Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
China Data Storage Hardware

Ask Slashdot: Is Non-USB Flash Direct From China Safe? 178

Dishwasha (125561) writes I recently purchased a couple 128GB MicroSDXC card from a Chinese supplier via Alibaba at 1/5th the price of what is available in the US. I will be putting one in my phone and another in my laptop. A few days after purchased, it occurred to me there may be a potential risk with non-USB flash devices similar to USB firmware issues. Does anybody know if there are any known firmware issues with SD or other non-USB flash cards that could effectively allow a foreign seller/distributor to place malicious software on my Android phone or laptop simply on insertion of the device with autoplay turned off?
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Is Non-USB Flash Direct From China Safe?

Comments Filter:
  • Fake! (Score:2, Insightful)

    by Anonymous Coward

    I would almost guarantee for that price it's a fake card. It's a pretty common practice. It's either smaller than it says (Try a write test for the full 128gb) or slower than stated etc. Assuming you have an android phone that has the unauthorized sources turned off by default I would think your relatively safe. I would not say it's not possible of an attack though. To my knowledge there is no such thing as autoplay on android.

    • I would almost guarantee for that price it's a fake card. It's a pretty common practice. It's either smaller than it says (Try a write test for the full 128gb) or slower than stated etc. Assuming you have an android phone that has the unauthorized sources turned off by default I would think your relatively safe. I would not say it's not possible of an attack though. To my knowledge there is no such thing as autoplay on android.

      http://www.ebay.com/gds/All-Ab... [ebay.com]

  • Well, you've just made the suggestion in a public forum monitored (at a very low-level) by multiple intelligence agencies. Some intern will now write it up and toss it up the chain, and if someone can develop such a thing, they will.

    • Puh-lease. This has been an existing vector of attack on companies for at least a decade now, and several high profile breaches from this vector shape current policy in secure areas.

      Old news.

      My advice to OP: treat all USB peripherals (mice, wireless cards, storage, etc) as malicious unless they come from trusted/vetted supply chains. And even then, be suspicious.

      Fortunately for the average consumer, China at a state level is interested in stealing valuable technology and company secrets, not in your person
      • by Mashiki ( 184564 )

        My advice to OP: treat all USB peripherals (mice, wireless cards, storage, etc) as malicious unless they come from trusted/vetted supply chains. And even then, be suspicious.

        Sorry, you can't even trust things coming from a trusted and vetted supply chain unless there are massive oversight controls. I've seen knockoffs and other crap come though ingram micro...that was in the 90's.

        • by Smerta ( 1855348 )
          Absolutely correct.

          Remember that kerfuffle a couple weeks ago about FTDI bricking products that were using counterfeit FTDI USB-serial chips? Some of the product designers were unknowingly using counterfeit chips bought from companies we've all heard of (no, not Alibaba or Ebay...)

        • by ihtoit ( 3393327 )

          my first 486 came from a very well known manufacturer... with a virus in the BIOS!

  • by Anonymous Coward

    Yes, there are big risks. That's why you need to write the manufacturers and insist they make a public statement. Then people can call them on their contract failure.
    Also, your phone and laptop are already 0wn3d by the government and the corps.

    • by harrkev ( 623093 )

      No. No chance of security problems other than possibly having malware pre-loaded in a file on the drive. If you have auto-play turned off and format the card, it should be just fine.

      Now, it is still likely that it is a fake. It might be very small, very slow, or die a very early death, but that would only endanger your data on there and not your computer itself.

      You may be asking "Why is this the case?" The reason is that the "U" in "USB" stands for "Universal" A USB device could easily present itself a

      • by ihtoit ( 3393327 )

        I've seen webcams and Bluetooth SD cards as well, even a composite GPS/storage card (how in the fuck they got a GPS to fit INSIDE an SD form factor with only an inch and a quarter of wire sticking out (the antenna) is anybody's guess...).

  • by Anonymous Coward

    That scenario is entirely possible, but the more likely scenarios are:
    It could be a smaller device hacked to misreport its size, or
    It has PC based malware waiting to be activated when you connect it to a computer.

  • "From China"?!? (Score:2, Interesting)

    by Anonymous Coward

    "Directly from China" is exactly as safe as "made in China and assembled in the US", which is pretty much your alternative.

