At the conference “Chaos Communication Congress (30C3)"Bunnie" and "xobs" researchers have discovered the existence of vulnerabilities in Secure Digital (SD) memory cards that can be used to execute arbitrary code.
The security holes in memory cards can be exploited for man-in-the-middle (MITM) attacks. In addition, the flaws of SD can be used by hardware hardware connoisseurs to gain access to the microcontrollers incorporated into the devices.
The researchers conducted tests on productτα της appotech, ιδιαίτερα στα μοντέλα AX211 και AX 215. Ωστόσο και άλλες μάρκες μπορεί να περιέχουν παρόμοια τρωτά points.
In particular, Bunnie says: We have discovered a simple vulnerable sequence transmitted through the manufacturer's commands (ie, CMD63 followed by "A", "P", "P", "O") which puts the controller in a firmware loading state. At this point, the card will accept the next 512 bytes and run them as code "
With the methodology of reverse engineering the registers of the specific functions in the 8051 microcontroller, they have managed to create new applications even without access to the documentation from the supplier.
It is worth noting that the experts used the open source hardware platform Novena and some adaptable card adapter card.
Also, - Bunnie added, - from a security perspective, our findings show that even if memory cards appear to be inert, they are nevertheless running a body of code that can be modified to perform MITM attacks that would be difficult to detect. And as we know, there is no standard protocol or method to inspect and certify it content of the code running on the memory card microcontroller.
Excessive details that might even put the average reader to sleep. We will not enter a larger one analysis, but the key lesson from all of the above, as well as the researchers, is that there is no guarantee that securely erasing the card will completely erase the sensitive information stored on it.
This should be taken into account, especially in "high risk and high sensitivity" situations. Experts recommend it physics destroying the memory cards, i.e. smashing them with a hammer or a pestle (!!), to ensure that sensitive information is 100% erased before throwing it away.
Watch the relevant video from the presentation of the researchers at the conference.
