30C3: SD card tricks can deliver MITM attacks
(Phys.org) —This year's 30th Chaos Communication Congress (30C3) in Hamburg from December 27 to December 30 carried numerous informative presentations, including a reverse-engineering story about SD cards, which two investigators explored for malware potential. The presenters were identified as "bunnie" and "xobs," taking center-stage to discuss their work. The presentation was titled " The Exploration and Exploitation of an SD Memory Card." (SD cards are the small flash-memory cards used to store data on phones, digital cameras and other portable devices.) As Gizmodo put it, "the next time you plug in an SD card, just remember that it's actually a tiny computer of its own." In short, some cards' embedded microcontrollers can be exploited. The two found that some SD cards contain vulnerabilities that allow arbitrary code execution—on the memory card itself. They talked about reverse-engineering and loading code into the microcontroller within a SD memory card.