How hard can it be to kill a flash drive? Judging by the look of defeat on [Walker]’s face in the video below, pretty darn hard.
To bring you up to speed, and to give the “Mission: Impossible” reference in the title some context, it might be a good idea to look over our earlier coverage of [Walker]’s Ovrdrive project. It started way back in 2022 with the idea that some people might benefit from a flash drive that could rapidly and covertly render the data stored on it, err, “forensically unavailable.” This would require more than just erasing the data, of course, so [Walker] began looking at ways to physically kill a memory chip. First up was a voltage doubler to apply voltage much greater than the absolute maximum rating of 4.6 V for any pin on the chip. That corrupted some files on the flash chip, enough of a win to proceed to a prototype that actually succeeded in releasing the Magic Smoke.
But sadly, that puff of smoke ended up being a fluke. [Walker] couldn’t repeat the result, at least not with the reliability required by people for whom data privacy is literally a life-or-death matter. To increase the odds of a kill, he came up with an H-bridge circuit to reverse the polarity of the memory chip’s supply. Surely that would kill the chip, and from the thermal camera images, it sure looked promising. But apparently, even 167°C isn’t enough to forensically disable the chip, which kind of makes sense from the point of view of reflow survivability.
What’s next for [Walker]? He says he’s going to team up his overvoltage and reverse-polarity methods for one last shot, but after that, he’s about out of reasonable options. Sure, a thermite charge or a vial of superacid would do the trick, but neither is terribly covert. If you’re going to go that way, you might as well just buy a standard flash drive and throw it in the microwave or a blender. And we need to remember that this may be something the drive’s owner needs to do with jack-booted thugs kicking in the door, or possibly at gunpoint. It wouldn’t do to be too conspicuous under such circumstances. That’s why we like the “rapid power cycling” method of triggering the drive’s self-destruct sequence; it could easily be disguised as shaking hands in a stressful situation.
Who knew that memory chips were this robust? Kudos to [Walker] for getting the project as far as he did, and we’re still rooting for him to make it work somehow.
I would think an SD card would be a better route to go.
Have that as the flash-drive’s storage and send the over-voltage to that as they are much more fragile.
get micro SD card. They break in half very easily. Break them again to get 1/4s and even FBI and NSA would find recovery challenging. An average Joe certainly won’t be able to recover from snapped flash chip
I suspect most folks here could recover a broken SD card with some patience and perhaps some slightly smaller tools than normal under a microscope – as odds are really really darn good it seems to me that there will be nothing wrong with the chip just the shell and bond wires to the human scale pads being broken.
Cracked silicon chip would be rather hard as you’d need to read bit by bit and account for a few missing bits. If the flash drive used encryption, recovery would be impossible since missing bits can corrupt the whole drive and brute force password guessing wouldn’t work
There I agree, but actually cracking the silicon doesn’t seem likely. Whenever I’ve snapped the worn out SD card (which isn’t that often, so not a conclusive sample size by any means) it always seems to be the plastic that breaks.
Design it like toilet paper: snap along doted line?
I think the microSD card idea has potential, but as Foldi-One notes it’s hard to make sure that you actually crack the memory chip itself, and not just the shell or bond wires.
How about a little 3D printed “die” that holds the microSD card in exactly the right location, then you can hit it with your hand (or a pen, or a screwdriver or whatever) and the 3D print will ensure that the microSD card cracks in the “right” place(s) every time.
Or you could 3D print a mount for your stapler – insert the card, and punch a metal staple right through the flash chip.
Most paper shredders can handle a microSD card, and probably shred finely enough that the memory chip with be crushed beyond salvage….
I spent my career writing software for microcontrollers.
I remember one day I stuck the micro in the programmer rotated around – which swapped Vcc and GND, didn’t notice it, and went out to lunch.
Came back and the chip was scalding hot and had been that way for over an hour.
…but I let it cool down and it programmed and seemed to work fine. (Then went into the trash, and not into a customer’s product.)
