If someone tries to sell you 30TB of solid-state storage for less than $40, consider turning around and running, no matter how many clip art rockets they use in their images.
It seems that high-capacity SSDs are getting cheaper, but in the words of a security researcher known as redacted ray on Twitter, there are still some offers that are too good to be true. In the spirit of discovery, he bought a “30TB” external SSD from AliExpress for $31.40, which also happens to be listing on Walmart website for $39 (I’m linking it for its educational and entertainment value, please don’t buy it.)
For those of you who are following this thread but don’t understand the scam:
The scammer obtains two 512 MB flash drives. Or 1 gigabyte, or whatever. They then add pirated firmware which causes it to misreport its size.
Windows reports EXACTLY 15.0 terabytes. Not 14.89, Not 14.78
Ray [REDACTED] (@RayRedacted) August 26, 2022
But when you go to WRITE a large file, the hacked firmware just writes all the new data over the old data, while keeping the directory intact (with false information).
H2Testw actually WRITE and then RE-READ your data. But the scammer reduced the speed of the bus from 5 gigabits per second to 0.48 gigabits
Ray [REDACTED] (@RayRedacted) August 26, 2022
Inside, this “SSD” looks like two small-capacity microSD cards hot-glued to a USB 2.0-compatible board. The firmware on this board has been modified so that each of these cards report your ability as “15.0TB” to the operating system, for a total of 30TB, although the actual capacity of the cards is much less. This is another gift; Windows reports drive capacities in gibibytes (1024 mebibytes) or tebibytes (1024 gibibytes), while drive manufacturers use gigabytes (1000 megabytes) and terabytes (1000 gigabytes). This is why a 1TB drive typically only has a reported capacity of 930GB, rather than a nice round number.
The unit is even smarter when it comes to tricking people into thinking it’s working. It preserves the directory structure of whatever you’re copying, but when it’s “copying” your data, it keeps writing and rewriting to the tiny microSD cards. Everything will look fine until you access a file, only to find that the data isn’t there.
The replies to Ray Redacted’s thread are littered with alternate versions of this scam, including multiple iterations of the hot-glued microSD version and at least one that hid a USB stick inside a larger enclosure.
Fake USB storage devices aren’t new or rare, though this one makes spectacularly outrageous claims about its price per gigabyte. When it comes to shopping for storage online, common sense advice is best: Stick to the big name brands, buy from trusted sellers (not just retail sites you trust; Walmart’s listing is sold through “JD E Commerce America Limited”, whatever it is), and know that if a deal sounds too good to be true, it almost certainly is.
