GoKawiilFrom the outside, the Phantom Drive, created by Rootkit Labs, appears like a boring old USB. It has that classic, cheap plastic-feeling look to it that would never make you second-guess its intention; when you plug it in, it shows up as just an 8GB drive. However, under the hood, the Phantomdrive is powered by a microSD card that only unlocks itself when you specifically create a new text file, after which it mounts the secret partition, which comes with AES-256 encryption. It's made for situations and places where you might be forced to reveal the contents of a storage device.
The Open Source USB Drive Built for Privacy - YouTube Watch On
The Phantomdrive is built using the CH569 microcontroller that has a bunch of different hardware blocks — this project uses the USB3, SD/eMMC, and the AES block. There are no NAND chips directly onboard the custom PCB because of the ongoing component crisis. Instead, the Phantomdrive relies on a simple microSD card (that you provide; it doesn't come with one) for both its 8GB decoy partition and the hidden partition. The creator does say they'll make a version with eMMC modules once prices come down.
Of course, if someone were to open up the drive, they'd be able to physically rip the SD card out. However, it still wouldn't be a dead giveaway since many cheap USBs are powered by microSD cards, and SD card adapters are also a thing. Anyhow, the finished drive looks pretty simple from the inside; it comprises a USB port, two buck supplies, a button for firmware update, the microSD card, UART test points, and some support components. The custom firmware now comes into play.
Latest Videos From Tom's Hardware Watch full video here:
The name of the game is interception. The firmware doesn't know it's being used to handle file transfers; it just reads raw packets of data being sent over the USB bus as is. It's coded to always look for a "password" string, so as soon as you create the unlock.txt file with "password:xyz" inside, it detects the "xyz" bit and copies it over to SRAM, while overwriting the raw data with a bunch of zeroes before it's written to the SD card. The operating system thinks it's created the new file, but the firmware intercepted it midway and sent essentially nothing to the physical storage cells.
The firmware uses the unique internal hardware ID of the microcontroller as the salt, combines it with the password you just typed, and runs the pair through PBKDF2-HMAC-SHA-256 hashes 100,000 times (you can also select 600,000 times) to create a key. Each run induces an intentional 2-3 second delay to deter brute-force attacks that would try to crack the password. The key is used to unlock and lock the hidden partition, and since it's tied to the silicon itself, putting the SD card into another Phantom Drive will not unlock it.
(Image credit: Rootkit Labs)
Even if you try to access it directly through a microSD card slot, it will stay hidden, and the 8GB decoy will actually appear like a broken partition. The creator has also provided the option to recompile the firmware on your own to spoof specific vendor IDs, so that the USB appears like it's from different brands. You can make the Phantomdrive pretend to be a cheap 16GB Kingston Datatraveler at the hardware protocol level, at which point no scanning software will flag it as anything more than a cheap USB.
There are Linux-based C tools you can use in case of emergency, however, to recover your data, such as physical damage to the board. The transfer speeds are also very limited because the project is built over USB 2 — 20 MB/s reads and 9 MB/s writes in AES-CTR mode. The speeds fall to 10 MB/s reads and 6 MB/s writes in AES-XTS, but at least you have the freedom to choose between the two according to your needs.
... continue reading