Dartmouth Events

Abstract: The Universal Serial Bus has become a pervasive means by which users connect peripherals to computers. USB devices were ubiquitous within organizations and enterprises, but their role in introducing malware and acting as vectors for data exfiltration have significantly curtailed their usage in these environments. We have found that USB hosts often blindly trust the peripherals attached to them, while devices also blindly trust hosts. In this talk, we discuss solutions to constrain USB device functionality by allowing user expectations of device operation to prevent unauthorized access to USB interfaces. We also consider how fine-grained permissions can be specified through the OS kernel to allow flexible and fine-grained protection to hosts. On the device side, we consider new USB storage devices capable of providing context about the hosts they connect into, and show how these capabilities can allow for malware tracking and attribution. We conclude by consider future challenges to assuring the security and trustworthiness of USB hosts and devices. 

Bio: Kevin Butler is an associate professor of Computer and Information Science and Engineering at the University of Florida, where he leads research in computer systems security within the Florida Institute for Cybersecurity Research. His work focuses on the security of systems and data, with a concentration on storage and embedded systems, mobile security and privacy, and cloud security. He also has interests in Internet security and applied cryptography. Kevin received his Ph.D. in Computer Science and Engineering from the Pennsylvania State University in 2010, an M.S. in electrical engineering from Columbia University in 2004, and a B.Sc. in electrical engineering from Queen’s University at Kingston in 1999. He received the National Science Foundation CAREER award in 2013 and the Symantec Research Labs Graduate Fellowship in 2009.