    • by ihtoit ( 3393327 )

      This. Also consider that these so-called knockoff chips are made on EXACTLY the same process lines as the "real thing", using EXACTLY the same substrates, screens, whatever... the only difference is that the "knockoffs" haven't been power tested - so you're taking pot luck that they actually work, even if they are actually as specified on the box (how long have the 8GB cards with 64/128GB firmwares been sitting in storage?? They're still genuine cards, what makes them slightly hooky is the firmware. There's

    • Its actually not, supported by ample evidence, but whatever. Quality control is a huge huge problem in china, whether or not you consider it "Politically correct" to say so.

  • by kimgkimg ( 957949 ) on Friday November 14, 2014 @05:16PM (#48388765)
    You'll want to check to make sure you are actually getting a 128GB card. I've gotten a couple of fake flash drives and cards over the years which report the proper capacity and will even format, but when you try to write actual data to the device you end up with corrupt files. If the price is too good to be true, it generally is, so I don't buy cards or sticks from vendors that I can't return anymore. Use H2TESTW to test the speed and capacity of your flash card/device: http://forums.sandisk.com/t5/S... [sandisk.com]
    • by Ken_g6 ( 775014 )

      Mod parent up. I got a USB drive as a gift that claimed to be 256GB! I tested it, and I think it's actually a 4GB drive with a little over-provisioning.

    • by phorm ( 591458 )

      Yes, my 64GB MicroSDHC turned out for be 3.5GB of actual memory followed by rewrites that corrupt over the existing data. Apparently this is very common.

      • Re:Ditto (Score:4, Informative)

        by sexconker ( 1179573 ) on Friday November 14, 2014 @05:52PM (#48388993)

        SDHC only goes up to 32 GB, so that should have been your first clue. Happened to my dad, too.

        • who remembers all the acronyms?

          SD, SDHC, SDXC, SDIO, BFG, LOL, WTF

          (lameness filter, blah blah blah)

          • by kesuki ( 321456 )

            "who remembers all the acronyms?"
            https://google.com/ [google.com] if the first page does not have it then try
            https://www.wikipedia.org/ [wikipedia.org] if wiki fails you or has too many acronyms on one page then ask the author if they can be reached.

            oh no, sdxc chips all use exfat and are limited to 4 gb for a single file, meaning a dvd iso won't fit. the sdhc was 2 gb files so it went up but not enough and according to wikipedia "SDXC adopts Microsoft's exFAT file system as a mandatory feature." i have xc cards already but if the ha

  • by fat_mike ( 71855 ) on Friday November 14, 2014 @05:16PM (#48388771)
    Or search Google or better yet be lazy and do no research at all and then post a question on Slashdot!
  • by Anonymous Coward

    Use some Linux tools to examine any partitions that might appear on the card. Also, use these same tools to wipe the card before use; but, doesn't all that manpower negate any savings? Shouldn't we do these things with any SD card?

    • There was a case where Best Buy (long time ago when 100MB Zip disk were the rage) re-sold Zip-disks containing someone's pr0n stash. So the source of the media doesn't really matter.

      Any media, no matter what it's packaging can be a vector for viruses. USB is the most heinous because a device could be the size of a micro BlueTooth tranciever, report it self as a keyboard, and install gigabytes of virus code on a computer system. There's no bigger risk to security than physical contact.

  • by Omega Hacker ( 6676 ) <omegaNO@SPAMomegacs.net> on Friday November 14, 2014 @05:18PM (#48388783)
    If you think you're getting a card for 1/5th the price, you're probably getting 1/5th the card. I have personal experience with cards that claim to be 8GB but only have 1GB of actual flash in them. I won't touch on the malware issue, but before you actually try to make use of the cards you need to find a way to very exhaustively exercise the entire card. I haven't looked for such a program but I hear they're pretty easy to find. If I were writing one I would put a pseudo-random sequence across the entire advertised size of the card, then read it back and confirm that the same pseudo-random sequence comes back. The sequence should be longer than the card, or at the very least not repeat on something like a 1GB boundary. I suspect a common trick in these cards is to simply drop the upper address bits, so you'll read the same contents off e.g. the 2nd GB as you will from the 1st, and all the others.
    • by Megane ( 129182 ) on Friday November 14, 2014 @05:35PM (#48388887) Homepage

      I think it's funny that he's worried about being pwned by the flash card firmware (answer: you can't, it's not a generic interface like USB that can be keyboards, mice, network cards, etc. on a whim), and not about being cheated by the old "1GB card that claims to be 4GB" scam.

