5 ms·

Intro to hacking MicroSD cards (2013)

352 points by bubblehack3r 8y ago

ge0rg 8y ago
This is the 2013 presentation about firmware analysis / modification of the internal controller inside of uSD cards.
- 2013 8y ago
  Yeah, those mini and regular SD cards looked huge, and micro SD is pretty much a universal standard by now.
  - gurgus 8y ago
    Sweet username!
    - 90 8y ago
      what’s so great about it?
    - 82 8y ago
      what’s so great about it?
WestCoastJustin 8y ago
If you're interested in this type of stuff. Here's a pretty good Youtube video on the subject of SD card data recovery (soldering with a breakout PCB). His channel is also packed with useful info on the subject of data recovery from all types of devices. https://youtu.be/jjB6wliyE_Y https://youtu.be/jjB6wliyE_Y Here's the point where it is all wired up. https://youtu.be/jjB6wliyE_Y?t=518 https://youtu.be/jjB6wliyE_Y?t=518
T3OU-736 8y ago
Shameless plug for bunnie: the "The Hardware Hacker" book has a fair bit more on the subject, and is, the verall, quite a good read.
- auto 8y ago
  Second this book for an insider’s look at the culture around Shenzhen and China’s position in the electronics market in general.
- gppk 8y ago
  I'd also suggest his blog is a goldmine for anyone even remotely interested in developing electronics projects.
- metamet 8y ago
  Amazon link for convenience: https://www.amazon.com/Hardware-Hacker-Adventures-Making-Breaking/dp/159327758X https://www.amazon.com/Hardware-Hacker-Adventures-Making-Bre...
  - fapjacks 8y ago
    Thanks for not dressing it up with an affiliate link, seriously.
    - sreggin 8y ago
      Why? I like affiliate links.
    - jeromegv 8y ago
      Would that be so bad that a fellow HackerNews user could get some revenue instead of having one of the richest person/corporation on Earth collect the full share of the sale instead?
      - Arubis 8y ago
        If they were shady about it, perhaps. I have no objection to affiliate links that are disclosed.
        toomuchtodo 8y ago
        Can you generate an affiliate link where the affiliate fee is directed to a non-profit?
Sujan 8y ago
(2013)
dooglius 8y ago
> Those in high-risk, high-sensitivity situations should assume that a “secure-erase” of a card is insufficient to guarantee the complete erasure of sensitive data. People in such situations should be encrypting anything sensitive that goes onto external storage anyway, you shouldn't be in a position where you have to "secure-erase" anything.
- dronescanfly 8y ago
  Destruction of data is still safer than the non-zero chance of breaking your encryption measure.
- deleted 8y ago
  [deleted]
- pbhjpbhj 8y ago
  Maybe "secure erase" caches, swap space, and RAM - don't know if it's true but I understand RAM can hold a pattern when powered down, sufficient to be recovered if you need it enough. Anything you consume unencrypted gets displayed unencrypted at some point and so is stored in some way in clear-text (unless you use external mechanical means for the last step?).
  - icebraining 8y ago
    Swap can be encrypted just fine. As for RAM encryption, Linux already supports it, if you're using a very new AMD CPU with SME: https://github.com/torvalds/linux/blob/master/Documentation/x86/amd-memory-encryption.txt https://github.com/torvalds/linux/blob/master/Documentation/...
sathackr 8y ago
Needs (2013)
thisisit 8y ago
Can we please add 2013 to this? Additionally it was discussed at that time: https://news.ycombinator.com/item?id=6980058 https://news.ycombinator.com/item?id=6980058
- sctb 8y ago
  Done. Thanks!
dehrmann 8y ago
> It can be anything from high-grade factory-new silicon to material with over 80% bad sectors. Guess I hadn't considered that a 512GB SD card could be repackaged as a 32GB card if the wear pattern isn't even and only 90% of the cells are dead. Also, 2013. I'm not convinced recycling this way is cost-effective.
benj111 8y ago
So are there any practical applications, in the sense of projects reprogramming sd cards for other uses, as a cheap micro controller, etc?
- askvictor 8y ago
  Given the lack of I/O, probably not (or perhaps in not thinking creatively enough). But you can get microcontrollers for less than a dollar anyway... Relatedly, I remember the eyeFi (or similar) wifi-enabled SD cards got 'hacked' a few years ago, and you could get a Linux shell on them.
  - int_19h 8y ago
    I mean, it still does have I/O, it just needs to present itself as a regular SD card. So computation could be triggered by e.g. changing the contents of a file with a certain name, and output would be another file. One immediate practical application is a hidden cryptographic partition on an SD card. It could be implemented in a way such that during normal use, no data shows up, and the corresponding blocks are marked as bad. But create a password file with the right content, and the firmware decrypts and exposes the hidden data. Since there's no way to read the firmware, only to update it, even detecting such a scheme would require tearing the SD card down in a lab - not really feasible for routine searches, given how many cards there are around (used in phones and tablets etc).

