Slashdot Mirror
Ask Slashdot: Is Non-USB Flash Direct From China Safe?
Dishwasha (125561) writes I recently purchased a couple 128GB MicroSDXC card from a Chinese supplier via Alibaba at 1/5th the price of what is available in the US. I will be putting one in my phone and another in my laptop. A few days after purchased, it occurred to me there may be a potential risk with non-USB flash devices similar to USB firmware issues. Does anybody know if there are any known firmware issues with SD or other non-USB flash cards that could effectively allow a foreign seller/distributor to place malicious software on my Android phone or laptop simply on insertion of the device with autoplay turned off?
I would almost guarantee for that price it's a fake card. It's a pretty common practice. It's either smaller than it says (Try a write test for the full 128gb) or slower than stated etc. Assuming you have an android phone that has the unauthorized sources turned off by default I would think your relatively safe. I would not say it's not possible of an attack though. To my knowledge there is no such thing as autoplay on android.
"Directly from China" is exactly as safe as "made in China and assembled in the US", which is pretty much your alternative.
You'll want to check to make sure you are actually getting a 128GB card. I've gotten a couple of fake flash drives and cards over the years which report the proper capacity and will even format, but when you try to write actual data to the device you end up with corrupt files. If the price is too good to be true, it generally is, so I don't buy cards or sticks from vendors that I can't return anymore. Use H2TESTW to test the speed and capacity of your flash card/device: http://forums.sandisk.com/t5/S...
Or search Google or better yet be lazy and do no research at all and then post a question on Slashdot!
If you think you're getting a card for 1/5th the price, you're probably getting 1/5th the card. I have personal experience with cards that claim to be 8GB but only have 1GB of actual flash in them. I won't touch on the malware issue, but before you actually try to make use of the cards you need to find a way to very exhaustively exercise the entire card. I haven't looked for such a program but I hear they're pretty easy to find. If I were writing one I would put a pseudo-random sequence across the entire advertised size of the card, then read it back and confirm that the same pseudo-random sequence comes back. The sequence should be longer than the card, or at the very least not repeat on something like a 1GB boundary. I suspect a common trick in these cards is to simply drop the upper address bits, so you'll read the same contents off e.g. the 2nd GB as you will from the 1st, and all the others.
GStreamer - The only way to stream!
Because I guarantee you that somewhere there is a guy buying them from China in bulk, for 1/5 the price, repackaging them and selling them on Amazon for 3/4 the price.
excitingthingstodo.blogspot.com
He was asking about firmware. Formatting the SD card will not do anything to the firmware.
SD cards can't impersonate a keyboard, so anything like the USB firmware hack you linked to is impossible. There could be malicious files pre-installed on the drive, but then that's happened to big name suppliers plenty of times too.
As far as I know Android has no facility to run code directly from an SD card anyway, and if you're using an antivirus package worth its salt on your PC it would block any autorun attempt.
In Soviet Russia, girlfriend claps tablet.
The SD* interface doesn't have the _same_ problem that USB does, ie badusb. It has other issues, though, and an SD card could made malicious. The issue with USB is that a USB device can be / act as storage, a keyboard, a mouse, a camera, etc. You can plug in a USB device which you think is just a memory stick, but unbeknownst to you you, it's also acting as a keyboard and "typing" commands to your computer. A pure SD card interface supports _only_ storage devices, so they can't act as keyboards. They therefore can't directly attack the host device in the same way that USB can.
Android does have some support for SDIO, though, which allows a card to act as a camera, wifi card, or keyboard. I *don't* think Android will by default use an SDIO input device. It's possible that it will, though. I may have to emulate such a card with a microcontroller and see what happens when it is plugged in to various iOS and Android devices. If it works, you just witnessed the birth of badsd, as I haven't heard of anyone doing that before.
What an SD card could do on a pure SD storage interface is muck with any files you put on the card. Suppose you installed towelroot or supersu on the SD card. The controller on the card could inject malware into the executable, and that malware would then be run with the same privileges you have - full root access if you root your phone, or the same access the apps have. Along with injecting malware into your files, the trojan SD card could send your files to the attacker. Wifi adapters can be made that small, so any data saved to the card could be sent to the attacker via the built-in wifi.
Your best defense in that case might be "at 1/5th the price of what is available in the US". A trojaned card like that is going to cost some money to make, particularly the version with built-in wifi. It wouldn't make sense to sell a million of them on Alibaba, losing money on all of them. They would more likely be used in a targeted attack - "mistakenly dropped" on the premises of a defense contractor or R&D lab, maybe even advertised on on a forum likely targets tend to visit, such as one related to aerospace engineering or large-scale investments.
