The firmware uses the unique internal hardware ID of the microcontroller as the salt, combines it with the password you just typed, and runs the pair through PBKDF2-HMAC-SHA-256 hashes 100,000 times (you can also select 600,000 times) to create a key. Each run induces an intentional 2-3 second delay to deter brute-force attacks that would try to crack the password. The key is used to unlock and lock the hidden partition, and since it's tied to the silicon itself, putting the SD card into another Phantom Drive will not unlock it.
There are Linux-based C tools you can use in case of emergency, however, to recover your data, such as physical damage to the board. The transfer speeds are also very limited because the project is built over USB 2 — 20 MB/s reads and 9 MB/s writes in AES-CTR mode. The speeds fall to 10 MB/s reads and 6 MB/s writes in AES-XTS, but at least you have the freedom to choose between the two according to your needs.
You can buy the Phantomdrive from Rootkit Labs for $50, but you can also build your own, since this is an open-source project. The prebuilt device comes with two extra shells because the pins wear off and break quickly. Otherwise, the GitHub repo provides all the resources, including the PCB layout files and schematics, the BOM for every part, and the custom firmware, alongside its related tools.
The creator of Phantomdrive, Ryan Walker, explains the goal behind the project as both utilitarian and political. It's built using entirely open-source software and with inexpensive, easily accessible components. They wanted to create something that could "slip past authoritarian government representatives, corrupt police, and anyone else that doesn't respect basis encryption rights."
(Score: 3, Interesting) by VLM on Wednesday August 12, @05:00PM (5 children)
The hardware sounds cool looking. There's a lack of basic microcontroller dev boards that look like bare USB flash drives. Yes the lack of IO is boring but you can run debuggers and learn subsystems and RTOS fun times with no IO.
IF you want to replicate just the software of this project, check out:
https://docs.zephyrproject.org/latest/samples/subsys/usb/mass/README.html [zephyrproject.org]
Almost any modernish microcontroller can run zephyr (check the docs) of that a subset with hardware USB support have Zephyr USB drivers.
I've done USB HCI protocol devices (virtual keyboards, basically) and the link above speaks USB mass storage.
As the worlds worst digital picture frame, I used this one time. Yes, a real picture frame uses the USB as a regular flash drive that can also be read complete with timed rotation of pics etc. However there is a simpler earlier step of "just get the darn thing running" at the simplest level and I was using this such that any file being written to the imaginary emulated was dumped as raw binary bitmap into a ST7735 LCD controller. I think this was a STM32 dev board but I don't remember it was awhile ago.
Another cool/funny thing you could do which I never quite got working was attach a quadrature encoder and maybe a display and as you spin the wheel the contents of the written files will be read ROT00 thru ROT13 thru ROT25 (well, ROT26 in a sense when it rolls over to ROT00). This is both useless and hilarious.
Something useful you can do with an emulated USB filesystem is get inspired by the Linux /proc filesystem and expose sensors and stuff such that plugging in the USB will show a flash drive with a small file named "temp.txt" and if you copy or cat it or look at it on Windows (I guess notepad++?) you'll see the contents of the file is the latest sensor result.
Microcontrollers with USB are soooooooooooooo cheap that I hope the previous design gets used in a car. Imagine if you could test your engine coolant temperature sensor by plugging its USB-C connector into any old modern-ish computer and simply reading a file. That would be cool. I mean I hate cars with embedded computers and infinite $$$$ generating sensors as much as the next guy but a system that sucks less would be better. I have not had much luck trying to find outdoor waterproof connectors that are a standard and pass USB. That would be cool... I suppose we'd end up with USB-C jumper cables and USB-C very slow chargers for EVs LOL.
In theory it would be pretty easy to add some other cool stuff and have an entire dev kit in a flash drive case. How about a weather type sensor (temp, humidity, pressure) connected to the microcontroller, those are pretty small. Even a light sensor. Actually kind of surprised this isn't already an Adafruit product or similar. An entire dev system, in a flash drive case, sounds cool. Maybe for a uni class. I am so old I took a 68HC11 programming class... back when they were new LOL. Something like this would be pretty cool although the limited I/O would suck. Maybe if you add a single LED output the uni kids could have a lab like make the LED blink the temperature in morse code or something.
