● Covered by 1 source · 1 reportMedium impact1 neutral
Open-source 'Phantom Drive' USB hides AES-256 encrypted partition behind 8GB decoy
Key points
- Phantom Drive appears as an 8GB USB, but uses a microSD card.
- A hidden partition with AES-256 encryption is unlocked by creating a specific text file.
- Built with a CH569 microcontroller, using USB3, SD/eMMC, and AES blocks.
- Firmware intercepts file creation to manage the decoy and hidden partitions.
Stealthy Data Concealment
The 'Phantom Drive,' developed by Rootkit Labs, functions as a USB storage device that initially appears as a standard 8GB drive. Its primary feature is the ability to conceal a separate, AES-256 encrypted partition. This hidden partition becomes accessible only after a user creates a specific text file with a predefined password string, making it suitable for scenarios requiring discreet data protection.
Hardware and Design
The device is constructed around a CH569 microcontroller, utilizing its USB3, SD/eMMC, and AES hardware blocks. Due to component shortages, the Phantom Drive uses a user-provided microSD card for both the visible 8GB decoy and the hidden partition, rather than onboard NAND chips. The custom PCB includes a USB port, buck supplies, a firmware update button, and UART test points.
Firmware Functionality
The custom firmware is central to the Phantom Drive's operation. It intercepts raw data packets over the USB bus, constantly scanning for a specific 'password' string within a newly created text file. Upon detection, the firmware copies the password to SRAM and overwrites the raw data with zeroes before it reaches the SD card, making the operating system believe the file was written while the firmware handles the unlock process.
Security Measures
To generate the encryption key, the firmware combines the microcontroller's unique hardware ID as a salt with the user-provided password. This combination is then processed through PBKDF2-HMAC-SHA-256 hashes 100,000 times (with an option for 600,000 iterations). Each hashing run introduces an intentional 2-3 second delay, designed to deter brute-force attacks against the password.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub o7-machinehum/phantomdriveReporting from
Rootkit Labs developed the open-source 'Phantom Drive,' a USB device that presents as an 8GB drive but conceals an AES-256 encrypted partition, accessible only by creating a specific text file. This device is designed for situations where users might be compelled to reveal storage device contents, offering a stealthy way to protect sensitive data.