attacks.
However, these attacks suffer from various drawbacks: ¶attackers can only simulate limited types of devices suchas HIDs (e.g. keyboards and mice) and disks, which makes
the attacks less effective; · accurate attacks could not be
performed due to a lack of UI status. Whatever HIDs theattackers simulate their USB devices to be, they could not
obtain the UI to check the status information, which makes it

4

Attack
DefenseFacedancer [20],Syzkaller [21][3], [10], [22]–[25]JFC [18]

Duqu [17],[28]–[31]

BAD USB-C

USB condom [45]Windows Defender ATP [46],Mohammadmoradi et al. [47],TMSUI [48]GoodUSB [5]USBeSafe [49]Mueller et al. [50]Neuner et al. [51]Pham et al. [52]
JFCGuard [53]means that the defense is effectivemeans that the defense is partial effectivemeans that the defense is not effective

TABLE II: Effectiveness of Defenses against USB Attacks

nearly impossible to carry out their attacks precisely or know
the effects after attacks.
Based on the drawbacks introduced above, several defense
mechanisms were proposed. For example, GoodUSB [5] implements an authorization procedure when a new device isplugged in and blocks other functions except authorized ones.
In this work, we utilize the new features of USB 3.x [12],[13] to address the problems above. Beneﬁting from the latest
protocol, we simulate an external display and thus obtainthe video stream to perform accurate attacks. However, weare still unable to bypass defenses like GoodUSB [5], which
completely blocks unauthorized functionality. This will befurther discussed in Section VII
As there were various BadUSB implementations available,
this work focuses on our new extensions. Next, we ﬁrst
introduce the components we used in BAD USB-C, then we
focus on the three different attack modes we implement forvarious scenarios.
1) Attack Model: Figure 3 shows the architecture of our
1 represents the victim’s devices;
2 isattack model.
our BAD USB-C; 3 is the attacker’s remote PC. The detailsof each component in BAD USB-C are as follows.

1

Victim’s Devices

3

Attacker’s Remote PC

2

BAD USB-C

Fig. 3: Attack Model.

to the victim. These constructed HID packets are interpretedby the victim as valid keystrokes and mouse movements. Thus,
attackers can execute arbitrary scripts on the victim’s device.
This is the function of BadUSB. Based on this, we made thefollowing improvements.
First, as BAD USB-C has established a feedback channel
using USB 3.x protocol, when performing keystroke andmouse movements injection, an attacker can obtain real-time
feedback from the victim’s device. This feedback allows an
attacker to tell whether the previous attack succeeded anddecide what to perform next. Existence of such a feedback
channel largely strengthens the attack ability of BAD USB-C.
Moreover, as the mouse relies on the visual feedback towork properly, its emulation and automation were not supported by the original version of BadUSB. Yet with the video
output support from USB 3.x, our BAD USB-C implements
a fully-functional mouse emulation. This function enables
attacks toward pure GUI programs and shows potential in themobile attack scenarios. Details can be obtained in Section V.

USB 3.x Hub exports the USB 3.x connector into various
ports, like DisplayPort, USB 2.0 port, etc.
• Video Capture Card converts DisplayPort signal into
compatible data, which is later processed by the Single
Board Computer (i.e., an embedded computer).
• HID Emulator emulates HID device which can be controlled by the attacker.
• Single Board Computer processes the video stream fromthe victim via the Video Capture Card or sends commands
to the victim via HID Emulator.
• Wi-Fi/GSM Module transmits the sensitive data or receives commands to/from the remote attacker PC.
•

HID Emulation Mode. This mode mainly relies on the“HID Emulator” in Figure 3 to send constructed HID packets

5The advantage of this mode is that it achieves attack
feedback with video streaming. Also, with mouse supported,BAD USB-C extends the original BadUSB attack and resultsin further attacks.
Video Capture Mode. BAD USB-C under this mode does
not emulate other USB device and solely relies on the video
stream function of USB 3.x; it uses the “Video Capture”
component as shown in the Figure 3 to transmit the stream tothe embedded “Single Board Computer”. The victim’s device
mistakenly treats BAD USB-C as an external monitor andoutput its video stream. This stream is later processed by theembedded computer to extract sensitive data.
When running in this mode, BAD USB-C passively processes the victim’s video stream and detects “valuable” private data. The data is considered as “valuable” or not by acustomized detector. We implemented a simple payment code
detector for the proof-of-concept purpose, which demonstrates
that we successfully transfered money from a victim to an
attacker. More detail can be obtained in Section V.
It is worth mentioning that BAD USB-C under this mode
is completely passive, making it hard to be detected. Withdifferent detectors implemented, BAD USB-C under this modeis capable of serving more purposes.
Full Control Mode. In BAD USB-C, we have implemented
all components required to control a computer/mobile device
completely, including a video stream and a keyboard/mouseemulation. Thus with all components enabled, not only does
the victim’s device treat BAD USB-C as an external display,
but also a valid HID input source. Hence we can achievecomplete hijack of the victim’s device.
BAD USB-C under this mode follows a simple logic.
BAD USB-C receives video stream from the victim’s device and redirects it to the attacker via GSM/WiFi. In the
meanwhile, BAD USB-C also receives keystrokes and mouse
movements from the attacker through GSM/WiFi and replaysthem to the victim’s device by the USB emulation.
This mode enables attackers to perform delicate operations
that are beyond automation. Moreover, this mode provides a
backdoor that does not require a host network and thus isundetectable by the ﬁrewall running on the host machine.
The advantage of this mode is that it can completely hijack
the victim’s device and provides a backdoor beyond detectionof ﬁrewalls; however, this complete control also comes withthe price of high power consumption and risk of being detectedby the user.