352 points by bubblehack3r 8y ago

ge0rg 8y ago

This is the 2013 presentation about firmware analysis / modification of the internal controller inside of uSD cards.

2013 8y ago
Yeah, those mini and regular SD cards looked huge, and micro SD is pretty much a universal standard by now.
- gurgus 8y ago
  Sweet username!
  - 90 8y ago
    what’s so great about it?
  - 82 8y ago
    what’s so great about it?

WestCoastJustin 8y ago

If you're interested in this type of stuff. Here's a pretty good Youtube video on the subject of SD card data recovery (soldering with a breakout PCB). His channel is also packed with useful info on the subject of data recovery from all types of devices. https://youtu.be/jjB6wliyE_Y https://youtu.be/jjB6wliyE_Y Here's the point where it is all wired up. https://youtu.be/jjB6wliyE_Y?t=518 https://youtu.be/jjB6wliyE_Y?t=518

T3OU-736 8y ago

Shameless plug for bunnie: the "The Hardware Hacker" book has a fair bit more on the subject, and is, the verall, quite a good read.

auto 8y ago
Second this book for an insider’s look at the culture around Shenzhen and China’s position in the electronics market in general.
gppk 8y ago
I'd also suggest his blog is a goldmine for anyone even remotely interested in developing electronics projects.
metamet 8y ago
Amazon link for convenience: https://www.amazon.com/Hardware-Hacker-Adventures-Making-Breaking/dp/159327758X https://www.amazon.com/Hardware-Hacker-Adventures-Making-Bre...
- fapjacks 8y ago
  Thanks for not dressing it up with an affiliate link, seriously.
  - sreggin 8y ago
    Why? I like affiliate links.
  - jeromegv 8y ago
    Would that be so bad that a fellow HackerNews user could get some revenue instead of having one of the richest person/corporation on Earth collect the full share of the sale instead?
    - Arubis 8y ago
      If they were shady about it, perhaps. I have no objection to affiliate links that are disclosed.
      - toomuchtodo 8y ago
        Can you generate an affiliate link where the affiliate fee is directed to a non-profit?

Sujan 8y ago

(2013)

dooglius 8y ago

> Those in high-risk, high-sensitivity situations should assume that a “secure-erase” of a card is insufficient to guarantee the complete erasure of sensitive data. People in such situations should be encrypting anything sensitive that goes onto external storage anyway, you shouldn't be in a position where you have to "secure-erase" anything.

dronescanfly 8y ago
Destruction of data is still safer than the non-zero chance of breaking your encryption measure.
deleted 8y ago
[deleted]
pbhjpbhj 8y ago
Maybe "secure erase" caches, swap space, and RAM - don't know if it's true but I understand RAM can hold a pattern when powered down, sufficient to be recovered if you need it enough. Anything you consume unencrypted gets displayed unencrypted at some point and so is stored in some way in clear-text (unless you use external mechanical means for the last step?).
- icebraining 8y ago
  Swap can be encrypted just fine. As for RAM encryption, Linux already supports it, if you're using a very new AMD CPU with SME: https://github.com/torvalds/linux/blob/master/Documentation/x86/amd-memory-encryption.txt https://github.com/torvalds/linux/blob/master/Documentation/...

sathackr 8y ago

Needs (2013)

thisisit 8y ago

Can we please add 2013 to this? Additionally it was discussed at that time: https://news.ycombinator.com/item?id=6980058 https://news.ycombinator.com/item?id=6980058

sctb 8y ago
Done. Thanks!

dehrmann 8y ago

> It can be anything from high-grade factory-new silicon to material with over 80% bad sectors. Guess I hadn't considered that a 512GB SD card could be repackaged as a 32GB card if the wear pattern isn't even and only 90% of the cells are dead. Also, 2013. I'm not convinced recycling this way is cost-effective.

benj111 8y ago

So are there any practical applications, in the sense of projects reprogramming sd cards for other uses, as a cheap micro controller, etc?

askvictor 8y ago
Given the lack of I/O, probably not (or perhaps in not thinking creatively enough). But you can get microcontrollers for less than a dollar anyway... Relatedly, I remember the eyeFi (or similar) wifi-enabled SD cards got 'hacked' a few years ago, and you could get a Linux shell on them.
- int_19h 8y ago
  I mean, it still does have I/O, it just needs to present itself as a regular SD card. So computation could be triggered by e.g. changing the contents of a file with a certain name, and output would be another file. One immediate practical application is a hidden cryptographic partition on an SD card. It could be implemented in a way such that during normal use, no data shows up, and the corresponding blocks are marked as bad. But create a password file with the right content, and the firmware decrypts and exposes the hidden data. Since there's no way to read the firmware, only to update it, even detecting such a scheme would require tearing the SD card down in a lab - not really feasible for routine searches, given how many cards there are around (used in phones and tablets etc).