332
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Aug 2026
332 points (99.1% liked)
Technology
87080 readers
4034 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Very useful for getting any sort of private data through an airport that does not respect privacy. For example any US airport...
No it isn't. It will be treated like any other drive where encryption is nothing new. In fact, to look for a text file and then make something accessible means it is likely much easier to detect that something is off about it than regular encryption that just looks like random data. Whether it tries to hide it's true storage capacity or boots its own internal OS to present storage, people often think they're being clever when really they're just making themselves stand out.
You misunderstood what is seen or how it works.
When the drive is checked, you can see files and whatever on what appears to be an 8GB flash drive.
You have to add the specifically worded txt file into that drive before the hidden drive shows up.
Do you think TSA/CBP is going to check the flash data lines to see if the MCU is scanning the flash internally?
This isn't a standard USB flash controller... You would need to break the casing and physically probe it to figure out that something was off as far as I can tell. It's not like the MCU broadcasts that it is scanning to the USB port.
You would have to be hitting the stick pretty hard, not just a normal file scan to notice the timing being slightly too long in a small portion of the scans. The bigger problem would be that the flash drive would be brand-recognizable if it ends up being mass produced that they might auto-confiscate it, and of course the default file that it searches for being known.
You’re proving my point. The device actually fails both ends of the threat model.
If it’s a casual check, custom hardware is total overkill. You take a standard 1 TB off-the-shelf drive formatted to its full 1 TB capacity as a single partition. You put normal files on it and hide the encrypted header—plus a lightweight host-side decryption utility/bootloader—inside a single JPEG using steganography. To any border agent, OS, or disk tool, the drive is just a healthy 1 TB partition containing readable files and residual random data from a quick format. There are no custom drivers installed, no modified media file sizes, and no missing drive space to trigger software or system flags. Once at your destination, you simply extract the utility from the JPEG on a trusted machine to mount the hidden sectors.
If it’s a high-scrutiny check, this custom hardware actively guarantees you stand out. CBP doesn't need software checks—non-destructive X-ray imaging is standard screening. Under a scan, a mass-produced thumb drive shows a single integrated ASIC on NAND. The Phantom Drive immediately reveals a generic CH569 microcontroller, buck regulators, UART test points, etc.
It visually stands out like a neon sign under basic physical imaging. It doesn’t defeat the threat model—it actively creates the physical hardware anomaly.
It would have to be distinctly different from any thumb drive over the last decades. My older ones definitely weren't just a single chip, I recon you'd need some immense training specifically on drive designs to know this isn't just a normal one from like 2010 or 2015.
Or some old cheap/free one. A university open day recently had a stack of free 8 GB USB sticks they were giving out.
If I got it right, you could easily detect this drive by just creating password.txt. as the article says it creation is intercepted and skipped. Hence if there is no password.txt afterwards, you know what you're dealing with. Still, you have to know this AND care.
It's only skipping if your password matches. Otherwise it'll just be a normal file.
Ah okay, so then I retract my statement and better my reading-skills 😁
It looks for a string "password:xyz" bring written to any file, where xyz is the password. If you get the password wrong it'll just write the file normally
Ah okay, so then I retract my statement and better my reading-skills 😁
No worries, I had to read stuff outside of the articles to get that information
You are yapping your ass off. This is a hardware mod, not a software package. Its literally using a custom storage controller chip that only physically unlocks the connection to the secret storage once it detects a certain key file on the decoy storage. They would have to xray the drive individually at close range with high resolution and know a lot about electronics to even come close to figuring out that something is different. There is no way to detect a fake USB HID so unless they open it they wont be noticing shit.
You’re completely confusing device classes and how forensic acquisition works.
First, it's a USB Mass Storage device, not a USB HID (Human Interface Device). Mass Storage operates via SCSI block commands wrapped in USB packets.
Second, even if the custom firmware successfully fakes the LBA table to report 8 GB, it fails at the protocol level. Forensic tools don't just read files—they issue low-level SCSI INQUIRY and MODE SENSE commands. Commercial flash controllers (Phison, Silicon Motion) have hardcoded ASIC signatures and proprietary descriptors. A generic CH569 MCU running C code trying to fake these descriptors or pass off software-bridged microSD reads introduces packet latency, timing jitter, and missing SCSI pages that log protocol anomalies during raw acquisition.
Finally, software doesn't matter if they look at the hardware. Modern 3D CT/X-ray baggage scanners visually isolate silicon footprints instantly without opening the casing. A standard commercial drive is a single integrated ASIC on NAND. A board with a generic CH569 MCU, voltage regulators, UART test points, and a physical microSD socket stands out.
You are so close to being right, and yet, so far away.
How would it be detected? It seems like the password detection and decryption is happening at the hardware level, and they take steps to have it show up as nothing more than a standard drive. I'm not an expert on this stuff though.
Airport forensic team can't flag an encrypted drive it can't detect.
The article talks about this.