A

Victim’s Device

B

BAD USB-C

1

USB 3.x Hub

2

Raspberry Pi 4B

3

Auxiliary Power Bank

4

Video Capture

5

ATMEGAA32U4 Board
Fig. 4: BAD USB-C Prototype.

BAD USB-C, which is powerful enough to process video dataand has an onboard WiFi chip. As for the HID Emulator, weused an Atmel ATMEGA32U4 board [56] with USB protocol
support, which is able to emulate multiple HIDs with our
modiﬁed ﬁrmware. About the USB 3.x Hub, we used one fromUGREEN [57], which supports HDMI, USB 2.0, and manyother exported peripherals. Apart from these essential parts, we
also used an auxiliary power bank to provide power for the
Raspberry Pi and the mobile devices used by the victim. The
image of our BAD USB-C prototype can be found in Figure 4.
A is a HUAWEI mobile phone, the victim’s device;B
is a compact look of BAD USB-C prototype; 1 is the USB
2
3.x Hub;
is a Raspberry Pi 4B as the Single Board
Computer; 3 is an auxiliary power bank; 4 is the Video
Capture Card; 5 is an Atmel ATMEGA32U4 board as the
HID Emulator.
A. Attack Initialization
After the BAD USB-C is plugged into the victim’s device,
there is an initialization process to make sure the BAD USB-C
is able to carry out subsequent attacks.
• Screen Mirroring: During our experiment, we noticed
that some devices did not mirror their main displays to
our BAD USB-C by default. In this case, BAD USB-C
would inject a series of keystrokes to mirror the victim’s primary display. On both Windows 10 and Ubuntu(Gnome Desktop), BAD USB-C can inject “Win+P” (the“Win” key is the “Super” key on Windows and Ubuntu
by default) to switch the display modes for the external
display. Figure 5 illustrates how these keystrokes workon Ubuntu, similar to that on Windows 10. On MacOS,
according to the ofﬁcial manual [58], BAD USB-C caninject “Command+F1” keystrokes to mirror the victim’s
primary display. In EMUI, there is a special mode called“Desktop Mode” that allows users to use their smartphones as desktop computers with external displays. If

V. E XPERIMENT
To evaluate the effectiveness of BAD USB-C in different
modes, we conducted three experiments on BAD USB-C using
devices with USB Type-C capabilities from different OEMs,
including a mobile phone, a tablet, and a laptop.
Setup. As mentioned in Section IV, our BAD USB-C only
requires common components that are easy to access online
or in any electronic store. Here we chose the following parts
to build a prototype. To begin with, we chose the Raspberry
Pi 4B [55] as the embedded Single Board Computer inside

6

this mode is enabled, since the victim’s “desktop” canbe obtained, BAD USB-C can inject mouse movements
to switch to mirror mode.

the target device. In the privacy extraction experiment,
BAD USB-C passively captured video from the victim’s
device and used OpenCV to identify the sensitive informationfrom the video stream. When the victim viewed text or
photos with text, BAD USB-C used the techniques of
Optical Character Recognition (OCR) to extract text fromcorresponding video frames. In this experiment, the attacker
successfully extracted text such as name, address, ID number,and other sensitive personal information. We also tested thepayment code extractor, which enables an attacker to identify
payment code in the video stream and performs transactions
without the password. During our experiment, we noticed
that this HUAWEI device supports “Desktop Mode” for its
external display, which enable users to use their devices
as if they were using a computer with an external display.
If BAD USB-C is set into this mode, BAD USB-C is able
to inject mouse movements to set itself into mirroring the
primary display, as we discussed in Section V-A. As this isalso a part of our case study, more details about the extracted
sensitive data can be found in Section V-E and Table III.
Note that the video capture mode only needs to process thevictim’s video stream locally, it does not need to transmit thereal-time video back to the attacker, which is useful when the
network connection between BAD USB-C and the attacker is
not stable.

Fig. 5: Switching Display Mode on Ubuntu.
•

Dismiss Notiﬁcation: In our experiment, we found thatsome devices would notify the user of the presence of an
external display. During our experiment, the following
notiﬁcations were raised:– On Lenovo Xiaoxin Pro 13, it raised a pop-up asking
user to choose the functionality of the external display.
– On HUAWEI P30, it showed a status bar indicator anda persistent notiﬁcation about the external display.
– On iPad Pro (the third generation), if iPad is locked, italso showed a blue status bar indicator and a notiﬁcation about USB accessories.
To avoid being discovered by the victim, BAD USB-C
can inject keystrokes and mouse movements to eliminate
some of these notiﬁcations. For example, in the ﬁrst
case, BAD USB-C is able to inject a series of mouse
movements to set the display to mirror mode, thereby
eliminating the pop-up.

