The Null Device

2010/2/27

When the Chumby One internet widget terminal was being assembled, the company noticed that one batch of memory cards, from Kingston, had a lot of defective cards. (The Chumby One's internal storage is a MicroSD card, like the ones used in mobile phones.) Kingston refused to replace them, as they had been programmed, and it looked like Chumby were out of luck. However, Chumby had an ace up their sleeve: one of their vice presidents is Andrew "Bunnie" Huang, i.e., the guy who cracked the XBox, and not someone one should count on being able to pull one over.

Anyway, Bunnie noticed some irregularities in the cards' markings and decided to conduct a thorough forensic investigation, examining the cards' serial numbers and manufacturing dates (where he found more inconsistencies; a lot of cards with implausibly low serial numbers and mismatched manufacturers' IDs) and then dissolving the cards' casings to examine their construction, and unearthed some answers:

First, the date code on the irregular card is uninitialized. Dates are counted as the offset from 00/2000 in the CID field, so a value of 00/2000 means they didn’t bother to assign a date (for what it’s worth, in the year 2000, 2GB microSD cards also didn’t exist). Also, the serial number is very low — 0×960 is decimal 2,400. Other cards in the irregular batch also had similarly very low serial numbers, in the hundreds to thousands range. The chance of me “just happening” to get the very first microSD cards out of a factory is pretty remote. The serial number of the normal card, for example, is 0×9C62CAE6, or decimal 2,623,720,166 — a much more feasible serial number for a popular product like a microSD card. Very low serial numbers, like very low MAC ID addresses, are a hallmark of the “ghost shift”, i.e. the shift that happens very late at night when a rouge worker enters the factory and runs the production machine off the books. Significantly, ghost shifts are often run using marginal material that would normally be disposed of but were intercepted on the way to the grinder. As a result, the markings and characteristics of the material often look absolutely authentic, because the ghost material is a product of the same line as genuine material.
After confronting Kingston and getting an exchange, no questions asked, Bunnie didn't stop investigating, visiting the dodgy bazaars of China and dealing with characters straight out of cyberpunk novels to procure a selection of variously dubious cards to investigate, and discovering various truths, some less savoury than others, about the memory card market. (For one, memory cards cost about as much as the raw memory inside them, but also contain an ARM-based microcontroller which is thrown in for free; the microcontroller handles error testing and saves the manufacturer the cost of dedicated testing gear, whilst also allowing the users of the card to get away with using regular filesystems on them. Secondly, some manufacturers, pressed to cut costs and increase profit margins, appear to be sanctioning (or at least turning a blind eye to) ghost shifts with dodgy materials and pawning the brummagem batches off on the kinds of weaker players they don't have much to fear from.)

Ghost shifts, and unlicensed extra items made on the side, are not unique to the memory card industry; this article describes several cases of contract manufacturers churning out extra copies of goods on the side, often in quantities large enough to flood markets, including a case involving shoe company New Balance.

Of course, you probably won't find ghost-shifted iPhones (as opposed to actual fake pseudo-iPhones, with built-in FM radios and entirely different firmware styled to look more or less iPhone-like) on the market any time soon, as Apple play hardball with their contractors, insisting on draconian security measures, dividing the manufacturing process up between different companies, and using nonstandard components.

(via MeFi) forensics hacks scams tech 1