Anyway, the point of the above is USB is super fun on microcontrollers and is both popular stuff and old stuff, but the physical hardware in the link looks cool. Usually "USB stick projects" look like an abomination so seeing a nice looking hardware project is pretty cool.
Note that in the spirit of microcontrollers being fast enough to emulate storage, I am told its "well known" there are plug in TPM modules that are actually hacked to hell and back microcontrollers where instead of keeping the private key secret, the hacked to hell microcontroller just reads it out. I'm sure if a MC is not fast enough a FPGA would be fast enough to emulate a "real" TPM.
TPM's as a concept are cool if you can trust them, which only a crazy person would do, so ...
(Score: 2) by VLM on Wednesday August 12, @05:03PM
Oh and as a disclaimer Zephyr USB is in perma-flux and remember to pay attention to sided-ness where you want the drivers that emulate a peripheral not the drivers that emulate a big computer. Zephyr has both types of drivers in general; I am fuzzy on exactly which if any MC have only one or the other supported as of today, buyer beware etc.
I am pretty sure there is at least some MC hardware out there that is "hardware accelerated" and only speaks HCI or only speaks mass storage or only speaks bus master (like its a desktop PC) so ... pay attention before purchasing.
(Score: 2) by JoeMerchant on Wednesday August 12, @05:05PM (2 children)
>I have not had much luck trying to find outdoor waterproof connectors that are a standard and pass USB.
They're out there: https://www.l-com.com/usb-usb-20-waterproof-type-c-panel-mounted-pc-tail-connector [l-com.com]
🌻🌻🌻🌻✌️ [google.com]
(Score: 2) by VLM on Wednesday August 12, @05:23PM (1 child)
That looks cool, although I forgot to mention if entire cars are going to be wired with hundreds of those, they need to be really cheap and need to physically firmly latch somehow... I find the idea of every sensor on a car plugging into any USB-C computer/phone/laptop for testing to be really cool for troubleshooting purposes.
What I'd like is an all USB-C car. In comparison, what we'll probably get, is an all Bluetooth car where you have to "pair" your EGR valve with the engine computer. I'm not sure if an All Bluetooth car would be heaven or hell. It would be one hell of an unintentional radiator, you'd be able to pop microwave popcorn with all those BT transmitters running at once LOL.
I'd also like to see CANBUS, cool as it is, go away and get replaced with 1000BASE-SX but modules for that are still like "ten bucks" so yeah not any time soon. Can't have a ground loop problem or one side of a twisted pair shorted to ground if it's a literal piece of fiber LOL. Also I think it would be funny to see hot rodders replacing their 1G car lan transverters with 10G SFP+ transverters, like audiophile style. Yo my exhaust sounds more beefy when I draw a green marker line on the side of my SFP connector LOL.
(Score: 3, Interesting) by JoeMerchant on Wednesday August 12, @06:47PM
I did an ECU swap on my 1991 in 1997... it was literally plug and play, pull the old ECU board from the case and put the new board in the exact same case connected with the same connectors. That was brilliantly durable - the tuning and even base software took 5 years of devlopment to get right, but the hardware itself was a no brainer. In 2004 they came out with a "simple addition" for a temp sensor they had resisted adding for the previous 7 years, claimed it really did make things work better, but by that point I was happy enough with how it had been working for the previous 2 years I decided to not mess with it.
Meanwhile, on a new 1999 vehicle, I read the wiring diagram and just tapped into the +12 supply under the passenger seat with a scotch-lock to get power for a disc player / FM transmitter to give us out own portable music collection on long trips. Kept that vehicle from new until 2023... the circuitry around that power tap (which I removed / re-insulated and basically returned to stock in 2007) was problematic, weird problems - maybe coincidental - but the seatbelt control module very near there both physically and in the wiring schema, just gave one problem after another - every 4-6 years. For a simple power tap. I also tapped the fuse block in that vehicle for aftermarket fog lights, I don't think that caused any problems elsewhere, but the switch install was a physical problem (cutting rectangular holes is a pain, having the switch hang below the dashboard is worse...) and we finally did let that vehicle go after it was having serious problems in the run-control circuitry - half the system would think the engine was running, the other half would think you're sitting with key in engine off. It also smelled bad from being parked under a tree for 20 years...