D. Full Control Mode
To test the capability of the full control mode, we chose
iPad Pro (3rd generation), a tablet running iOS 14.4 (Build
18D52) with a USB Type-C interface, as the target device inthis experiment. In addition to disguising themselves as normal
HIDs like a conventional BadUSB [3], BAD USB-C alsotransmitted the real-time video stream from the target device
to the attacker via WiFi. After establishing the connection,
the attacker performed a series of actions to test the capabilityof BAD USB-C. In the beginning, the attacker accessed thealbum application on the iPad and obtained all the photos
inside. After that, the attacker sent messages via the victim’s
account. At last, the attacker performed a transaction using aﬁnancial application. All of these tests resulted in success.
Through this experiment, we have found that with video
transmission and mouse emulation, BAD USB-C extensively
expanded the attack capability of BadUSB, especially inmobile devices. In short, we have achieved the complete hijackof the victim’s device in this experiment.

B. HID Emulation ModeIn the experiment of HID emulation mode, we used
Lenovo Xiaoxin Pro 13 2020, a PC with Windows 10(OS Build 18363.1379) and Ubuntu 20.04.2 LTS with two
USB Type-C interfaces as the target devices. During thisexperiment, BAD USB-C disguised itself as a normal keyboard
and an external display as a feedback channel. When ﬁrst
plugged in, the victim’s device raised a pop-up window
asking the victim which mode should the new screen be
set to. BAD USB-C immediately injected a series of mouse
movements and clicks to set itself as a mirror to the primary
display. Thus we had successfully completed the attack initialization. Then we tested three scripts, ranging from reverseshell backdoor to malware payload execution, all of them
resulted in success. Compared with original BadUSB attacks
like Rubber Ducky, our BAD USB-C can provide attackers
real-time feedback, which allows attackers to conduct moreaccurate attacks.

E. Case study
BAD USB-C can be used in various attack scenarios,
ranging from mobile devices to PC devices. For example,
BAD USB-C can be attached to the power station, which
provides USB 3.x hubs, in the airport to perform attacks.
Most people charge laptops or smartphones in the power
station in emergency, with negligence of security. In thefollowing paragraphs, we will demonstrate the attack scenariosof BAD USB-C using sharing power bank as an example.

C. Video Capture Mode
During the experiment of privacy extraction via ourvideo capture mode, we chose HUAWEI P30 (ELE-AL00),asmartphonein
EMUI 11.0.0.135(C00E128R2P5)(Android 10.0 based) with a USB Type-C interface, as

7

Fig. 6: Two Power Bank Stations.
Fig. 7: Bar/QR Code Payment Procedure.

1) Background: We ﬁrst introduce the technical background of our case study, sharing power banks and QR code
payment.
Sharing Power Banks. Sharing power banks provides users
with short-term rental of power banks. The company deploys
power bank stations in the city and users can rent a powerbank from any of the power bank stations, charge their device
on the trip, return the rented power bank to the near stations,and pay the rental fee.
Power bank sharing is a popular service in Asia, power bankstations are deployed in markets, stores, and even newsstands.
For example, Figure 6 are photos of two power bank stations in
China, which are taken outside of a supermarket. Brick [59] isalso such a power bank sharing service provider from Sweden.
It provides power bank rental service all over Sweden and isplanning on expanding its service to entire Europe.
Sharing power banks bring convenience but also security
issues. We noticed that most of the power bank stations do
not check the integrity of the power bank during the rental
process, and users rarely check the power banks carefully
when connecting the power bank to their devices. An attacker
can tamper with a rented power bank and return it to a powerbank station, thereby posing a potential threat to subsequent
users.
QR Code Payment. QR code payment is a new payment method popular in Asia. The most famous cases are
WeChat Pay [60] and Alipay [61]. QR code payment provides
merchants and customers with a convenient ofﬂine payment
method while ensuring equivalent security as credit cards.
As illustrated in Figure 7, QR code payments are typically
performed in the following steps: (1) The customer shows the
QR payment code to the merchant on the mobile device. The
QR code is encoded with a globally unique ID to identify thecustomer’s account. (2) The merchant scans the QR payment
code and charges the corresponding amount. By showing thisQR code, the customer authorizes the proceeding transaction.
(3) After conﬁrmation, the payment service provider proceedswith this transaction and returns the payment result to boththe merchant and the customer.
Next, we explain a payment method called micropayment.
A micropayment is pre-determined by the payment service
provider according to the threshold in the user agreement.
In the real world, payment service providers use different

