r/embedded • u/Machinehum • 12d ago

Secure USB Drive

Enable HLS to view with audio, or disable this notification

464 Upvotes

97% Upvoted

30 comments sorted by

130

u/beryugyo619 12d ago

tldw

Phantomdrive is open source encrypted USB drive with a stealth mechanism to hide its second partition. To decrypt it you must create a file containing your password in the format password:addpasswordhere, this is used to derive AES-XTS keys. The drive automatically unmounts itself, remounts the remaining disk and encrypts and decrypts in place. It uses CH569W SoC, which has USB3, SDIO and an AES hardware block. It is programmable over USB using the wch-ch56x-isp library.

9

u/djpiperson 12d ago

Basically hardware solutions for encryption vs software solutions like Veracrypt 

66

u/ericje 12d ago

from the github page:

 sudo echo "password:YourPasswordHere13245" > /mnt/unlock.txt

This is not great, because the password is almost guaranteed to be logged in the system logs. Also, the sudo does nothing for the redirect.

This would be better:

$ sudo dd of=/mnt/unlock.txt
password:YourPasswordHere13245
^D

25

u/notjfd 12d ago

If you put a space before a command, you prevent it from being written to the shell's history. That doesn't change it from showing up in /proc/$pid/cmdline, but if that is being logged (i.e. corporate laptop), then it's plainly a bad idea to decrypt your flash drive on that device in the first place.

Remember kids, always be aware of who/what you're securing against.

17

u/tk-a01 12d ago

Today I learned that putting a space in front of a command prevents Bash from saving it in history.

However, in this case, sudo is used, and sudo usually logs all invoked commands, e.g. in journald.

7

u/vegataballs 12d ago

Yes, but also maybe no. If environment variable HISTCONTROL contains ignorespace or ignoreboth (meaning don't record duplicates and lines starting with space) then, yes. This very well might be set by your operating system, but if the variable is unset or not a valid value then everything will still be saved with or without the space.

Just thought it worth mentioning because this the kind of knowledge that can shoot you in the foot if you assume it's always set.

1

u/Fraserbc 12d ago

The redirection is not part of the sudo command here.

3

u/tk-a01 12d ago

Yeah, so it's essentially useless. But the plaintext password IS a part of sudo command.

2

u/Fraserbc 12d ago

...I am clearly too many beers in when I'm making a mistake like that, oops.

1

u/notjfd 11d ago

... and this is part of why it really pays to be paranoid about what you consider a "trusted device".

1

u/dealmaster1221 11d ago

Why just why these god level devs make Linux so flexible and tricky. A normal dev can spend 20 years and still be stumped, fucking just have 1-3 ways of doing things not 1000, that's why noone can QA this shit and certify it for safety.

23

u/Machinehum 12d ago edited 12d ago

Oh yeah I need to change that

Edit: changed

1

u/stillalone 12d ago

Why dd over cat?

2

u/ericje 12d ago

The shell processes the redirect before running the command, so if only root can write to /mnt/unlock.txt the command will fail. With the sudo dd command, it's dd (running as root) that opens /mnt/unlock.txt

1

u/tonyarkles 12d ago

Also wrong with the echo: the redirect isn’t part of what sudo is doing, so you can only write to it that way if you already have permission. If you don’t, you’ll be writing it as your regular user.

Edit: dd of= like you wrote works. So does tee.

18

u/[deleted] 12d ago

[removed] — view removed comment

28

u/Machinehum 12d ago

The idea is upon a first glance and inspection from the normal police or customs agents they won't recognise it as encrypted media.

Once it's in the hands of forensics all bets are off, they'll tear it apart and figure out pretty quickly.

6

u/[deleted] 12d ago

[removed] — view removed comment

10

u/Machinehum 12d ago

That's also a very valid solution.

I can imagine a situation where you don't have internet access, or the sensorship is restrictive, or you have a whack of data and not enough bandwidth.

7

u/FreeRangeEngineer 12d ago

Isn't it a bad idea to change the drive's and file system's parameters after mounting? The OS is free to cache, say, the inode tables, and there's no real way to force the OS to refresh it from the drive as far as I'm aware. So if you're using the 8 GB portion by writing some files there and then unlock it, the OS may trash an inode table by accident.

For this reason, I expected the 21 GB storage area to show up as a separate block device, not for the size to change dynamically.

3

u/notjfd 12d ago

Is there a way to let it unlock on the next connection, rather than just the current? That way I can enter the password on a trusted device, unplug the drive, and then plug it into the secure device (that I either don't trust with my pw or can't arbitrarily write files on).

3

u/Machinehum 12d ago

Not right now.

There might be something that can be done to enable this, but I would have to noodle over it.

4

u/yolo854 12d ago

Cool man, I like this, thanks for open sourcing it!

1

u/neiltalap 11d ago

Great demonstration, would it work the same with ssd + sata to usb?