      Anyhow, here are some relevant links:
      http://www.bunniestudios.com/b... [bunniestudios.com]
      http://www.bunniestudios.com/b... [bunniestudios.com]

      • by klui ( 457783 )

        Analogous to worrying about something that's not likely to happen but sounds scarier and ignore a more common problem.

    • by ihtoit ( 3393327 )

      I usually throw a new card into a camera and format the thing. Generally sorts it out.

  • by gurps_npc ( 621217 ) on Friday November 14, 2014 @05:20PM (#48388801) Homepage
    What makes you think the one you bought direct from China is any different than one you get from Amazon or Best Buy.

    Because I guarantee you that somewhere there is a guy buying them from China in bulk, for 1/5 the price, repackaging them and selling them on Amazon for 3/4 the price.

    • by Maxwell ( 13985 )

      Doubt it. Even if they somehow got reseller status on Amazon, they would promptly get feedback'd down to oblivion. They would't last long on ebay either. Only on Alibaba would someone actually think those cards were real....

      I have seen 640G Sony cards, 512G SD, etc years before that size was actually available....

  • I would tend to agree with other people: There's really no risk that a SD card is a security problem in the same way that USB is, since it's just storage. However, there is a big risk that any SD card you buy through unusual channels, especially at a ridiculously low rate like 1/5 the price, is just a fake which will start overwriting your data after you get past 1G or 8G or whatever. I absolutely refuse to buy SD cards outside a major physical store chain.

    • Mod parent up.

      The posters flash is almost certainly a fake if it's a mass market brand. Even if it's a generic Chinese brand, it most likely uses the same low-grade flash used in the fakes. I would not risk my data on these devices as the durability over the course of normal use is a big unknown since they aren't backed by a company doing extensive characterization.

      • by Goaway ( 82658 )

        It's not that the flash is low grade, it's that it just plain doesn't exist, and the card will just discard data after a while. What flash there is in there probably works, but is useless.

    • Re: (Score:3, Interesting)

      by queazocotal ( 915608 )

      Of course it's a security risk.
      The SD card has a 32 bit processor that does the wear leveling.
      There is nothing stopping it doing 'interesting' things to files on it, if it's so programmed.
      The extra fun part is that the user can't read out this programming.

      Obvious things might be infecting files with viruses, appending small secret files to large media files in the hope that they will later be shared, or more targeted attacks.

      • Mod parent up! This is the only informative on-topic comment I've seen on the entire page so far! Why is that if someone asks "is it safe", everyone wants to chime in and instead "it isn't real"? That is an answer to a different question than the question that was asked.
        • by AK Marc ( 707885 )
          There are other questions for "safe". Is it safe to hold data on? Is your computer safe? If the data isn't "lost" is it still the same data you tried to put on it?
          • There's a big difference between "it will lose the data you put on it" and "it will infect your computer and destroy the data you put everywhere". If I wanted to conduct secure transactions with my bank over the internet, it doesn't really matter (much) if my computer is running off of an unreliable hard drive. It might crash in the middle, but I probably won't lose money over it. But if the hard drive infected the operating system, the infection could undermine the security of my transactions and drain my

            • by AK Marc ( 707885 )
              What's the theoretical attack vector of a blank SD card? Some "memory cards" can run video cards and wireless, so are you asserting that someone could put those functions on an SD card (that also has functional memory) and capture things? Or are you just saying "Asia sucks"?

              Because so often in these discussion it comes down to the latter.
              • I'm not asserting anything about SD cards. I don't myself know how dangerous a maliciously crafted one could be. That's why I thought I'd wade into the comment section and see who does. Apparently more people are interested in answering a different question.
                • by AK Marc ( 707885 )
                  You can run a network connection over an SD card. http://www.eyefi.com/products/... [eyefi.com] But that's still not an attack vector. You'd have to auto-run the drivers, and have a root-kit in the drivers to be able to really do much with it. And the constraint was "no autorun", so are you going to install the network adaptor on your memory card, with manual clicks and past multiple warnings?

                  There's no practical way to compromise a machine with an SD card. There are theoretical ways. You are throwing up uninforme
                  • Hey, don't accuse me of hijacking the discussion. I wasn't the one who asked if an SD card bought from unreliable sources could install malware without autorun:

                    Does anybody know if there are any known firmware issues with SD or other non-USB flash cards that could effectively allow a foreign seller/distributor to place malicious software on my Android phone or laptop simply on insertion of the device with autoplay turned off?

