Some quick tips to help avoid fake SD Cards/flash media


Prometheus

Well-Known Member
Joined
Mar 8, 2008
Messages
9,472
I just thought I'd post this in light of another recent thread, as the matter of fake SD Cards and USB flash drives is shockingly widespread. Anyone who follows SOSFakeFlash will likely know all of this (and probably more), but I just wanted to make a quick checklist available for reference.


For those unaware: Fake flash media is what you get when fraudsters sell flash memory that has had its controller hardware hacked in order to make it report a false size to the operating system. Which operating system makes no difference - because the controller itself is lying, it will fool any operating system. Sellers of this memory sometimes call it "upgraded", but it really is no such thing. Fake flash media often includes counterfeit flash media as well - fake-capacity flash drives and memory cards, which carry fake brand name labels and casings.


Some tips for avoiding fake flash media are as follows;


1: Avoid eBay. This cannot be stated enough. The majority of false capacity flash media is bought and sold here, and this is recorded as having been a problem on eBay since at least 2003, if not before. As a precautionary measure, you may also want to avoid third-party sellers who sell via sites such as Amazon and Play.com. Whilst many of these are honest businesses, there have been times when fakes have been sold via these facilities.


2: Snap yourself out of the mindset that fake flash media is in any way similar to fake handbags or the fake Nikes you saw at the Sunday market. Whilst fake handbags or fake shoes in some way perform as handbags and shoes would be expected to, fake flash media does not. Fake flash media lies about its capacity - what may be claiming to be 32GB, 64GB, 512GB, or any other size, is most likely actually only 64MB to 2GB in actual size, and likely to be made with unreliable parts, which in many cases may have been meant for destruction due to not being up to the required standards in the first place. You will never be able to trust these chips with your data - you are practically guaranteed to lose it.


3: Educate yourself as to what is a reasonable price. Whilst many people (sadly, incorrectly) believe that low prices on eBay are a result of "cutting out the middle-man", an unfortunately high number of people fall into the trap of believing one, or both, of two widespread myths. Myth one is "Companies make their products for small amounts and only charge high prices in order to rip us off.". Myth two is "Flash prices are always falling.". The profit margins on genuine flash media are actually quite slim unless you can move in high volumes, and the poor economy has hit flash manufacturers badly - for the last couple of years, prices have risen a number of times, and, more recently, stayed put for a little while (but soon began to rise again). You can get a handle on the spot prices for flash chips by looking here. Bear in mind that if you see Gb this means Gigabit, NOT Gigabyte (GB)! Likewise, Mb means Megabit, not Megabyte (MB). You must divide it by eight to get the size in GB or MB. Also note that some of the spot prices are for flash chips only - you also need to factor in the cost of casings, controller hardware, packaging, and so on. Regardless, this should help to give you a rough idea of what the retail price should be like. You can also look at the prices of a known-safe retailer of genuine goods to get an idea, too - Amazon UK and Play.com will give you this idea if you're from the UK, and I'm sure members from elsewhere can provide good companies to refer to for their respective countries, as well.


4: Because there is always a chance of fakes getting into even the best supply chain, regardless of where you buy your flash media you should always test your flash purchases with H2testw (a program for Microsoft Windows, which will also run via WINE on x86 Linux and probably via WINE on x86 Mac OS X as well), or its open source, command-line-based equivalent (currently only tested on Ubuntu), F3. (I don't have the know-how to see whether F3 can be made to run on the Pandora, but this may be worth a look for someone who can make it work. :p )


5: Beware of terms such as "upgraded"/"upgraded memory", and similar. These are, without exception, used by vendors of false-capacity flash media (often via wholesale sites that they are using to offer these items to resellers) to point out that the controller chips have been hacked to lie about the size of the flash chips they're coupled with.


6: Often, if the price seems too good to be true, it is! However, some vendors of fake flash media are cottoning on to this, and are charging real flash prices for their fake goods. If you think that £200 is a lot for a genuine flash drive, consider how much more it is for a fake!


