Nullcon Goa 2023 | Cracking With Automated USB Fuzz By Subba Bachina & Conna

This talk focuses on the security vulnerabilities of USB interfaces, one of the most prevalent peripheral connections in modern computer systems. The speaker presents a novel USB fuzzing tool that employs genetic algorithms to enhance the efficiency of fuzz testing by automating the detection of vulnerabilities and refining fuzz data based on device feedback. The talk highlights how this tool has successfully simulated a USB camera operation in compliance with the Microsoft UVC protocol, demonstrating that a standard infrared image can be exploited to unlock Windows Hello. Additionally, the fuzzing process has revealed critical issues, including the capability to provoke denial of service attacks on both Windows and Ubuntu systems.