1

Hackers can hack the SD memory card micro controller and physical tampering to modify the SD card firmware or hardware.

https://media.ccc.de/v/30C3_-5294-en-_saal_1_-201312291400-_the_exploration_and_exploitation_of_an_sd_memory_card_-bunnie-_xobs

How can I create a tamper proof SD card?

  • Well you'll need to write your own microcontroller firmware and flash it to an existing SD card, or make your own SD card from scratch. – user Sep 20 at 17:46
4

You don't.

Once someone has access to your SD card for prolonged amounts of time, it's not longer your SD card. This is a variation of one of the 10 immutable laws of security.

1

Creating tamper-proof hardware is a very difficult problem. Depending on the attacker’s resources, capabilities and motives, just about any chip’s secrets can eventually be recovered.

Instead, consider other solutions to protect your data. You could encrypt the data before you write it to the SD, and not store the decryption key on the card. That way if someone does obtain the device, they still won’t have the information they need to decrypt it.

0

Let’s be honest, what are the odds someone wants to hack you, let alone your SD CARD?

If you think they’re high, I can’t be much help.
Writing your own microcontroller FW from scratch (aside from the obtuse technical difficulty) leads to more risks in my opinion.
Doubtful any of us here will do a better job at it than entire dev teams @ Sandisk or Kingston...

This angle of vulnerability has been known for a long time regarding USB flashdrives too. You can encrypt data, but won’t protect the controller. You can change the disk format type, doesn’t help either.
Even the new “NFC or BLE” SD cards don’t help in your situation, a malicious attacker with SD reader and some skill will always be able to “plug and play”.

There is a good read about EEPROM security at this link : https://www.digikey.com/en/articles/techzone/2019/jan/use-external-encrypted-eeprom--secure-data-embedded-systems

After all i do want to offer a solution, it’s a card, if you physically keep it out of reach from anyone and only ever plug it to a trusted computed, shouldn’t that be enough?:)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.