Hackers can hack the SD memory card micro controller and physical tampering to modify the SD card firmware or hardware.
How can I create a tamper proof SD card?
1
-
Well you'll need to write your own microcontroller firmware and flash it to an existing SD card, or make your own SD card from scratch.– userCommented Sep 20, 2019 at 17:46
Add a comment
|
3 Answers
You don't.
Once someone has access to your SD card for prolonged amounts of time, it's not longer your SD card. This is a variation of one of the 10 immutable laws of security.
Creating tamper-proof hardware is a very difficult problem. Depending on the attacker’s resources, capabilities and motives, just about any chip’s secrets can eventually be recovered.
Instead, consider other solutions to protect your data. You could encrypt the data before you write it to the SD, and not store the decryption key on the card. That way if someone does obtain the device, they still won’t have the information they need to decrypt it.
answered Sep 21, 2019 at 5:09
Let’s be honest, what are the odds someone wants to hack you, let alone your SD CARD?
If you think they’re high, I can’t be much help.
Writing your own microcontroller FW from scratch (aside from the obtuse technical difficulty) leads to more risks in my opinion.
Doubtful any of us here will do a better job at it than entire dev teams @ Sandisk or Kingston...
This angle of vulnerability has been known for a long time regarding USB flashdrives too. You can encrypt data, but won’t protect the controller. You can change the disk format type, doesn’t help either.
Even the new “NFC or BLE” SD cards don’t help in your situation, a malicious attacker with SD reader and some skill will always be able to “plug and play”.
There is a good read about EEPROM security at this link : https://www.digikey.com/en/articles/techzone/2019/jan/use-external-encrypted-eeprom--secure-data-embedded-systems
After all i do want to offer a solution, it’s a card, if you physically keep it out of reach from anyone and only ever plug it to a trusted computed, shouldn’t that be enough?:)