It’s really hard to kill a chip. I’ve also heard lots of 1st person stories from hardware designers about how you have to wear a static strap or you’ll definitely kill that CMOS chip, but in reality I never worry about static and never had a problem.
Maybe it’s a karma thing, I don’t know.
In 30+ years, I’ve destroyed exactly one chip. One of a prototype CPU that they’d forgotten to put the esd protection on the first tapeout, and the office had nylon carpets (duh) that generated enough static that we regularly got shocks off the furniture.
On the other hand, I also knew someone who was the anti-Midas to hardware, and could destroy anything they touched.
I once managed to kill an ATTiny by switching an alternator field coil way too fast. No idea how you’d fit an inductor that size in a USB thumb drive though.
“On the other hand, I also knew someone who was the anti-Midas to hardware, and could destroy anything they touched.”
3 year old child?
Perhaps named Jubilee?
Microwave parts perhaps.
There’s a bit in the Jargon File — I think it’s under “magic smoke” — with a similar experience; a fellow was burning EPROMs and noting the status LED under the UV window, until he realized that there wasn’t supposed to be a light there and the die was actually glowing.
Just annealing the silicon to make it easier to program!
Magic smoke from “The Jargon File”
http://www.catb.org/jargon/html/M/magic-smoke.html
Quote:
Usenetter Jay Maynard tells the following story: “Once, while hacking on a dedicated Z80 system, I was testing code by blowing EPROMs and plugging them in the system, then seeing what happened. One time, I plugged one in backwards. I only discovered that after I realized that Intel didn’t put power-on lights under the quartz windows on the tops of their EPROMs — the die was glowing white-hot. Amazingly, the EPROM worked fine after I erased it, filled it full of zeros, then erased it again. For all I know, it’s still in service. Of course, this is because the magic smoke didn’t get let out.”
I accidentally grabbed an uncalibrated boot converter the other day and ran an arduino and ws2812 strip at ~23v. The buttons behaved a bit glitchy, but nothing died, and when I realised and brought the voltage down it worked fine. Was more surprising that the LEDs survived. Thankfully didn’t have the lipo battery charger circuit installed at that point.
I saw a misconfigured regulator output 12V instead of 5V to an MCU, the chip glowed for a few seconds before blowing a chunk off, no attempt was made at programming it afterwards
@PWalsh, was this an ATTiny85 or similar? The 8 pin DIP package is very easy to rotate by 180 degrees in the socket, and yes, it’ll get damn hot if plugged in this way. I’ve scalded fingers on these and yet I don’t remember actually killing one this way. Though, like you, I would usually discard the chip anyway, even if it tested OK.
Source: programming ATTiny85s with a room full of teenagers.
Here’s a thought, this could be a good use for transparent hardware encryption and battery-backed RAM. Initiate via the PC, on-drive encryption hardware stores a random encryption key in the RAM, and the PC software could back this up if needed. From here it appears to work like an ordinary flash drive, except a button on the drive disconnects power to the RAM, losing the key and making the drive contents unrecoverable. For bonus points it could be set to start wiping the flash storage if plugged in with no encryption key in RAM.
Or maybe use only ram?
Maybe a piezoelectric actuator that shatters the silicon by making it resonate?
Personally I might go with a thin slither of magnesium or lithium, laminated to protect it, with a bit of nichrome wire sat across it or maybe just a little pouch of strong acid that injects itself onto the die surface, but no doubt it wouldn’t be terribly convert.
I like the RAM idea, but there are methods to read RAM after the power is removed, residual charge sticks around for a while and biases the cells ever so slightly. Perhaps adding a super capacitor or a tiny lithium battery, then having it overwrite itself, with random bits, a few times just before shutdown.
Essentially TCG Opal, but for USB. Makes sense. And you might even be able to claim it’s mostly for balancing the ones and zeros.
I like my method, a miniature HV arc from a lighter transformer that goes through the chip stack.
No (as in zero) chance that will ever work again, if the HV doesn’t get it the heat surely will.