Anyway, around about that time of the old truck swap for a 2019 model, I did a full engine swap in the 1991. Custom ECU, 70% wiring harness change-out - stripped the airbag sensors in the process- it's remarkable how many wires it takes just to do "basic" EFI and spark control. The wiring was probably 80% of the time invested in the engine swap process. Cutting a notch in the aluminum transmission housing, fitting a custom sheet metal panel over the gap, replacing the K frame and engine, all of that went relatively quickly compared with getting the wiring done. Drove it for 3 years, then it had some kind of problem starting - apparently endemic to this variety of kit - and now I've got to go figure it out.
All told, I'd very much love to redesign an automotive wiring harness to make it as absolutely simple and durable as possible. Hundreds of USB connectors would seem to be contrary to that goal.
Can you drive safely without ABS? The whole world did until about 30 years ago. How about airbags? I'm all in favor of seat belts, but airbags? How many airbags is enough airbags? Windows don't need motors to go up and down, doors don't need power central locking. Some of these "wired" modernizations actually save cost compared with having physical key locks on the passenger door and other places, but... at what cost in terms of longevity? Having minimized the number of useless items throughout the chassis, then run a simple stout +12 (or maybe +48)V power line and a CAN bus data line for everything that needs to blink like headlights, brake lights, turn signals, cabin lights, etc. One data connector per "pod". Each connector is a failure point / service cost - there should be as few connectors as possible.
🌻🌻🌻🌻✌️ [google.com]
(Score: 2) by RootTwo on Wednesday August 12, @07:37PM
Don't give them any ideas. Next up USB-4.0 using USB-D connectors/ports and with USB-EV-PD. Order now and get a free USB-C adapter to charge your electronics in milliseconds.
(Score: 5, Interesting) by JoeMerchant on Wednesday August 12, @05:00PM (5 children)
If this is really going to work, what really needs to be good is the case of the USB device. It has to look like a mass produced commercial device, preferably with an 8GB label embossed in the plastic. No stated capacity is better, but if the device has any markings claiming it's bigger than 8GB, you're probably toast if they've gone far enough to plug it in for inspection.
Having an X-ray profile that looks like a commercial drive is another important aspect, a bunch of hand soldered jumper wires isn't going to pass the smell test.
If all that is good, the odds of their inspection figuring out some fancy partitioning footwork is slim... until they read this article.
🌻🌻🌻🌻✌️ [google.com]
(Score: 2) by VLM on Wednesday August 12, @05:13PM
Use a real case? Then it will look like a real case, because it is a real case.
I was always partial to the Kingston metal tube/bar designs, and those were popular enough to have clones, so if you wanted to make a clone of a case by hand, I'd copy the classic kingston. It's a rectangular aluminum extrusion, possibly custom ordering the exact dimensions to internally fit a USB plug would be difficult/expensive. They'll just think its a metal tube Kingston, if they bother to xray and it doesn't match its merely a popular grey market clone of the kingston design. If its a metal tube maybe they won't xray it anyway.
Sandisk flash drives were pretty popular back in the day, and they were physically big, maybe thats a good model.
Current model AmazonBasics would be interesting; they're also chonky enough to hold some additional hardware (LOL maybe some are already shipped to us, or at least to certain addresses with 'special' hardware LOL)
Maybe if the dev board were so tiny it'll fit in any of the above with a little hot glue / superglue...
(Score: 2) by arslan on Thursday August 13, @12:08AM (2 children)
It is and it does. It looks like one of the cheap USB drives from China... and yea this will definitely stump some of those pesky corrupt customs officers in some countries.
(Score: 2) by JoeMerchant on Thursday August 13, @12:16AM (1 child)
The problem is: if it gets published on a bulletin, when they dump your belongings on the counter for inspection their image-analysis camera may recognize the case and now you've been flagged as carrying a spy-type data smuggling device. I'd want to be able to swap the case to something both common in the market, and unique to me, not the same case that 1000 other data smugglers are using.
🌻🌻🌻🌻✌️ [google.com]
(Score: 2) by arslan on Thursday August 13, @12:25AM
Sure... the chip looks fairly normal in terms of form factor based on the pics in the web shop. I'm sure you can find an 8GB drive that will fit with a little bit of elbow grease.
