Nicolas Oberli - Poking the S in SD Cards
Explores the attack surface of the SD card specification, revealing undocumented commands and firmware update mechanisms that enable persistent device compromise.
Summary
SD Card Security Research
Nicolas Oberli (Hardware Security Researcher, Kudelski Security) presents research into the security properties of the SD card specification, exposing an underexplored attack surface in the most ubiquitous storage medium.
SD Card Architecture
SD cards contain a complete embedded system: an 8051 or ARM microcontroller, flash memory chips, and proprietary firmware that implements wear leveling, error correction, and the SD protocol state machine. The controller firmware is the primary attack target.
Undocumented Vendor Commands
Oberli discovers that all major SD card manufacturers implement proprietary extensions to the SD command set, accessible via specific multi-byte command sequences. These vendor commands include firmware update triggers, raw flash access modes, and diagnostic functions undocumented in public specifications.
Firmware Update Persistence
Exploiting the firmware update mechanism, Oberli demonstrates implanting custom code in SD card firmware that intercepts specific file reads/writes — enabling a malicious SD card to exfiltrate data to a hidden partition or trigger malware execution when inserted into a target device.
Related talks
Main Stage·42 min
Ladar Levison · hon1nbo
Ladar Levison and hon1nbo presents booby trapping boxes: Ever worry about the hardware you leave behind?
Main Stage·33 min
Bui · Rao
Bui and Rao presents last mile authentication problem exploiting the missing link: With "Trust none over the Internet" mindset, securing all communication between a client and a server with protocols such as TLS has...
Main Stage·46 min
Douglas McKee
Douglas McKee presents 80 to 0 in under 5 seconds: It seems each day that passes brings new technology and an increasing dependence upon it.