                    That was the OP, not me. I just wanted to praise queazocotal for actually answering the OP's question.

                    • by AK Marc ( 707885 )
                      If you want to discuss theoretical, you couldn't name something that's *not* an attack vector. Perhaps a VGA video port, but display port is a valid attack vector, as well as RAM expansion, or any card you put in it. So in general terms, unless you get silly (the paint on the keys isn't an attack vector for anything but anthrax), assume everything has a valid attack. Does that answer the question?
  • Regarding your question, I'm not aware of any such exploits offhand, but that doesn't mean that they don't exist. That said, I'm not sure why you think getting a flash drive from China would mean it's any more risky. They are all manufactured in China anyway, and US companies are not the least bit trustworthy.
  • by AC-x ( 735297 ) on Friday November 14, 2014 @05:42PM (#48388937)

    SD cards can't impersonate a keyboard, so anything like the USB firmware hack you linked to is impossible. There could be malicious files pre-installed on the drive, but then that's happened to big name suppliers plenty of times too.

    As far as I know Android has no facility to run code directly from an SD card anyway, and if you're using an antivirus package worth its salt on your PC it would block any autorun attempt.

  • by raymorris ( 2726007 ) on Friday November 14, 2014 @05:47PM (#48388963) Journal

    The SD* interface doesn't have the _same_ problem that USB does, ie badusb. It has other issues, though, and an SD card could made malicious. The issue with USB is that a USB device can be / act as storage, a keyboard, a mouse, a camera, etc. You can plug in a USB device which you think is just a memory stick, but unbeknownst to you you, it's also acting as a keyboard and "typing" commands to your computer. A pure SD card interface supports _only_ storage devices, so they can't act as keyboards. They therefore can't directly attack the host device in the same way that USB can.

    Android does have some support for SDIO, though, which allows a card to act as a camera, wifi card, or keyboard. I *don't* think Android will by default use an SDIO input device. It's possible that it will, though. I may have to emulate such a card with a microcontroller and see what happens when it is plugged in to various iOS and Android devices. If it works, you just witnessed the birth of badsd, as I haven't heard of anyone doing that before.

    What an SD card could do on a pure SD storage interface is muck with any files you put on the card. Suppose you installed towelroot or supersu on the SD card. The controller on the card could inject malware into the executable, and that malware would then be run with the same privileges you have - full root access if you root your phone, or the same access the apps have. Along with injecting malware into your files, the trojan SD card could send your files to the attacker. Wifi adapters can be made that small, so any data saved to the card could be sent to the attacker via the built-in wifi.

    Your best defense in that case might be "at 1/5th the price of what is available in the US". A trojaned card like that is going to cost some money to make, particularly the version with built-in wifi. It wouldn't make sense to sell a million of them on Alibaba, losing money on all of them. They would more likely be used in a targeted attack - "mistakenly dropped" on the premises of a defense contractor or R&D lab, maybe even advertised on on a forum likely targets tend to visit, such as one related to aerospace engineering or large-scale investments.

    One step you could take to protect yourself would be to write and read back some known files of various types and compare their SHA hashes within a VM. The card should return a bit-by-bit identical copy of the file that you copied to it. If you save an .exe or .apk file and it comes back changed, that would be a bad sign. I'd like to hear from anyone who experiences tat so we can investigate further.

    • by raymorris ( 2726007 ) on Friday November 14, 2014 @05:58PM (#48389023) Journal

      I forgot to say, don't completely dismiss the possibility of a targeted attack. A few years ago there was a guy who didn't have access to any top secret information or anything. He worked on software for factory machine parts and stuff. For example, he might work on a large servo, translating the command "turn 30 degrees" to electrical impulses to the motor's magnets. He sure doesn't seem like a high-value target.

      He turns out that the motors and stuff he worked on were being used by another company who built larger modules from motors, gears, etc. Those modules were, in turn, used to make chemistry lab equipment such as centrifuges. Centrifuges used in Iran. So servo firmware guy WAS target zero for stuxnet.

      * The above narrative is roughly correct. Maybe the firmware-writing employee was a she, not a he, we don't know exactly which employee was hit first. We do know it came in through that company.

