USBCaptchaIn：防止工业控制系统中不规则使用的USB设备的（非）常规攻击
USBCaptchaIn: Preventing (Un)Conventional Attacks from Promiscuously Used USB Devices in Industrial Control Systems
摘要：
工业控制系统（ICS）是高调攻击者和高级持续威胁的明智目标，众所周知，这些攻击者利用USB拇指驱动器作为有效的传播媒介。在ICSes中，拇指驱动器被广泛用于在断开连接的系统之间传输文件，并代表严重的安全风险，因为它们可能被混杂地用于关键和常规系统。这些威胁来自隐藏在存储在拇指驱动器中的文件中的恶意软件和BadUSB攻击[16]。BadUSB利用USB设备固件的修改来模仿键盘的行为并向主机发送恶意命令。我们提出了一个解决方案，允许混杂使用USB拇指驱动器，同时保护关键机器免受恶意软件，通过常规文件感染或固件感染传播。我们提出的架构的主要组成部分是一个硬件，称为USBCaptchaIn，旨在在关键机器和所有USB设备之间的中间。我们不要求用户改变他们使用拇指驱动器的方式。为了避免人为错误，我们不要求用户做出任何决定。所提出的方法与ICS环境中已经部署的产品高度兼容，并在恶意软件到达目标之前主动阻止恶意软件。我们描述了我们的解决方案，提供了一个全面的分析，我们的方法在ICS的上下文中的安全性，并报告了一些专家对我们的第一个原型的非正式反馈。
英文摘要：
Industrial Control Systems (ICS) are sensible targets for high profile attackers and advanced persistent threats, which are known to exploit USB thumb drives as an effective spreading vector. In ICSes, thumb drives are widely used to transfer files among disconnected systems and represent a serious security risks, since, they may be promiscuously used in both critical and regular systems. The threats come both from malware hidden in files stored in the thumb drives and from BadUSB attacks [16]. BadUSB leverages the modification of firmware of USB devices in order to mimic the behaviour of a keyboard and send malicious commands to the host. We present a solution that allows a promiscuous use of USB thumbs drives while protecting critical machines from malware, that spread by regular file infection or by firmware infection. The main component of the architecture we propose is an hardware, called USBCaptchaIn, intended to be in the middle between a critical machine and all USB devices. We do not require users to change the way they use thumb drives. To avoid human-errors, we do not require users to take any decision. The proposed approach is highly compatible with already deployed products of a ICS environment and proactively blocks malware before they reach their targets. We describe our solution, provide a thorough analysis of the security of our approach in the ICS context, and report the informal feedback of some experts regarding our first prototypes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
