Hyeongjun Choi, Ji Hyuk Jung, Ji Hye Yoon · 2026 · arXiv (Cornell University)
DOI: 10.48550/arxiv.2610.28401 · cited by 0 works (OpenAlex) · open-access PDF
SPECTER는 호스트 측 USB 전원 제어를 사용하여 공기 간격 및 네트워크 분리 시스템에서 정보를 제거하는 호스트 측면 암호 채널입니다. 관리 권한이있는 송신기는 USB 전원 관리 또는 장치 상태 작업을 통해 비트를 암호화하고 USB 데이터 전송에 유용한 부하를 배치하지 않습니다. 결과 신호는 스마트 폰 충전 상태, 시각적 인 외부 행동 및 가까운 필드 RF 활동을 기반으로 3 개의 대체 수신 경로를 통해 복구됩니다. Windows 10 및 Ubuntu 22.04에 대한 실험은 상품 하드웨어에 채널을 보여줍니다. 채널의 충전 상태 신호는 0.2-0.25 비트 / 초 안드로이드 및 iOS 장치에 따라 호스트 구성, 연결 장치, 보안 장치 및 보안 전송 장치에 의존
Machine translation (Meta M2M100); the English original follows.
We present SPECTER, a post-compromise covert channel that uses host-side USB power control to exfiltrate information from air-gapped and network-segregated systems. A transmitter with administrative privileges encodes bits through USB power-management or device-state operations without placing the payload in USB data transfers. The resulting signals are recovered through three alternative receiver paths based on smartphone charging states, visible peripheral behavior, and near-field RF activity. Experiments on Windows 10 and Ubuntu 22.04 demonstrate the channel on commodity hardware, with charging-state signaling at 0.2-0.25 bit/sec across Android and iOS devices and peripheral-state signaling at 1.0 bit/sec using a USB mouse on Windows. RF reception is demonstrated using a software-defined radio with a loop antenna in direct contact with the USB cable. Channel availability and observable side effects depend on the host configuration, connected device, and receiver path. These results identify host-side USB power control as a mechanism for low-rate exfiltration of short secrets and motivate treating USB power-management and device-state events as security-relevant telemetry.
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
Topics: USB, USB hub, Payload (computing), Computer science, Host controller interface, Transmitter
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.28401, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange