Perimeter-Crossing Buses: a New Attack Surface for Embedded Systems, Sergey Bratus, Travis Goodspeed, Peter C. Johnson, Sean W. Smith, Ryan Speers. 7th Workshop on Embedded Systems Security (WESS), October 2012.
Towards A Verified Complex Protocol Stack in a Production Kernel: Methodology and Demonstration, Peter C. Johnson, Ph.D. thesis, Dartmouth College, November 2015; Dartmouth Computer Science TR2016-803.
How USB Does (and Doesn’t) Work: A Security Perspective, Peter C. Johnson. USENIX ;login:, Vol. 39, No. 4, August 2014.
Related:
Lessons learned from 50 bugs: Common USB driver vulnerabilities, Andy Davis. NCC Group publication, January 2013.
Lowering the USB Fuzzing Barrier by Transparent Two-Way Emulation, Rijnard van Tonder, Herman Engelbrecht, 8th USENIX Workshop on Offensive Technologies (WOOT). August 2014.
Emulating USB Devices with Python, Travis Goodspeed, July 2012.
REcon 2012: Facedancer USB: Exploiting the Magic School Bus, Sergey Bratus & Travis Goodspeed. June 2012.
TROOPERS.de 2013: You wouldn’t share a syringe. Would you share a USB port?, Sergey Bratus & Travis Goodspeed. [video], March 2013.
You can purchase a Facedancer21 device from int3.cc/products/facedancer21.