Slashdot Mirror
Ask Slashdot: Is Non-USB Flash Direct From China Safe?
Dishwasha (125561) writes I recently purchased a couple 128GB MicroSDXC card from a Chinese supplier via Alibaba at 1/5th the price of what is available in the US. I will be putting one in my phone and another in my laptop. A few days after purchased, it occurred to me there may be a potential risk with non-USB flash devices similar to USB firmware issues. Does anybody know if there are any known firmware issues with SD or other non-USB flash cards that could effectively allow a foreign seller/distributor to place malicious software on my Android phone or laptop simply on insertion of the device with autoplay turned off?
"Directly from China" is exactly as safe as "made in China and assembled in the US", which is pretty much your alternative.
If you think you're getting a card for 1/5th the price, you're probably getting 1/5th the card. I have personal experience with cards that claim to be 8GB but only have 1GB of actual flash in them. I won't touch on the malware issue, but before you actually try to make use of the cards you need to find a way to very exhaustively exercise the entire card. I haven't looked for such a program but I hear they're pretty easy to find. If I were writing one I would put a pseudo-random sequence across the entire advertised size of the card, then read it back and confirm that the same pseudo-random sequence comes back. The sequence should be longer than the card, or at the very least not repeat on something like a 1GB boundary. I suspect a common trick in these cards is to simply drop the upper address bits, so you'll read the same contents off e.g. the 2nd GB as you will from the 1st, and all the others.
GStreamer - The only way to stream!
Because I guarantee you that somewhere there is a guy buying them from China in bulk, for 1/5 the price, repackaging them and selling them on Amazon for 3/4 the price.
excitingthingstodo.blogspot.com
The SD* interface doesn't have the _same_ problem that USB does, ie badusb. It has other issues, though, and an SD card could made malicious. The issue with USB is that a USB device can be / act as storage, a keyboard, a mouse, a camera, etc. You can plug in a USB device which you think is just a memory stick, but unbeknownst to you you, it's also acting as a keyboard and "typing" commands to your computer. A pure SD card interface supports _only_ storage devices, so they can't act as keyboards. They therefore can't directly attack the host device in the same way that USB can.
Android does have some support for SDIO, though, which allows a card to act as a camera, wifi card, or keyboard. I *don't* think Android will by default use an SDIO input device. It's possible that it will, though. I may have to emulate such a card with a microcontroller and see what happens when it is plugged in to various iOS and Android devices. If it works, you just witnessed the birth of badsd, as I haven't heard of anyone doing that before.
What an SD card could do on a pure SD storage interface is muck with any files you put on the card. Suppose you installed towelroot or supersu on the SD card. The controller on the card could inject malware into the executable, and that malware would then be run with the same privileges you have - full root access if you root your phone, or the same access the apps have. Along with injecting malware into your files, the trojan SD card could send your files to the attacker. Wifi adapters can be made that small, so any data saved to the card could be sent to the attacker via the built-in wifi.
Your best defense in that case might be "at 1/5th the price of what is available in the US". A trojaned card like that is going to cost some money to make, particularly the version with built-in wifi. It wouldn't make sense to sell a million of them on Alibaba, losing money on all of them. They would more likely be used in a targeted attack - "mistakenly dropped" on the premises of a defense contractor or R&D lab, maybe even advertised on on a forum likely targets tend to visit, such as one related to aerospace engineering or large-scale investments.
One step you could take to protect yourself would be to write and read back some known files of various types and compare their SHA hashes within a VM. The card should return a bit-by-bit identical copy of the file that you copied to it. If you save an .exe or .apk file and it comes back changed, that would be a bad sign. I'd like to hear from anyone who experiences tat so we can investigate further.
Of course it's a security risk.
The SD card has a 32 bit processor that does the wear leveling.
There is nothing stopping it doing 'interesting' things to files on it, if it's so programmed.
The extra fun part is that the user can't read out this programming.
Obvious things might be infecting files with viruses, appending small secret files to large media files in the hope that they will later be shared, or more targeted attacks.
I forgot to say, don't completely dismiss the possibility of a targeted attack. A few years ago there was a guy who didn't have access to any top secret information or anything. He worked on software for factory machine parts and stuff. For example, he might work on a large servo, translating the command "turn 30 degrees" to electrical impulses to the motor's magnets. He sure doesn't seem like a high-value target.
He turns out that the motors and stuff he worked on were being used by another company who built larger modules from motors, gears, etc. Those modules were, in turn, used to make chemistry lab equipment such as centrifuges. Centrifuges used in Iran. So servo firmware guy WAS target zero for stuxnet.
* The above narrative is roughly correct. Maybe the firmware-writing employee was a she, not a he, we don't know exactly which employee was hit first. We do know it came in through that company.
It might not do what you think.
/dev/urandom | tr -dc [:graph:] | head -c56` < /dev/zero | pv -pterb -s `blockdev --getsize64 $1` -S | tee $1 | md5sum | tee writesum)
Here's what to do: Generate random stream with openssl, md5sum it going into the card, md5sum it coming back out. Use pv for progress display if desired.
~ # cat randomtest.sh
#!/bin/bash
time (openssl bf-ofb -pass pass:`cat
echo
time (cat $1 | pv -pterb -s `blockdev --getsize64 $1` | md5sum - > readsum)
echo
echo "Written:" `cat writesum`
echo "Read:" `cat readsum`
rm writesum readsum
Same here. I bought two 128GB cards on eBay for $23 each. Only one showed up, and when I tested it with:
# dd if=/dev/zero of=/dev/sdc
it gives I/O error at about 8.2GB. Definitely not worth the aggravation.
No, no, don't do it that way. If you overwrite an SD card starting from the beginning, you will overwrite the Protected Area of the card. Also happens if you use the "format disk" function of an operating system on the card.
The SD Association has a special formatter which avoids this problem.
Maybe try reading the card instead of writing, to test for those cards which have missing flash. Or carefully skip the Protected Area with dd when writing.