Out of my head you can do it the thermal, mechanical, electical or fireworks way.
Thermal: after getting it hot, you cool it down quickly? Body fluids are 37 Celsius degrees, the chip was 167. Thermal stress can kill the chip then?
Mechanical: add a on the same keychain that holds the stick an automated center punch and use it on the memory chip. Or place a small ball bearing on the chip, a coin over it and you can punch it with your fist to crack the chip. This could be hidden in the case.
One can 3d print a fully compliant pliers and crush the chip.
A prince Rupert glass teardrop can be hold in confined contact with the chip and when its tail is cracked, it explodes hopefuly doing the deeds.
Electrical: you have a device under the laptop (hidden as a cooler) delivering 200 volts on the usb ready to plug in the stick. Or masked as an usb hub. Press a little button and it overcharges the memory stick that is connected.
Or go MythBusters way and use thermite.
That Prince Ruperts drop idea is interesting, but I think you would have to unpackage the memory first or the casing will save the workings from harm. But a bare die is probably not a good idea either as you do want the device to a reliable data storage medium. Also I don’t think its all that covert as I can’t see a way to make it look like any other normal drive like that.
My suggestion would just be for a master always visible chip of really encrypted looking gobldy gook so time will be spent trying to copy and decrypt it – hopefully long enough to then write destructively to the whole other chip secure part of the drive. Which probably means an artificially slow data transfer rate and/or much larger capacity (that can of course be fake – it just has to report as huge and full) for the fake drive chip … But as these drives do often have multiple memory chips it won’t redflag for that, so as long as they don’t pre-emptively desolder the memory chips to read them directly the little ‘dram’ chip that isn’t can overwrite and overwrite – maybe it won’t entirely kill the chip in a reasonable time but it should at least have scrubbed it clean enough.
Though the idea of a more bare die gets me thinking it may be possible to make the chip break reliably in a very hard to recover way – unpott it enough to get at the silicon and with something bimetalic strip style use the heat of the reverse voltage chip to apply lots of pressure direct to the silicon – if you can get it to crack that would be near impossible to recover. However that wouldn’t really be practical on a small scale mass production IMO.
So this may be stupid but since there isn’t an issue with residual magnetic fields or phase change as in older tech, wouldn’t overwriting or erasing be sufficient? It would have to be really important to go through the trouble of pulling apart chips and stacked silicon to look at each cells state of charge. There is (or was ?) something like ATA-secure erase as well..
Otoh dropping it between plates charged with HV/high freq might work better (thinking “smoke eater” ish or better) might be better at inducing charges at die interconnects as control circuits are more likely to die before individual storage gates ?
Hmmm, “smoke eater”,
maybe an innocuous looking vape could be altered to deliver a fatal shock and/or acid.
Old name from when people smoked in bars etc, sorry. Think “electronic air cleaner” on some forced air furnaces. Essentually parallel al plates fed 6-9 kV to ionize dust.
A low-cost store called Dollarama here in Canada sells a $5 32 GB flash drive under the brand name “Eaget”. All you have to do is write a Windows install image to it it more than once to destroy the memory chip, in my experience with 2 of them!
self destruct and no thermite? what is this project?!?
Put a reverse USB killer on the flash drive so that instead of pumping high voltage at the host computer’s data lines it first pops fuses on them then sends the power back into the flash drive.
I’d suggest a spiral coil of nichrome wire potted directly over the flash chip to make a heating element. Circuitry applies the available 5v to the heating element when the self destruct criteria is met. If you can get to 600°C, you’ve got a dull red glowing flash chip, and I’m pretty sure your data is gone.
Surprisingly, if you heat the chip that much, the plastic of the chip’s package will melt, then the bonding wire will blow first, leaving the die safe (for a forensic lab). And it’s obvious that the key is dead from any observer.
