If someone tries to sell you 30TB of solid-state storage for less than $40, no matter how many thumbnail rockets they use in their photos, consider going back and running.
High-capacity SSDs always seem to come cheaper, but in the words of a security researcher, Beam Corrected Twitter still has some deals too good to be true. In the spirit of discovery, bought a “30TB” external SSD from AliExpress for $31.40. Listed on Walmart’s website for $39 (I am linking for educational and entertainment value, please do not buy).
For those of you who follow this thread but don’t understand the scam:
The scammer gets two 512MB Flash drives. Or 1 gigabyte or whatever. Then they add hacked firmware that causes it to misreport its size.
Windows reports EXACTLY 15.0 terabytes. Note 14.89, Note 14.78
— Beam [REDACTED] (@RayRedacted) 26 August 2022
But when you go to WRITE a large file, the hacked firmware will overwrite the old data with all the new data while keeping the directory (with incorrect information) as is.
H2Testw actually WRITES and then REREADs its data. But the scammer slowed the bus from 5 gigabits per second to 0.48 gigabits per second
— Beam [REDACTED] (@RayRedacted) 26 August 2022
Inside, this “SSD” looks like two small-capacity microSD cards glued to a USB 2.0 capable card. The firmware for this card, each of these cards reports its capacity to the operating system as “15.0TB”, for a total of 30TB, although the actual capacity of the cards is much lower. Here’s another draw; While Windows reports drive capacities in bbytes (1,024 mebibytes) or tebibytes (1,024 bbytes), drive manufacturers use gigabytes (1,000 megabytes) and terabytes (1,000 gigabytes). So a 1TB disk normally only has a reported capacity of 930-ish GB instead of a nice round number.
The driver is even smarter when it comes to tricking people into thinking it works. It preserves the directory structure of whatever you copy, but as you “copy” your data, small microSD cards continue to overwrite and rewrite. Everything will look fine until you go to access a file, only to find that the data is not there.
Replies to Ray Redacted’s thread are full of alternate versions of this scam, including multiple iterations of the hot-pasted microSD version and at least one. stored in a larger enclosure and USB flash drive.
Fake USB storage devices are neither new nor rare, but this device makes extraordinarily dire claims about its price per gigabyte. When it comes to buying storage online, common sense advice is best: stick with brands, buy from trusted vendors (only sold by Walmart listing “JD E Commerce America Limited”, not retail sites you trust), and know that If a deal seems too good to be true, it almost certainly is.
