A Linux Kernel USB Proxy With Integrated Threat Detection

Abstract

Universal Serial Bus (USB) devices are widely used due to their flexibility, but they also introduce security risks because they expose multiple interfaces that are implicitly trusted by the operating system. A representative example is BadUSB, in which modified device firmware injects malicious input while the device is enumerated by the host. In this paper, we present the design and implementation of a kernel-level USB proxy for Linux capable of intercepting and mediating USB packets. From a security perspective, the proposed solution combines descriptor-level policy enforcement with packet-level inspection to detect and block malicious USB devices before they are enumerated by the host, or to disconnect them when suspicious USB traffic is detected during normal operation. The same mechanism can also be used to protect USB devices connected to potentially malicious host systems by filtering suspicious host-generated commands. We evaluated the proposed proxy using a diverse set of USB devices, including HID peripherals, Android smartphones operating in Android Debug Bridge (ADB), Media Transfer Protocol (MTP), and Remote Network Driver Interface Specification (RNDIS) modes, Apple iPhones, USB modems, USB Ethernet adapters, USB-to-serial converters, USB mass storage devices, and emulated composite USB devices. Experimental results demonstrate transparent USB enumeration across all supported device categories. Normal device functionality was preserved for all evaluated device categories, with the exception of USB mass storage devices, for which the current implementation supports read operations only. Full write support for USB mass storage devices remains a topic for future work.