I think part of the entire design is that it's quite hard to detect.
1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure.
The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake the SD-card measurably and some constant-time optimizations should make it more or less undetectable.
It's a clever design and I think it should be possible to optimize to become more or less unrecognizable.
> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay,
- Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”.
- have your password checking thread run in background at idle priority
- when you get an async password match, force usb disconnect and reconnect and the system will rescan the bus and mount your real drive.
Short of adversary dumping drive firmware (or them figuring out your hn account t, having a LLM scan the messages and finding this conversation) it’s not really easily detectable..
If I was building a black box to detect hidden data on a USB stick, I'd include a feature whereby it measures power consumption and flags USB drives that don't consume the expected power for that type of drive.
What an unreasonably complex device to imply you’re going to make 50,000 copies of and ship out to every border agent in the nation after telling them every SINGLE flash drive crossing the border MUST be scanned. That’s so much wasted time, energy, and money. Are you building a similar device for SD cards? HDDs? SSDs? External drives? You’re going to build a database of exact charge draws for every device in existence which happens to have some form of storage on it?
Fucking up every single import and traveler on the off-chance one in seven billion scans detects one of these devices and, further, carries some data the US cares enough about to chase down to this degree?
No. Nope. Nuh uh. Insanely unreasonable. You will get ONE at a station, which you only bother to use if you can convince your $12/hr employee to even give a shit. Literally an insane proposition.
Can you flesh that out? If I've missed something and oversimplified the design here, I'd want to clarify that!