7: Always use a credit card for flash media purchases, because credit card companies are more protective of their customers than some online payment services are.


8: If you somehow end up with a fake flash item, please report it to SOSFakeFlash, following their instructions carefully (bear in mind that they cover more than just eBay), and then fight for a refund. If you bought it on eBay and have already left positive feedback, DO NOT change your feedback in order to get a refund if your seller asks you to, because it will just invite others to be scammed in the same way as you were - moreover, this is feedback extortion, which I gather is against eBay's rules. Leave follow-up feedback instead, documenting the truth. If you can leave negative feedback, do so, and if you can mention the terms SOSFakeFlash and H2testw, your feedback may be able to guide more victims to resources that can help them.


I hope this post proves to be useful to someone. I wish the best of luck to all of you in avoiding this issue.


Disclaimer: I am in no way associated with SOSFakeFlash, and have thankfully never fallen victim to this problem myself (thanks to the efforts of folks like them documenting it in the first place!). I am just a bystander who is disgusted by the notion of people having their hard-earned money ripped off in such a way.


This post has been promoted to an article
 
Last edited by a moderator:
Here's a Pandora compile of F3: »» Link ««
The binaries didn't work for me ("cannot execute binary file"), but the source files could be compiled by just using gcc <file>. :)

I find it a bit funny it would take this long before anyone noticed my screwup, those are i386 biaries ;)


Will replace with ARM ones asap


EDIT: Updated, same link.
 
Last edited by a moderator:
Here's a Pandora compile of F3: »» Link ««
The binaries didn't work for me ("cannot execute binary file"), but the source files could be compiled by just using gcc <file>. :)

I find it a bit funny it would take this long before anyone noticed my screwup, those are i386 biaries ;)


Will replace with ARM ones asap


EDIT: Updated, same link.
:eek:


Just noticed how very /old/ this thread is.


Strange, seems nobody downloaded it but me - although this seems like a must have to me, what else could one do when buying a new, untrusted, SD card?
 
Had only I known. I feel so used and dirty now like I need to take a shower with my clothes on. Thanks for bringing this info to the surface again Prometheus!
 
i hate being that person, but after another pandora member falling into the ebay scam, i have to do it...


BUMP
 
Another one? :( What did I miss?
 
Last edited by a moderator:
Sadly, I bought a 2GB SD card from a third-party Amazon seller sometime in 2008, and didn't realize that it was fake until I tried to copy a Pandora rootfs image to it. I think it's actually about 256MB. Previously I'd only used it for Wii save files, which are small enough that I never had any issues. I'm pretty sure it's too late to do anything about it now, but at least I only paid $7 or so.
 
since i never said who the person that got ripped off was, here is his response to the problem....

From: *** ******* <***@nipl.net>


To: **********@gmail.com, *************@gmail.com


Cc:


Bcc:


Subject: you sent me two fake SDHC cards, and I'm NOT HAPPY


Reply-To:


Mr *******,


I am not pleased with you.


I bought two SD cards from you, falsely marked ADATA 32GB Class 10 SDHC.


I tested them, and they are counterfiet.


I promise you, you will be very sorry for this.


The items you shipped are really 1GB cards, and they are not Class 10. This


was not an accident. You didn't ship the wrong product by mistake. You have


shipped illegal counterfiet items. This is fraud, it is highly illegal,


and I will surely make you pay for it.


I see from your ebay feedback that you have scammed at least one person like


this in the past. You have also scammed others who did not notice at once.


I expect from you: an apology, a full refunding including all of my postage,


and $200 compensation for shipping a fake product and wasting my time.


You may send it to this email address ***@nipl.net by paypal.


I will not be shipping your fake product back to you.


I don't want to waste any more time and effort with you,


except to prosecute and punish you.


You've wasted my time although I specifically contacted you,


and warned you not to ship me a fake product. This annoys me.


Whether you compensate me or not, I will take very strong action against you.


You will receive extremely negative feedback from me on ebay.