A probably more efficient method would be to have a some inverting transistors on the data lines and burn them so they fail in short circuit. From any observer, the key looks fine, and when plugged on the computer, it’s unreadable until it’s formatted again, like a brand new key (and it’ll work once formatted too). The observer will just think the suspect hadn’t had the time to format it to save his files when he was interrupted/arrested.
Can’t for the life of me reason why this is even an issue. If I need to destroy something electronic, I have a 32oz rip claw hammer for framing with cross hatch on face. Hit, repeat until device resembles powder.
For those living in Hawaii it’s probably easier.
The point of the exercise appears to be to avoid data being obviously destroyed while you, the hardware, and the people with guns are in the same place.
I’m skeptical of this being a good use off time aside from the fun factor. Having purpose-built suicide hardware is going to get you nailed anywhere with effective rule of law. The hardware being conveniently dead is enough to screw you anywhere else. I don’t see the benefit beyond something like veracrypt with duress passwords.
I’m sure in the history of the world it’s been relevant, but it feels a little like having a contingency plan for lefthanded albino communist home invasion.
What’s the problem. Just use a micro-sd and when the bad guys are kicking in your door you just swallow it.
And they’ll put you in a room and feed you only laxatives until you produce it.
And you’d really not want a micro-SD card wedged in your gut, bowel etc. That’d be a “bad thing”.
One of the things that surprised me when I started working in semiconductor design was how good the ESD structures are at handing high voltage at low current. Chips can take repeated shocks of thousands of volts. But there’s a range above absmax and below where the esd structure starts to function, where a chip is pretty vulnerable. If you curvetrace a pin upwards you can see the current go through the roof starting a couple hundred mV over the absmax for a pin, and that’s where you’d like to aim. A boost converter whose output is 1.2V higher than the absmax, plus a mux to hook it to all the data lines, would be likely to damage silicon instead of just bond wires or do nothing at all.
Why not just wrap the chip and board with fine insulated copper wire a few dozen times wired up to deliver the required em-flux to scramble the living begeesus out of it?
I understand that physically breaking things is fun. But it seems to me that the most practical approach would be encryption. Stick a long enough random key into whatever, let it be a small eeprom, or the first block of the flash, and load it into the flash-USB interface chip at startup. If a panic condition is detected, zero-fill the key – this should be faster and more reliable than physically burning out anything. Not as spectacular though.
And likely not that hacker-friendly, I’m not aware of any usb-flash interface chips with publicly available docs.
What about using an FPGA as a storage device?
ok, the data is hard to destroy. How About some deception and “slight of hand”? We all know about death by unknown device that looks like a usb drive but is a charge pump that sends a high voltage down the victems dara lines quickly frying the machine trying to read the phoney drive right? and we have read about malicious code loaded from usb devices via a “rubber duck” attack, some even work as a usb drive with a part of the altered usb devices memory used as a drive to camouflage the attack, well put the data thats to be proteted in that type device and if some one trys accessing it without an disarming codeit turns on a device built in like the first i mentioned! Do you think someone would try that drive again if it destroys the first machine that trys reading it? It could also install some nasty network/hard drive controller infecting virus on the suckers machine giving them other things to worry about than reading your data!!
“sleight”
HTH =]
Thanks for the spelling check! you notice spell check acts different in windows 10 than it did in Win 7 pro? it is not automatic in most app’s and there isnt a menu itrm to force a check either!
So many wonderfully insane ideas here, so I’ll add mine:
storage device housed inside a solid metal case, welded shut, with a very large capacitor inside that will release itself onto the nand chip when a 30-second timer goes off.
The timer starts when the cable is removed from the female USB port. The USB port has a spring loaded door so it can’t quickly be opened without knowing the trick (tbd). So, thief guy is holding a metal bar that they’re unable to open. 30 seconds later, it gets warm, and it’s done.
Also instead of a capacitor, this could be accomplished with a power bank, so it looks like you’re just charging to/from a power bank, but it’s also a storage device, and that storage can be overwritten/destroyed physically using the might of the 12 18650s it’s supposedly managing.