  • Its never secure, however buying directly from a supplier who has a good reputation to protect is is safer than buying from a distributor in the US. Simply because if you purchase direct and discover something they would be easily exposed,and that would kill their business. The more hands it gets passed through the more opportunities for someone to sneak something in.
  • These types of "deals" are always some type of trade-off. How much is your time worth? Go with a tried and true distributor and reputable seller off amazon. If you can't afford something at the normal asking price to the point your are willing to dabble with nefarious entities from China, then maybe you should wait and save up for when you can ... or don't and convince yourself you got a great deal from "someone" in China.
    • These types of "deals" are always some type of trade-off. How much is your time worth?

      I don't know about 1/5, but you can typically get memory cards at 1/2 off by just buying naked OEM cards. Before I leave positive feedback, I try to register for the warranty.

  • I would be more worried about getting into trouble for buying counterfeit or stolen property.
  • Where do you think your phone and laptop came from?
  • by Anonymous Coward

    I got a counterfeit USB stick from Aliexpress and gave the item a one star review. The company actually called me up the next night - or should I say morning (3 AM), telling me that they understood the time difference and that they would continue to call me at that time every day until I changed my review.

    I will never deal with Aliexpress again. Aliexpress never replied to my complaint. I will stick with something that realizes the importance of reputation.

  • FYI... Sean "xobs" Cross and Andrew "bunnie" Huang disclosed low-level vulnerabilities in SD cards (as far as I can tell: on par with- and related to- the more recent BadUSB-type hacks) at a 30C3, back in December 2013.

    For further details, see:-
    http://www.bunniestudios.com/blog/?p=3554 [bunniestudios.com]

    • by Frogg ( 27033 )
      Granted, an exploited SD card can't pretend to be other USB devices (like BadUSB), but the exploit is similar to BadUSB in as much as it means the card's firmware can be re-written and malware can basically MITM your data / the device it's inserted into — so, theoretically at least, the card could be made to further exploit any vulnerabilities in the device it is talking to...
  • No idea about Alibaba but E-Bay has a dispute system. And when I bought a pack of 18650 batteries 0.25 Ah each instead of at least 2.5 Ah and marked them OK - it's my own problem.

    Next time I asked the seller "How many Ah has your 3.0Ah battery?" Answer was "They usually have at least half of that, you understand...". I preferred to buy a cheap notebook battery and disassemble it.

  • by Foresto ( 127767 )

    I don't have any experience with malicious flash drives, but since we're on the topic of fakes, F3 is a handy test program:

    http://oss.digirati.com.br/f3/ [digirati.com.br]

  • The price makes the item suspect. One must oneself, why is this so much cheaper?

    While being malicious is possible, it's probably much more likely its substandard and either won't work very well straight out of the box, or will fail fairly quickly compared to a 'normal' priced one.

    • by ihtoit ( 3393327 )

      This. Bricks and mortar for me, and I'll only deal with a BAM that records the serial number of the card (they're around, and EVERY branded card has a UUID silkscreened on it). Any problems, card goes back for exchange. Sorted. :) I also won't buy a card with less than three years warranty.

  • considering any you are buying locally will be made in china or korea anyway then if you are scared of those cards you should be scared of just about every piece of electronic kit in the modern world. Your only safe bet is to go live in the woods with an abundant amount of tin foil.

  • It takes effort to put root-kits on these and even the USB-attacks where a publicly available tool-chain exists need customization for the target and specific exploit code. These are not one-size-fits-all attacks.

    But safe? Likely these use sub-standard flash and controllers to make that price. Expect data loss and undetected corruption.

  • Take some tinfoil, form a large hat, a medium hat, and small hat. Put the large one on your head, the medium one on your laptop, and the small one on your phone. After that, you should be just fine.

  • by SharpFang ( 651121 ) on Saturday November 15, 2014 @11:08AM (#48391873) Homepage Journal

    Most likely QA rejects. Now why they were rejected by QA - this is your opportunity for getting decent media cheap. Sometimes the controller is broken and you'll end up with a fancy guitar pick. But sometimes the number of bad blocks on flash exceeds the standard. Run 'badblocks' on your card, and you'll get a card 95% the size of respective 'brand' at 20% the price. As a bottom line, this may cost some work and don't expect your profit is 4x the value of 'certified', but you may come out profitable.

The best way to avoid responsibility is to say, "I've got responsibilities."

Working...