rules for micropayment purchases. For example, WeChat
Pay [60] treats transactions under US$154 as micropayments.
Different from the typical payment procedure, when marking
micropayments, conﬁrmations can be automatically applied
without the customer’s permission, which aims to provide
convenience for both merchant and customer. If the victim’s
payment code is leaked to the attacker, the attacker can use thecode to authorize multiple micropayments without permission.
In order to prevent this situation, both WeChat Pay [60]and Alipay [61] have designed a mechanism to refersh thepayment code every minute. This is sufﬁcient to prevent
attacks like opportunistic theft of a payment code, but cannot
prevent real-time attacks like our BAD USB-C. In summary,
the QR payment code is highly sensitive on users’ devices. Th
following case study is about how to use an attacker-crafted
power bank via BAD USB-C to obtain this code.
2) Attack Scenario: In this part, we will introduce a reallife attack scenario to show that our BAD USB-C is a practicaloffensive tool. This scenario can be broken down into thefollowing steps.
I. The attacker rents a power bank from one of the powerbank stations and replaces the internal components withBAD USB-C.
II. After the modiﬁcation, an attacker-crafted power bank isreturned to the rental station in crowded areas like airports
or railway stations, which increases the probability ofsuccess.
III. A user borrows the modiﬁed power bank and connects it
to his/her own device, becoming a victim of BAD USB-C.
IV. The attacker can now fully control the victim’s device
and can use different modes for various attacks.
Next, we summarize the possible threats toward the victim
under different modes. First, under HID emulator mode, theattacker is able to implant malware and backdoor scripts into
the victim’s device. Moreover, using video capture mode,
once the victim accesses his/her sensitive data such as QR
payment code or photos, the sensitive data will be immediatelytransmitted to the attacker via BAD USB-C. Lastly, with fullcontrol mode, the attacker can completely control over thevictim’s device and can perform any operations on the victim’s

8device.
3) Experiment: We conducted experiments to further validate the capabilities of BAD USB-C in the attack scenario
introduced in Section V-E2. 11 applications were selected andtested on HUAWEI P30 (ELE-AL00) step by step: (1) Loginin with a test account. (2) Keep the default settings. (3) Attach
attacker’s BAD USB-C to the test device. (4) Simulate victim’s
daily usage of the application.
During this experiment, we tested full control mode which
actively obtained sensitive information and video capture mode
which passively obtained the sensitive information visited by
the victim. We noticed that, most sensitive information could
be obtained directly through full control mode without victim’s
interaction, but there was also certain information that had
to be obtained passively through video capture mode. For
example, as illustrated in Table III, in most applications,information like “Account” can be obtained directly while
information like “Payment Password” cannot be obtained untilthe victim inputs his/her password.
4) Result: In summary, BAD USB-C is able to actively
obtain most sensitive information from the screen, such asbrowsing history, personal account, phone number without
victim’s interaction. There also exists information such as
payment password that is not available immediately, but sucha piece of information can be obtained once the victim inputs
it. The obtained information can be used to guess the victim’s
lock screen password and poses further threat to victim’s
privacy.

Fig. 8: Isolated UI Rendering

only available on the internal display. However, this defense
is only enabled on the lock screen keyboard, other keyboards(e.g., the virtual ones used by the apps) are still vulnerable
to our BAD USB-C. This mechanism has inspired us to propose a new defense against our BAD USB-C called Isolated
UI Rendering. As illustrated in Figure 8, we designed two
separated UI render layers and corresponding drivers, one issecure the another is insecure. When an application requires
to render, it can pass the content along with a tag identifying
whether the content is “sensitive” or not. If the content istagged with “sensitive”, then the OS could only render it on
the secure layer, which only shows the sensitive content (e.g.,a keyboard) on the trusted screen. For the rest of the rendering,
it would render on both the trusted and untrusted display (e.g.,insensitive contents). For example, in Figure 8, the “password”
and “keyboard” are recognized as sensitive while other parts ofcontent are insensitive. Thus, the “password” and “keyboard”
are not rendered on untrusted screen.

VI. C OUNTERMEASURES
Next, we discuss our recommended countermeasures against
BAD USB-C.
External Hardware Authorization. One possible countermeasure is to introduce external hardware completing theauthorization process. For example, USBCheckIn [62] adopts
a dedicated hardware between the host and device. When adevice is plugged-in, the authorization will be conducted on
the dedicated hardware instead of the internal display, preventing the host from being hijacked. Although USBCheckIn is anadequate defense against BAD USB-C, the external hardware
brings additional cost and inconvenience, especially for mobile
devices.
Distrust-by-Default. Most security issues of USB protocol
are due to its trust-by-default assumption; BAD USB-C alsorelies on this feature to work. To defend against BAD USB-C
and other USB-based attacks, we can simply reject all unauthorized devices – applying the distrust-by-default policy. For
example, in GoodUSB [5], all USB devices are enabled withcorresponding functionality only after being authorized by
the user. Defense like USB Condom distrusts all types ofUSB devices by blocking data channels and stopping all
USB functions other than charging. Such defense methods
effectively stop attacks like BAD USB-C.
Isolated UI Rendering. During our experiments, we noticed that BAD USB-C is actually unable to mirror the lockscreen keyboard from the iPad OS. Instead, the keyboard isVII. D ISCUSSION
A. Limitation
There exist multiple limitations of BAD USB-C. To begin
with, when BAD USB-C is attached, the victim’s device may
not be set to mirror the screen. Depending on the victim’s
settings, the BAD USB-C may be used as an extended monitor
or be set to ‘Desktop Mode’ or not be enabled at all. Though
we proposed the attack initialization in Section V-A to inject
keystrokes to ensure BAD USB-C is mirroring primary screen.
But without knowing the exact operating system of the victim’s
device, BAD USB-C may have to try multiple injections before
successfully mirroring the screen. Moreover, as mentioned in
Section V, BAD USB-C cannot directly obtain the informationon the lock screen. Apart from that, we also noticed thatin most devices, when an external monitor is connected tothe device, there will be notiﬁcations about the monitor.
In iPad, there is a small blue icon in the notiﬁcation bar.
In Windows 10, there is a pop-up for user to select thefunctionality of the external monitor. In latter case of a popup, BAD USB-C can dismiss it by injecting keystrokes as
described in Section V-A. But they are still noticeable by
the victim. Also, it cannot be ignored that DisplayPort over9

