3

In that paper: http://www.delaat.net/rp/2011-2012/p14/report.pdf[1] is reported that USB OTG can be used to have direct DMA memory access and as a consequence have access to all the content of the memory of a device/computer.

I would like to know more about that attack vector.

Any idea about where can I find more information and/or some tool to exercise that attack vectors ?

Many thanks.

What I know are:

  • M. Jodeit and M. Johns. “USB Device Drivers: A Stepping Stone into your Kernel”. In: Computer Network Defense (EC2ND), 2010 European Conference on. IEEE. 2010.
  • D. Maynor. “0wn3d by everything else-USB/PCMCIA Issues”. In: Presentation at CanSecWest (2005).
|improve this question
4

In contrast to all the other buses mentioned, USB does not allow remote DMA; nowhere in the USB on-the-wire protocol are there memory addresses. Only the driver and/or the OS can control from/to which memory addresses USB data is read/written.

OTG allows to change the roles of host and device, but does not change the USB protocol.

Jodeit/Johns talks only about bugs in USB device drivers.

Maynor talks about driver bugs, and then mentions something called "DMA attack", but gives no details whatsoever. The most likely explanation is that he found some driver bug that allows the device to influence how the driver handles its memory buffers. This would still be a bug in one specific driver, and has nothing to do with the remote DMA feature of other buses.

In other words: there is nothing dangerous about USB OTG itself, only with the quality of its drivers.

|improve this answer
  • Unfortunately I don't know how USB OTG works. My understanding is that with USB OTG and USB protocol exploitation you can have access to DMA. I contacted Maynor on Twitter but he didn't reply yet. In summary by the way, seems that in the paper are used wrongs and not so clear assumption. – boos Nov 4 '14 at 10:59
  • No, neither 'normal' USB nor ORG have remote DMA. – CL. Nov 4 '14 at 11:58
  • Do you know that because you know how USB works under the hood or what ? – boos Nov 5 '14 at 13:43
  • 1
    Yes, I've written several USB drivers. BTW, the USB specifications are public. – CL. Nov 5 '14 at 13:50
  • 1
    Ok thank you. Maynor replied to some of my enquiries and he told me nothing basically. I know that USB specification are public but I can't allocate the necessary effort on the spec. I trust your explanation. Thank you. – boos Nov 5 '14 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.