(Score: 2) by Common Joe on Thursday August 13, @02:58AM
My preference would be to drop a software based encryption container (Veracrypt) with the option of plausible deniability. I don't actually use this feature, but it is pretty neat and you can use it on a USB.
Veracrypt, Plausible Deniability [veracrypt.io]
I recognize that may not be everyone's preference as some would really prefer hardware that can be destroyed or enforce the time delay, but Veracrypt seems pretty solid.
(Score: 4, Insightful) by looorg on Wednesday August 12, @06:58PM (4 children)
If they find this hidden partition it's going to be a much much longer, and possibly more horrible, interrogation. Even if they can't access it.
I would prefer one attached to a USB killer device. If not using it the correct way it's instead an anti-USB device.
(Score: 4, Informative) by Whoever on Wednesday August 12, @07:09PM
Related:
https://www.theguardian.com/us-news/2026/jul/23/cop-city-protester-phone [theguardian.com]
(Score: 0) by Anonymous Coward on Thursday August 13, @02:23AM (1 child)
And you think your interrogation will be less horrible after your device zaps their stuff?
Imagine even trying something like that in a country which has:
How did you even get modded up that much? Is SN turning into Slashdot? 🤣
(Score: 2) by looorg on Thursday August 13, @10:46AM
Or they can tell the two apart. They can keep more then one idea in their brain mulling over at the same time.
That said as a Forensic countermeasure the USB killer is quite bad. It won't really work, as intended. They are not going to put you unknown USB stick into any kind of important system or even straight into a computer. At worst then this would fry a USB hub or a dongle. But that is probably not getting fried either. The people that make these forensic devices already know about the USB Killer and have probably put in surge protection and then charge extra for that when they sell their device. The USB killer is against people that are stupid, people that pick up unknown usb sticks and just use them on their own (or the company) computer to see what was on this thing. Not a proper forensic countermeasure. In that regard if they would have been better off if it had fried the USB stick and not the the target USB port.
But you are correct in that it would only make things worse. Since you'll now also have other charges filed against you.
I'm somewhat intrigued by the websites that sell them that print "usb killer" on them. As if it was a brand. It either defeats the purpose as it acts like a warning. Or this is what you should do then on all your sticks to put doubt into the minds of people. After all it probably won't work as a defense on your part if someone does use it and you said it said usb-killer on it and you should have known better.
(Score: 0) by Anonymous Coward on Thursday August 13, @02:42PM
What sort of muppetry is this talk? How to land yourself in deep shit in one easy lesson?
In the context of dealings with any sort of security services (Police, Customs etc), if your USB killer device damages their device then, congratulations! you've just won a no expenses necessary trip to the nearest prison to be held on minimum charges of destruction of government property, obstruction of an official in the course of his lawful duties etc. etc. where, if you're really lucky and pull a stunt like this in the right part of the world, you'll get to visit that special room where they'll show you the alternate fun use that the secret police have devised for the plausibly deniable 15kV Megger that the kind electricians mistakenly left behind in the dank basement when they were rewiring the place, which is only fair - you fry their devices, they fry your...ahem, devices.
In the dim, distant past (early-mid '90s), I have memories of a parallel port dongle/hardware key for an ECAD package at one place I worked whose party tricks included 'self-destructing' if plugged into an unauthorised machine and sneakily monitoring the signals on the parallel port connection to try detect the presence of any connected logic analyzers etc, and again 'self-destructing' if it decided there was such a device present, there was also a big warning in the manual not to attach a printer to the dongle - one wonders why they went for a pass-through design - as this might/would trigger this mechanism as well, but as no-one ever reads the fucking manual...
If you do have a hankering to go all Mission: Impossible on it, an internal 'self-destruct' mechanism along these lines would be the safer option, after all, there are many, many dead cheap chinese USB sticks out there, one more added to that number is ever so plausibly deniable...especially one which has 'faulty?' written in sharpie/whatever on it's case.
As to this device, it might pass visual muster but it'll show up as being 'odd' on xray scanners especially due to the presence of the internal microSD card, they would have been better off making it look physically like the sort of generic USB microSD card reader that you might plausibly have on you to transfer files from your drone/gopro/whatever.