USBCheckIn: Preventing BadUSB Attacks by Forcing Human-Device Interaction Federico Griscioli∗, Maurizio Pizzonia∗ and Marco Sacchetti∗ ∗Roma Tre University, Department of Engineering Via della Vasca Navale 79, 00146 Rome, Italy fgriscioli,
[email protected] [email protected] GoodUSB [3] is a software solution that aims at protecting Abstract—The BadUSB attack leverages the modification of the host against BadUSB attacks. When a new USB device is firmware of USB devices in order to mimic the behaviour of a attached, a message is shown to the user, which must declare keyboard or a mouse and send malicious commands to the host. This is a new and dreadful threat for any organization. Current his/her expectation about the functionalities of the device. countermeasures either require special USB devices or ask the In this paper we present USBCheckIn, an hardware solution user to decide if the device can be used. that is able to protect any kind of USB host against attacks We propose a new approach that, before allowing the device from devices that claim to be human interface devices but are to be used, forces the user to interact with it physically, to not. The basic idea is that the authenticity of a real human ensure that a real human-interface device is attached. Our implementation is hardware-based and, hence, can be used with interface device can be easily checked by asking the user to any host, comprising embedded devices, and also during boot, use it. To authorize a human intreface device to connect to i.e., before any operating system is running.