Application

Leaked Sensitive Information
Without Victim’s Interaction
With Victim’s Interaction

Social & Finance App

WeChat (8.0.1)

Account, Financial Status, Chat History, Payment Code

Payment Password

Social App

WhatsApp (2.21.5.18)
Facebook (309.0.0.47.119)

Account, Contacts, Chat History, Phone Number
Account, Posts, Contacts<None><None>

Finance App

Alipay (10.2.15.9500)
Cash App (3.35.1)
Paypal (7.38.1)

Account, Financial Status, Payment Code
Email, Phone Number, Cash Balance
Account, PayPal Balance

Payment Password
Payment Password
Payment Password

Shopping App

Amazon Shopping (22.6.0.100)

Account, Orders, Shopping Cart

<None>

Tool

Chrome (89.0.4389.72)
Health (11.0.5.508)

Browsing History
Personal Health Metrics<None><None>

SystemMessages (11.0.1.430)
Settings (11.0.0.300) - WiFi
Settings (11.0.0.300) - VPN

Contacts, Chat History
WiFi SSID
VPN Address, VPN Account, VPN Password<None>
WiFi Password<None>

Category

TABLE III: Sensitive Information Leaked From Applications.

USB Type-C is not available on all devices. When selecting
devices to test BAD USB-C, we ﬁnd that many smartphones
equipped with USB-C connectors actually do not support
USB 3.x protocol. There is an incomplete list of devices that
support DisplayPort over USB Type-C [6]. Most vendors like
HUAWEI and Samsung tend to support USB 3.x protocol intheir high-end smartphones. But there also exists vendors like
Xiaomi who does not support USB 3.x protocol at all.

and analyze video stream extracted from 11 applications withBAD USB-C, which demonstrates its capability in a simulated
real-life scenario. In the end, we propose a new defense
scheme named isolated UI rendering, which can effectively
stop attacks with BAD USB-C. As for future work, we willfurther explore the potential of isolated UI rendering andimplement it on a customized operating system. Moreover,
we also hope to lower the power consumption for networktransmission in BAD USB-C to make it more practical.

B. Impact

IX. R ESPONSIBLE D ISCLOSURE
Responsible disclosure have already been carried out, wehave contacted HUAWEI and Apple through proper channels.
We received response from HUAWEI on March 7th anddiscussed the mitigation plan on March 10th while Apple
has not responded yet. HUAWEI security team has conﬁrmed
this issue and been working on mitigation. We are actively
facilitating their mitigation process and waiting for a ﬁx to
be deployed. After the mitigation is deployed, HUAWEI willassign a CVE ID for this vulnerability.

The USB protocol is used widely as introduced in thepreceding sections. As the technologies develop rapidly, more
and more devices will be equipped with USB-C capabilities [27], which makes BAD USB-C more inﬂuential. Since
non-professional users may neglect checking the security ofplug-in USB devices, they may unaware of the attacks fromBAD USB-C. can be hardly detected by them while attacks are
performing. The popularity and universality of public USB
devices, including sharing power banks, even increase suchrisks. Moreover, BAD USB-C provides a better way for traditional BadUSB attacks, since attackers can obtain the screen
streaming with ease. Attackers can use such technologies toperform more precise attacks, such as interacting with the userinterface and controlling the consequences of their attacks. In
summary, BAD USB-C can be applied in various application
scenarios and brings rather huge impacts.

