ID: IRCNE2014012055
Date: 2014-01-01
According to "cnet", security researchers have found a way to hack SD Cards, the most common form of flash-memory cards used to store data mobile phones and digital cameras, and run software that intercepts data.
Andrew "bunnie" Huang and Sean "xobs" Cross disclosed the approach Sunday in a blog post and talk at the Chaos Computer Congress (30C3). With the attack, a person could run malicious software on the memory card itself. That's because the cards have tiny built-in computers called microcontrollers that are used to oversee the details of data storage.
The result is a "perfect setup for a man-in-the middle attack," Huang said in a video of the talk.
In a man-in-the-middle attack, someone intercepts data that's being transferred from one location to another, potentially scrutinizing or modifying it. Huang and Cross believe their attack could be used to secretly copy data, to modify sensitive data such as encryption keys, or to subvert authentication processes.
The approach works in principle not just with SD Cards, where the researchers demonstrated their approach, but also with other flash-memory devices such as SSDs (solid-state drives) used in place of traditional hard drives in personal computers and eMMC (Embedded Multimedia Controller) storage used in mobile phones.
The specific vulnerability Huang and Cross describe doesn't apply to all flash-memory devices because it's dependent on the specific microcontroller used. However, they believe the approach is generally effective since all flash devices rely on such controllers to figure out how to work around bad memory cells in flash-memory systems.
- 2