Introduction to USB and Fuzzing

### Overview of USB Architecture and Attack Surfaces Universal Serial Bus (USB) has evolved into the ubiquitous peripheral interconnect across modern desktop, server, and embedded computing systems. While traditional hardware attacks like BadUSB focus on using microcontroller-based devices to mimic human interface devices (such as malicious HID keyboards injecting keystrokes), this presentation in the DEF CON Hardware Hacking Village explores an orthogonal threat vector: attacking host operating system kernels and device drivers directly through the USB protocol stack. Because host operating systems automatically parse complex USB descriptors and load kernel-level drivers upon device attachment—often without user interaction—flaws in descriptor parsing and protocol state machines offer a direct route to kernel-level code execution.

### USB Topology, Descriptors, and Enumeration The USB architecture operates as a tiered star topology managed by a host controller, supporting up to 127 addressable devices per bus. Internal motherboards incorporate root hubs and multi-tier internal hubs that connect integrated webcams, Bluetooth transceivers, and card readers to the same buses that service external ports. During device enumeration, the host interrogates the connected device through a hierarchy of structured descriptors: - **Device Descriptors:** Specify baseline vendor IDs (VID), product IDs (PID), device classes, and supported USB specification revisions. - **Configuration Descriptors:** Define power consumption profiles and interface groupings. - **Interface and Endpoint Descriptors:** Detail operational capabilities, such as audio, mass storage, or video streams, mapping individual one-way unidirectional communication pipes (endpoints) to specific kernel drivers. Because multiple interface descriptors can coexist on a single composite physical device, an attacker can trigger multiple distinct kernel driver stacks simultaneously.

### Hardware Sniffers vs. Software Packet Capture To dissect and understand USB transactions, researchers utilize both hardware and software capture tools: - **In-Line Hardware Analyzers:** Hardware sniffers (such as Total Phase Beagle analyzers) sit transparently between the host and device on the physical D+/D- differential lines. They capture physical signaling, low-level packet framing (tokens, SOFs, handshakes), and timing quirks without altering host driver behavior, outputting capture streams to an isolated analysis workstation. - **Software Capture Frameworks:** On Linux, kernel instrumentation via `usbmon` (loaded via `sudo modprobe usbmon`) captures raw URBs (USB Request Blocks) and interfaces directly with Wireshark's native USB dissector. On Windows platforms, utilities like USBCap provide equivalent software-level capture without requiring dedicated analyzer hardware.

### Attacking Host Kernels via USB Emulation Rather than relying on fixed physical peripheral hardware, attackers emulate arbitrary USB devices using programmable hardware boards such as Facedancer, GreatFET, or Arduino-based microcontrollers: - **Descriptor Spoofing:** Emulated devices can dynamically cycle through arbitrary VID/PID pairs, claim complex composite device interfaces, or present malformed descriptor hierarchies designed to trigger edge-case parser bugs. - **Protocol State Desynchronization:** By violating USB state machine rules—such as returning unexpected STALL or NAK packets, transmitting oversized payload buffers, or withholding expected handshakes—the emulator stresses host driver state handling. - **Cross-Driver Attack Surface:** Because generic OS class drivers (e.g., CDC-ACM serial, HID, USB Mass Storage, UVC video) contain tens of thousands of lines of legacy C code in the Linux and Windows kernels, emulating unusual peripheral configurations exposes rarely tested driver initialization paths.

### Fuzzing Methodologies and Vulnerability Discovery The session outlines practical fuzzing workflows for USB host stacks: - **Descriptor Mutation:** Generating mutated byte sequences within device, interface, and endpoint descriptors, introducing integer overflows, negative buffer lengths, and illegal endpoint addresses. - **Control and Bulk Transfer Fuzzing:** Injecting semi-valid payloads into Endpoint 0 control setup packets (`bmRequestType`, `bRequest`, `wValue`, `wIndex`, `wLength`) and streaming corrupted data streams into bulk or interrupt endpoints. - **Crash Detection and Instrumentation:** Monitoring kernel ring buffers (`dmesg`), kernel crash dumps, and hardware debugging probes to correlate host kernel panics (null pointer dereferences, heap buffer overflows, and memory corruption) with specific mutated USB packet sequences.

(AI summary — Gemini 3.8 Flash)