Poking the S in SD cards
summary
Demonstrates a practical break of the SD card lock by abusing CMD42 lock/password via SPI, using a HydraBus + logic analyzer + oscilloscope to measure processing delays (roughly 53→55 μs examples, letting length and bytes be recovered — a 6‑byte PIN cracked in minutes). Tests on about 20 retail cards show most vendors’ controllers leak via timing and power side‑channels; SanDisk cards resist, and cutting power during the erase unlock often preserves user data.
AI-written summary · about
chapters (12)
- 0:00Introduction and background
- 1:03SD card fundamentals
- 2:10Protocol and interface
- 5:31Tool development
- 8:33Password security features
- 12:46Timing attack implementation
- 17:26Testing across manufacturers
- 22:48Flash erase analysis
- 25:19Side-channel attack method
- 32:30Live demo and findings
- 35:25Conclusion and future work
- 38:06Q&A session
related talks
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
26mBrute-Forcing Lockdown Harddrive Pin Codes
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers
40mExposing The Deep-Secure Elements Of Smartcards
37mOpen Sesame! The full story behind opening a smart lock
40mBadge of Shame: Breaking into Secure Facilities with OSDP
33mBreaking Into Chips By Reading The Datasheet
42mShuffle Up and Deal: Analyzing the Security of Automated Card Shufflers