bunnie studio: On Hacking MicroSD Cards - Page 1
Forum section: electronics / general

author: TerraHertz
author_rank: Super Contributor
timestamp: January 01, 2014, 10:06:52 am
content: http://www.bunniestudios.com/blog/?p=3554"... disclosed a finding that some SD cards contain vulnerabilities that allow arbitrary code execution — on the memory card itself. On the dark side, code execution on the memory card enables a class of MITM (man-in-the-middle) attacks, where the card seems to be behaving one way, but in fact it does something else. On the light side, it also enables the possibility for hardware enthusiasts to gain access to a very cheap and ubiquitous source of microcontrollers."So, every SD card has a capable processor, most with means to reload the code - but usually the protocol to access that ability is 'secret.' Frustrating!Also no wonder SD cards are considered security risks.

author: EEVblog
author_rank: Unknown
timestamp: January 01, 2014, 10:54:27 am
content: I thought this was already pretty widely known for a long time?, and that the vendors in the markets in China reprogram them to spoof the size etc.Cool that they have hacked it all though.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2014, 11:31:57 am
content: I'd heard about faking ID values to spoof size, but was surprised that there was a microcontroller there - I'd assumed it would be an ASIC as the functionality is very fixed, and that most of the bad-block mapping would have been fixed at factory test time.

author: nctnico
author_rank: Super Contributor
timestamp: January 01, 2014, 01:34:58 pm
content: SD cards (and any Flash based memory device) need to have internal wear leveling to make sure every flash sector gets worn equally. So yes, a microcontroller inside is mandatory.

author: andersm
author_rank: Super Contributor
timestamp: January 01, 2014, 01:37:32 pm
content: Bunnie wrote apost about counterfeit SD cardsa few years ago.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 01, 2014, 01:39:22 pm
content: Quote from: nctnico on January 01, 2014, 01:34:58 pmNot necessarily - it could be dedicated logic

author: nctnico
author_rank: Super Contributor
timestamp: January 01, 2014, 02:21:13 pm
content: In theory yes but the algorithms are so complex that it is very hard and time consuming to come with an Asic which does wear levelling, error correction, bad block mapping, etc. And what if there is still a bug in the wear levelling or error correction? That would render the entire stock of Asics useless.In my FPGA designs I have used similar approaches as well. A simple programmable statemachine or CPU with (hardware accellerators) is easy to program and debug.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 01, 2014, 02:29:56 pm
content: NAND management is too nonlinear for hard logic (I don't say "impossible", just "too much effort") - there are dynamic features like blocks translation table loaded from hidden NAND area at startup, updating those tables after blocks failures etc. Also there are soo many NAND geometries and command set variations. Even an MCU with a mask ROM is not an option for most cases - too little flexibility.This documenthttp://www.usbdev.ru/?wpfb_dl=1534can give an idea how many NAND variations exists.And management complexity example: there is a class of higher end USB flash drives consisting of USB-to-SATA bridge + SATA-SSD-NAND controller + NAND instead of usual USB-NAND controller + NAND. Guess why? Because SATA-SSD-NAND controllers (their beefy firwmares actually) offers more sophisticated management that results in higher speed/reliability.Another example: Phison produces cheap 8051-based controllers for 1-2 channel entry level products and separate 32-bit ARC600-based controller for high end - to be able to handle big translation tables and interleaved 8 channel operation.I've done some research on USB 3.0 8051 Phisons, preparing a small framework for PS2303 to use it as a generic USB 3.0 to parallel bus bridge, something like old good Cypress FX2.

author: amyk
author_rank: Super Contributor
timestamp: January 02, 2014, 12:45:26 pm
content: MMC/eMMC is the same (SD was based on it, so no surprise); in fact there are some patches to the firmware in Android's source code towork around some nasty bugs, it is mostly undocumented but could provide a starting point for someone to play with....and if you want to get into thereallyobscure stuff, even "raw NAND" chips have a microcontroller in them to manage things like program/erase timings. The book "Inside NAND Flash Memories" has a lot of tasty content on that in chapter 6.

author: nowlan
author_rank: Frequent Contributor
timestamp: January 02, 2014, 12:57:31 pm
content: On a related note,Electric Imp

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 02, 2014, 11:57:15 pm
content: https://bitbucket.org/flowswitch/phisonPC side tools and some documentation will be added later.Hope Phison will not eat me for that. All info was extracted from public sources and flash sticks bought from local store, all reverse engineering was done in the name of interoperability

author: marshallh
author_rank: Unknown
timestamp: January 03, 2014, 12:18:23 am
content: Quote from: abyrvalg on January 02, 2014, 11:57:15 pmVery cool, will track this. The code reminds me very much of writing for FX2

author: logictom
author_rank: Unknown
timestamp: January 03, 2014, 12:57:48 am
content: Quote from: nctnico on January 01, 2014, 01:34:58 pmI was lead to believe that consumer grade SD cards rarely had wear levelling, previous projects at work had issues, and that was the reason for the price jump to get industrial grade cards?Panasonic industrial SD

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 03, 2014, 02:34:12 am
content: Quote from: marshallh on January 03, 2014, 12:18:23 amYes, I'm a frequent FX2 user and this Phison project was started because the next generation FX3 is a bit hard to buy/hard to use (BGA)/too expensive. The current code is in dirty experimental state, but I'll try to make something usable from it.