X. ACKNOWLEDGEMENT
We are very grateful to our shepherd, Michael Schwarz,
and the anonymous reviewers for their valuable feedback that
improved the paper.
R EFERENCES[1] J. D. Tian, N. Scaife, D. Kumar, M. Bailey, A. Bates, and K. R. B.
Butler, “Sok: "plug & pray" today - understanding USB insecurity
in versions 1 through C,” in 2018 IEEE Symposium on Security
and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco,California, USA. IEEE Computer Society, 2018, pp. 1032–1047.
[Online]. Available: https://doi.org/10.1109/SP.2018.00037[2] “Common vulnerabilities and exposures,” 2020. [Online]. Available:
https://cve.mitre.org/[3] K. Nohl and J. Lell, “Badusb-on accessories that turn evil,” Black Hat
USA, vol. 1, no. 9, pp. 1–22, 2014.
[4] USB-IF, “Device class deﬁnition for human interface devices (HID),”
2001.
[5] J. D. Tian, A. Bates, and K. R. B. Butler, “Defending against malicious
USB ﬁrmware with goodusb,” in Proceedings of the 31st Annual
Computer Security Applications Conference, Los Angeles, CA, USA,
December 7-11, 2015. ACM, 2015, pp. 261–270. [Online]. Available:
https://doi.org/10.1145/2818000.2818040

VIII. C ONCLUSION
Leveraging the new features of USB 3.x [11]–[13], we
explore a new attack scheme named BAD USB-C and threeattack modes. Each of these three modes has its own strengthand use scenarios. The HID emulation mode largely extends
the original BadUSB. The video capture mode proved practicaland powerful, as it extracts victim’s sensitive information ina stealthy way. The full control mode achieves the complete
hijack of the target device, allowing us to perform various
types of subsequent attacks. By experimenting BAD USB-C
with mobile phones, tablets, and PCs, we further test its
ability under different modes. In our experiment, we obtain10[6] EverybodyWiki, “List of devices with video output over usb-c,”
2021. [Online]. Available: https://en.everybodywiki.com/List_of_
devices_with_video_output_over_USB-C#Devices_with_DisplayPort_
Alternate_Mode_over_USB-C[7] Compaq, D. E. Corporation, I. P. Company, Intel, Microsoft, NEC, and
N. Telecom., Universal Serial Bus Speciﬁcation, Revision 1.0, January
1996.
[8] ——, Universal Serial Bus Speciﬁcation, Revision 1.1, September 1998.
[9] ——, Universal Serial Bus Speciﬁcation, Revision 2.0, April 2000.
[10] Hak5, “Episode 709: Usb rubber ducky part 1,” 2013. [Online].
Available: http://hak5.org/episodes/episode-709[11] I. HP et al., “Universal serial bus 3.0 speciﬁcation,” 2008.
[12] ——, “Universal serial bus 3.1 speciﬁcation,” 2013.
[13] I. M. R. S. Apple, Hewlett-Packard and T. Instruments., “Universal serialbus 3.2 speciﬁcation,” 2017.
[14] G. Chandler et al., Universal Serial Bus Type-C Cable and Connector
Speciﬁcation.
[15] “USB implementers forum,” 1995. [Online]. Available: https://www.
usb.org/about/[16] USB-IF, “USB-IF statement regarding USB security,” 2014.
[17] P. Szor, “Duqu–threat research and analysis,” McAfee Labs, 2011.
[18] W. Meng, L. W. Hao, M. S. Ramanujam, and S. P. T. Krishnan,“Charging me and I know your secrets!: Towards juice ﬁlming attacks
on smartphones,” in Proceedings of the 1st ACM Workshop on CyberPhysical System Security, CPSS 2015, Singapore, Republic of Singapore,
April 14 - March 14, 2015, J. Zhou and D. Jones, Eds. ACM, 2015, pp.
89–98. [Online]. Available: https://doi.org/10.1145/2732198.2732205[19] W. Meng, L. W. Hao, Z. Liu, C. Su, and Y. Li, “Evaluating theimpact of juice ﬁlming charging attack in practical environments,” inInformation Security and Cryptology - ICISC 2017 - 20th International
Conference, Seoul, South Korea, November 29 - December 1, 2017,
Revised Selected Papers, ser. Lecture Notes in Computer Science,
H. Kim and D. Kim, Eds., vol. 10779. Springer, 2017, pp. 327–338.
[Online]. Available: https://doi.org/10.1007/978-3-319-78556-1_18[20] GoodFET, “Facedancer21,” 2016. [Online]. Available: http://goodfet.
sourceforge.net/hardware/facedancer21[21] Google, “Found linux kernel usb bugs,” 2017. [Online].
Available: https://github.com/google/syzkaller/blob/master/docs/linux/
found_bugs_usb.md[22] A. D. Ramadhanty, A. Budiono, and A. Almaarif, “Implementation andanalysis of keyboard injection attack using usb devices in windows
operating system,” in 2020 3rd International Conference on Computerand Informatics Engineering (IC2IE), 2020, pp. 449–454.
[23] J. Bang, B. Yoo, and S. Lee, “Secure usb bypassing tool,” digital
investigation, vol. 7, pp. S114–S120, 2010.
[24] M. Brocker and S. Checkoway, “iseeyou: Disabling the macbook
webcam indicator LED,” in Proceedings of the 23rd USENIX
Security Symposium, San Diego, CA, USA, August 20-22,
2014, K. Fu and J. Jung, Eds. USENIX Association, 2014,
pp. 337–352. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity14/technical-sessions/presentation/brocker[25] S. Kamkar, “Usbdriveby.” 2014. [Online]. Available: http://samy.pl/usbdriveby/[26] MHL, “Mhl devices,” 2021. [Online]. Available: http://www.mhltech.
org/devices.aspx?tid=1[27] A. Li, “Usb type-c for machine vision,” Quality, pp. 16VS–17VS, 2018.
[28] K. Zetter, “Meet ﬂame,the massive spy malware inﬁltrating iraniancomputers,” Wired Magazine, 2012.
[29] H. J. Highland, “The brain virus: fact and fantasy,” Computers &Security, vol. 7, no. 4, pp. 367–370, 1988.
[30] “Common vulnerabilities and exposures,” 2010. [Online]. Available:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2568,[31] S. Shin and G. Gu, “Conﬁcker and beyond: a large-scale empirical
study,” in Twenty-Sixth Annual Computer Security Applications
Conference, ACSAC 2010, Austin, Texas, USA, 6-10 December 2010,
C. Gates, M. Franz, and J. P. McDermott, Eds. ACM, 2010, pp.
151–160. [Online]. Available: https://doi.org/10.1145/1920261.1920285[32] Z. Wang and A. Stavrou, “Exploiting smart-phone USB connectivity forfun and proﬁt,” in Twenty-Sixth Annual Computer Security Applications
Conference, ACSAC 2010, Austin, Texas, USA, 6-10 December 2010,
C. Gates, M. Franz, and J. P. McDermott, Eds. ACM, 2010, pp.
357–366. [Online]. Available: https://doi.org/10.1145/1920261.1920314[33] ——, “Exploiting smart-phone USB connectivity for fun and proﬁt,”
in Twenty-Sixth Annual Computer Security Applications Conference,