One step you could take to protect yourself would be to write and read back some known files of various types and compare their SHA hashes within a VM. The card should return a bit-by-bit identical copy of the file that you copied to it. If you save an .exe or .apk file and it comes back changed, that would be a bad sign. I'd like to hear from anyone who experiences tat so we can investigate further.
Of course it's a security risk.
The SD card has a 32 bit processor that does the wear leveling.
There is nothing stopping it doing 'interesting' things to files on it, if it's so programmed.
The extra fun part is that the user can't read out this programming.
Obvious things might be infecting files with viruses, appending small secret files to large media files in the hope that they will later be shared, or more targeted attacks.
SDHC only goes up to 32 GB, so that should have been your first clue. Happened to my dad, too.
I forgot to say, don't completely dismiss the possibility of a targeted attack. A few years ago there was a guy who didn't have access to any top secret information or anything. He worked on software for factory machine parts and stuff. For example, he might work on a large servo, translating the command "turn 30 degrees" to electrical impulses to the motor's magnets. He sure doesn't seem like a high-value target.
He turns out that the motors and stuff he worked on were being used by another company who built larger modules from motors, gears, etc. Those modules were, in turn, used to make chemistry lab equipment such as centrifuges. Centrifuges used in Iran. So servo firmware guy WAS target zero for stuxnet.
* The above narrative is roughly correct. Maybe the firmware-writing employee was a she, not a he, we don't know exactly which employee was hit first. We do know it came in through that company.
My advice to OP: treat all USB peripherals (mice, wireless cards, storage, etc) as malicious unless they come from trusted/vetted supply chains. And even then, be suspicious.
Sorry, you can't even trust things coming from a trusted and vetted supply chain unless there are massive oversight controls. I've seen knockoffs and other crap come though ingram micro...that was in the 90's.
Om, nomnomnom...
Don't worry about it. If you got it through Alibaba it is almost certain to be a counterfeit card with the size and even brand name printed on failing rejected cards, and it will have no better chance of retaining malware than it will have of holding your own data. I know a couple of people who bought through Alibaba that this happened to.
I'm an American. I love this country and the freedoms that we used to have.
Its never secure, however buying directly from a supplier who has a good reputation to protect is is safer than buying from a distributor in the US. Simply because if you purchase direct and discover something they would be easily exposed,and that would kill their business. The more hands it gets passed through the more opportunities for someone to sneak something in.
(If at first you don't succeed, do it different next time!)
These types of "deals" are always some type of trade-off. How much is your time worth? Go with a tried and true distributor and reputable seller off amazon. If you can't afford something at the normal asking price to the point your are willing to dabble with nefarious entities from China, then maybe you should wait and save up for when you can ... or don't and convince yourself you got a great deal from "someone" in China.
Or, literally do exactly what this question is asking, release something that autoruns malicious software on your machine when you try to use it...
I would be more worried about getting into trouble for buying counterfeit or stolen property.
Jack of all trades,master of none
I would almost guarantee for that price it's a fake card. It's a pretty common practice. It's either smaller than it says (Try a write test for the full 128gb) or slower than stated etc. Assuming you have an android phone that has the unauthorized sources turned off by default I would think your relatively safe. I would not say it's not possible of an attack though. To my knowledge there is no such thing as autoplay on android.
http://www.ebay.com/gds/All-Ab...
Make sure everyone's vote counts: Verified Voting
Remember that kerfuffle a couple weeks ago about FTDI bricking products that were using counterfeit FTDI USB-serial chips? Some of the product designers were unknowingly using counterfeit chips bought from companies we've all heard of (no, not Alibaba or Ebay...)
I got a counterfeit USB stick from Aliexpress and gave the item a one star review. The company actually called me up the next night - or should I say morning (3 AM), telling me that they understood the time difference and that they would continue to call me at that time every day until I changed my review.
I will never deal with Aliexpress again. Aliexpress never replied to my complaint. I will stick with something that realizes the importance of reputation.
I wish I had mod points left so I could mod all of these up.
The SD Association has a special formatter which avoids this problem.
Interesting that the special formatter is only available for Microsoft Windows and Apple Macintosh, and apparently only in binary form. Even if I had such a computer I would not be comfortable formatting my disk with non-free software. Who knows, it might be putting an encrypted child porn picture on a hidden part of the disk, exposing me to the risk of prosecution. No thanks.
Most likely QA rejects. Now why they were rejected by QA - this is your opportunity for getting decent media cheap. Sometimes the controller is broken and you'll end up with a fancy guitar pick. But sometimes the number of bad blocks on flash exceeds the standard. Run 'badblocks' on your card, and you'll get a card 95% the size of respective 'brand' at 20% the price. As a bottom line, this may cost some work and don't expect your profit is 4x the value of 'certified', but you may come out profitable.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2