4 ms·

Presumably sd cards are safer to connect rather than unsolicited usb drives.

ChuckNorris89 5y ago
Safer how? On PC at least, SD card readers, both internal and external are attached via the USB protocol and are seen by the OS like mass storage devices, just like USB drives, including being bootable, so whatever malware you have for a specific PC target, the payload should basically work the same from SD cards as via USB drives.
- redundantly 5y ago
  Nyet. An SD card in a card slot can only be accessed as a mass storage device. A USB drive can act as a mass storage device as well as a keyboard and mouse and even contain an entire OS on it that could be remotely accessible via WiFi.
  - ChuckNorris89 5y ago
    You're right. My bad.
  - cva 5y ago
    fwiw, it is most definitely possible to build an sd card that can exfiltrate its own data over wifi. in fact, that was the entire point of the Eye-Fi[0] product (though not with any nefarious intent). though granted that's still a way smaller attack surface than what would be typically granted to a usb device. [0]: https://en.wikipedia.org/wiki/Eye-Fi https://en.wikipedia.org/wiki/Eye-Fi
    - redundantly 5y ago
      I had forgotten entirely about Eye-Fi. Excellent point! When it comes to physical access, especially with shared physical devices, there's always going to be some type of attack vector, however small it may be.
  - askvictor 5y ago
    SDIO would suggest otherwise, though I have no idea if Android supports it, and what drivers would hypothetically be required. Niche, but might be possible.
- lou1306 5y ago
  Still, it's probably much easier for an USB drive to actually pack malicious hardware in addition to software, like sensors (e.g., microphones) or an USB killer: https://en.wikipedia.org/wiki/USB_Killer https://en.wikipedia.org/wiki/USB_Killer
LeifCarrotson 5y ago
A USB drive can operate fully within the USB spec, implementing a USB hub and USB keyboard, and enter malicious code. The SD interface does not implement a similar spec, so this somewhat safer. The bad news most PC card readers are based on USB, so a targeted attack (which is probably in scope for Briar's customers) may still be possible - you could attack the firmware of the card reader, as described in [1] by Adam Caudill of BadUSB fame. Without breaking that firmware, however, you can't connect USB network->Card reader->USB hub, and you also probably can't connect SDIO/SPI network->SDIO-based-card-reader->USB hub. There's also the possibility that the card itself can run untrusted code. Just like a USB drive, an SD card typically contains a small 8051 [2] or ARM [3] microcontroller. Running a compromised controller would give the attacker access to all the data that's ever sent to the SD card, but one would hope that Briar does not cache unencrypted data to the uSD card which the user is expected to write to an physically pass to a potential adversary. Also, be aware of products like the Toshiba FlashAir Wifi SD card, which implement a wireless adapter in an SD card form factor. Replacing the label would be trivial, and it could broadcast or connect to a hidden wifi network without your knowledge. But again, one would hope that Briar does not cache unencrypted data to the SD card where it could, with one of these cards, be exfiltrated wirelessly. I think this capability is only available as an SD card or an obvious uSD-to-protruding-SD-card adapter form factor, not as a microSD card which would typically be used in a mobile device. Of course, there's still the possibility that the host OS does something stupid, like autorun an executable on the external media...but that's more of a badly configured Windows PC problem, I expect that modern mobile devices do not do that. [1] https://security.stackexchange.com/a/109595 https://security.stackexchange.com/a/109595 [2] https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554 [3] https://www.bunniestudios.com/blog/?page_id=1022 https://www.bunniestudios.com/blog/?page_id=1022

Safer how? On PC at least, SD card readers, both internal and external are attached via the USB protocol and are seen by the OS like mass storage devices, just like USB drives, including being bootable, so whatever malware you have for a specific PC target, the payload should basically work the same from SD cards as via USB drives.

redundantly 5y ago
Nyet. An SD card in a card slot can only be accessed as a mass storage device. A USB drive can act as a mass storage device as well as a keyboard and mouse and even contain an entire OS on it that could be remotely accessible via WiFi.
- ChuckNorris89 5y ago
  You're right. My bad.
- cva 5y ago
  fwiw, it is most definitely possible to build an sd card that can exfiltrate its own data over wifi. in fact, that was the entire point of the Eye-Fi[0] product (though not with any nefarious intent). though granted that's still a way smaller attack surface than what would be typically granted to a usb device. [0]: https://en.wikipedia.org/wiki/Eye-Fi https://en.wikipedia.org/wiki/Eye-Fi
  - redundantly 5y ago
    I had forgotten entirely about Eye-Fi. Excellent point! When it comes to physical access, especially with shared physical devices, there's always going to be some type of attack vector, however small it may be.
- askvictor 5y ago
  SDIO would suggest otherwise, though I have no idea if Android supports it, and what drivers would hypothetically be required. Niche, but might be possible.
lou1306 5y ago
Still, it's probably much easier for an USB drive to actually pack malicious hardware in addition to software, like sensors (e.g., microphones) or an USB killer: https://en.wikipedia.org/wiki/USB_Killer https://en.wikipedia.org/wiki/USB_Killer

LeifCarrotson 5y ago

A USB drive can operate fully within the USB spec, implementing a USB hub and USB keyboard, and enter malicious code. The SD interface does not implement a similar spec, so this somewhat safer. The bad news most PC card readers are based on USB, so a targeted attack (which is probably in scope for Briar's customers) may still be possible - you could attack the firmware of the card reader, as described in [1] by Adam Caudill of BadUSB fame. Without breaking that firmware, however, you can't connect USB network->Card reader->USB hub, and you also probably can't connect SDIO/SPI network->SDIO-based-card-reader->USB hub. There's also the possibility that the card itself can run untrusted code. Just like a USB drive, an SD card typically contains a small 8051 [2] or ARM [3] microcontroller. Running a compromised controller would give the attacker access to all the data that's ever sent to the SD card, but one would hope that Briar does not cache unencrypted data to the uSD card which the user is expected to write to an physically pass to a potential adversary. Also, be aware of products like the Toshiba FlashAir Wifi SD card, which implement a wireless adapter in an SD card form factor. Replacing the label would be trivial, and it could broadcast or connect to a hidden wifi network without your knowledge. But again, one would hope that Briar does not cache unencrypted data to the SD card where it could, with one of these cards, be exfiltrated wirelessly. I think this capability is only available as an SD card or an obvious uSD-to-protruding-SD-card adapter form factor, not as a microSD card which would typically be used in a mobile device. Of course, there's still the possibility that the host OS does something stupid, like autorun an executable on the external media...but that's more of a badly configured Windows PC problem, I expect that modern mobile devices do not do that. [1] https://security.stackexchange.com/a/109595 https://security.stackexchange.com/a/109595 [2] https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554 [3] https://www.bunniestudios.com/blog/?page_id=1022 https://www.bunniestudios.com/blog/?page_id=1022