ACSAC 2010, Austin, Texas, USA, 6-10 December 2010, C. Gates,
M. Franz, and J. P. McDermott, Eds. ACM, 2010, pp. 357–366.
[Online]. Available: https://doi.org/10.1145/1920261.1920314[34] K. Sridhar, S. Prasad, L. Punitha, and S. Karunakaran, “Emi issues ofuniversal serial bus and solutions,” in 8th International Conference on
Electromagnetic Interference and Compatibility. IEEE, 2003, pp. 97–
100.
[35] A. Davis, “Revealing embedded ﬁngerprints: Deriving intelligence fromusb stack interactions,” Blackhat USA, 2013.
[36] Y. Su, D. Genkin, D. C. Ranasinghe, and Y. Yarom,“USB snooping made easy: Crosstalk leakage attacks on USB
hubs,” in 26th USENIX Security Symposium, USENIX Security
2017, Vancouver, BC, Canada, August 16-18, 2017, E. Kirda
and T. Ristenpart, Eds.
USENIX Association, 2017, pp.
1145–1161. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity17/technical-sessions/presentation/su[37] mich., “Inside a low budget consumer hardware espionage implant.”
2017. [Online]. Available: https://ha.cking.ch/s8datalinelocator[38] A. Bates, R. Leonard, H. Pruse, D. Lowd, and K. R. B.
Butler, “Leveraging USB to establish host identity using
commodity devices,” in 21st Annual Network and Distributed
System Security Symposium, NDSS 2014, San Diego, California, USA, February 23-26, 2014.
The Internet Society,2014. [Online]. Available: https://www.ndss-symposium.org/ndss2014/leveraging-usb-establish-host-identity-using-commodity-devices[39] K. Nohl, “Badusb exposure: Hubs,” 2014. [Online]. Available:
https://opensource.srlabs.de/projects/badusb/wiki/Hubs[40] L. Letaw, J. Pletcher, and K. R. B. Butler, “Host identiﬁcation via
USB ﬁngerprinting,” in 2011 IEEE Sixth International Workshop on
Systematic Approaches to Digital Forensic Engineering, SADFE 2011,
Oakland, CA, USA, May 26, 2011, R. F. Erbacher, R. H. Campbell,
and Y. Guan, Eds. IEEE Computer Society, 2011, pp. 1–9. [Online].
Available: https://doi.org/10.1109/SADFE.2011.9[41] D. F. Oswald, B. Richter, and C. Paar, “Side-channel attacks on
the yubikey 2 one-time password generator,” in Research in Attacks,
Intrusions, and Defenses - 16th International Symposium, RAID 2013,Rodney Bay, St. Lucia, October 23-25, 2013. Proceedings, ser. Lecture
Notes in Computer Science, S. J. Stolfo, A. Stavrou, and C. V. Wright,
Eds., vol. 8145. Springer, 2013, pp. 204–222. [Online]. Available:
https://doi.org/10.1007/978-3-642-41284-4_11[42] M. Guri, M. Monitz, and Y. Elovici, “Usbee: Air-gap covert-channel
via electromagnetic emission from USB,” in 14th Annual Conference
on Privacy, Security and Trust, PST 2016, Auckland, New Zealand,
December 12-14, 2016. IEEE, 2016, pp. 264–268. [Online]. Available:
https://doi.org/10.1109/PST.2016.7906972[43] TURNIPSCHOOL, “Nsa playset.” [Online]. Available: http://www.
nsaplayset.org/turnipschool[44] “Usbkiller,” 2016. [Online]. Available: https://www.usbkill.com/[45] INT3.CC, “The original usb condom,” 2018. [Online]. Available:
https://int3.cc/collections/usb/products/usbcondoms[46] Microsoft, “How to control usb devices and other removable
media using microsoft defender for endpoint,” 2018. [Online].
Available:
https://docs.microsoft.com/en-us/windows/security/
threat-protection/device-control/control-usb-devices-using-intune#
prevent-installation-of-speciﬁcally-prohibited-peripherals[47] H. Mohammadmoradi and O. Gnawali, “Making whitelisting-based
defense work against badusb,” in Proceedings of the 2nd International
Conference on Smart Digital Environment, ICSDE 2018, Rabat,
Morocco, October 18-20, 2018, F. E. Bouanani and A. Habbani, Eds.
ACM, 2018, pp. 127–134. [Online]. Available: https://doi.org/10.1145/
3289100.3289121[48] B. Yang, Y. Qin, Y. Zhang, W. Wang, and D. Feng, “TMSUI:
A trust management scheme of USB storage devices for industrial
control systems,” in Information and Communications Security 17th International Conference, ICICS 2015, Beijing, China, December
9-11, 2015, Revised Selected Papers, ser. Lecture Notes in Computer
Science, S. Qing, E. Okamoto, K. Kim, and D. Liu, Eds.,
vol. 9543. Springer, 2015, pp. 152–168. [Online]. Available:
https://doi.org/10.1007/978-3-319-29814-6_13[49] A. Kharraz, B. L. Daley, G. Z. Baker, W. Robertson, and E. Kirda,“USBESAFE: an end-point solution to protect against usb-based
attacks,” in 22nd International Symposium on Research in Attacks,
Intrusions and Defenses, RAID 2019, Chaoyang District, Beijing,

11

China, September 23-25, 2019. USENIX Association, 2019, pp. 89–
103. [Online]. Available: https://www.usenix.org/conference/raid2019/presentation/kharraz[50] T. Mueller, E. Zimmer, and L. de Nittis, “Using context and provenanceto defend against usb-borne attacks,” in Proceedings of the 14th
International Conference on Availability, Reliability and Security, ARES
2019, Canterbury, UK, August 26-29, 2019. ACM, 2019, pp. 1:1–1:9.
[Online]. Available: https://doi.org/10.1145/3339252.3339268[51] S. Neuner, A. G. Voyiatzis, S. Fotopoulos, C. Mulliner, and E. R.
Weippl, “Usblock: Blocking usb-based keypress injection attacks,” inData and Applications Security and Privacy XXXII - 32nd Annual IFIP
WG 11.3 Conference, DBSec 2018, Bergamo, Italy, July 16-18, 2018,
Proceedings, ser. Lecture Notes in Computer Science, F. Kerschbaum
and S. Paraboschi, Eds., vol. 10980. Springer, 2018, pp. 278–295.
[Online]. Available: https://doi.org/10.1007/978-3-319-95729-6_18[52] D. V. Pham, M. N. Halgamuge, A. Syed, and P. Mendis, “Optimizing
windows security features to block malware and hack tools on usb
storage devices,” in Progress in electromagnetics research symposium,
2010.
[53] W. Meng, L. Jiang, Y. Wang, J. Li, J. Zhang, and Y. Xiang, “Jfcguard:
Detecting juice ﬁlming charging attack via processor usage analysis on
smartphones,” Computers & Security, vol. 76, pp. 252 – 264, 2018.

[54] B. Leung, “Surjtechs 3m usb a-to-c cable completely violates the
usb spec. seriously damaged my laptop,” 2016. [Online]. Available:
https://www.amazon.com/review/R2XDBFUD9CTN2R[55] R. P. Foundation, “Raspberry pi 4B,” 2019. [Online]. Available:
https://www.raspberrypi.org/products/raspberry-pi-4-model-b[56] M. T. Incorporated, “ATmega32u4 chip,” 2016. [Online]. Available:
https://www.microchip.com/wwwproducts/en/ATmega32u4[57] U. G. Limited, “UGREEN company introduction,” 2012. [Online].
Available: https://www.ugreen.com/pages/about-ugreen[58] Apple, “Mac notebooks: Key placement and functions,” 2017. [Online].
Available: https://support.apple.com/en-us/HT201181[59] Brick, “Brick,” 2019. [Online]. Available: https://brickapp.se/about-us/[60] “WeChat Pay,” 2020. [Online]. Available: https://pay.weixin.qq.com/
index.php/public/wechatpay_en[61] Alipay, “Alipay,” 2020. [Online]. Available: https://global.alipay.com/
platform/site/ihome[62] F. Griscioli, M. Pizzonia, and M. Sacchetti, “Usbcheckin: Preventing
badusb attacks by forcing human-device interaction,” in 14th Annual
Conference on Privacy, Security and Trust, PST 2016, Auckland, New
Zealand, December 12-14, 2016. IEEE, 2016, pp. 493–496. [Online].
Available: https://doi.org/10.1109/PST.2016.7907004

12