I will contact all of the ebay buyers who have previously purchased memory


technology items from you. I will tell them that you are a scammer, and I will


show them how to test their memory items. If other buyers find that they have


also been scammed, we will take legal class action against you.


I will complain about you to ebay and paypal. They will investiagate you.


I will inform the SA police, the federal police, Australia Post, and the ADATA


memory technology company, and I will demand that they take action against you.


I will contact the other memory technology companies whose names you are


abusing. I will inform them that you are a scammer, a fraudster, selling


counterfiet items. I will urge and remind them to take action against you.


You have screwed over the wrong guy. I'm a computer expert, I'm in a bad mood,


I'm well connected, and I'm stubbornly keen to see you face justice.


I hope you will stay in jail for a long time.


"a teenager who committed several frauds on eBay has been sentenced by a


Queensland court to three years in prison"


You might I hope be punished more severely, since (I suppose) you are older.


If I am unable to prosecute you properly by myself, or with the help of the


other victims, I may ask my employer Linfox Armaguard for advice or assistance.


You may be aware that this company in whose head office I am employed, is a very


powerful Australian company in the security and money transport business.


We don't care much for counterfiet goods.


If there is some good reason why I should not take these actions against you,


you had better tell me what that might be, quick smart. I won't be persuaded


easily.


Most Seriously and Sincerely,


Mr. ****** *******


Analyst Programmer,


Linfox Armaguard


National Head Office


Essendon Fields


Victoria, Australia


Edit: thank you Fry
 
Last edited by a moderator:
Not sure we should have the name and e-mail addresses it was sent to on display, here. After all, whilst it's one of our community that this has happened to, it's unlikely the rest of us need to know the seller's e-mail addresses. Sorry DM, I think I'd better edit those out.
 
Just an addition:


If you are not firm with consoles and have no windows for h2testw at hand:


Most (not all) scams can be easily found out just by filling the card with data that is unique and can be compared (Zeros/patterns don't work). Sooo either fill the card with a couple of videos and check if the still look like they should or just create a file just as big as the cards free space with junk via dd on a trusted filestorage, md5 it, copy this file to the card and md5 it on the card again. Don't do it the other way round.


The MD5 way also detects other ways of scams and defects as well.


Mind you there are different ways of scams.


Size-Scam is the most popular with either just a wrong size, wich leads to a write error, when the real storage is exhausted and the address runs into nothing. The other way is a bit more "sophisticated". Sectors get adressed multiple times. This way the card really thinks it is a large card and can adress every sector. What it does not know: The data in the sector just gets overwritten as the sector responds to multiple addresses. This leaves you with a brilliantly looking complete filetree. Everything seems to be there. Only when you open the files after filling the card you notice that the content is damaged.


This is one way. There are 2 different scams that no one yet talked about:


* Half-broken cards sold as "new".


This is detectable with a full compare of every bit. Either via h2testw or via md5. This way every sector gets checked if it really keeps the data. Some cards do not but you will hardly recognize when you just save your data to it, as 10 MBs scrambled data spread all over the card are hard to find on todays large cards if you're not searching for it. You'll find them when you have stored something important on it half a year later ;)


This is not always a scam...the card could as well simply be broken but I know cases of dealers relabeling knowingly defective cards as new.


* Cards that do not reach their advertised speeds.


This is quite hard to detect if not extremely off the advertising as you cant expect a "20 MB/s read" card to always perform at that speed. Rule of thumb: The card should reach that speed at least nearly when reading/writing a very large file (+100 MB, the more the better but not the maximum cardsize) sequentially from/to it. Speeds differ greatly for small files AND (this is an important part): Some cards do not work well with some readers or OSes or filesystems or maybe indian graveyards...this may lead to slower speeds than advertised even though the card is capable of the speed (in a different reader, with a different filesystem, etc.)


-----


That said:


If you want hasslefree performance, stick to the big brands sold by known retailers.


If you want "something that just stores my data reliably" go for the budget cards from trusted stores.


If you dont mind the extrawork, try the cheap options.


The very hard competition and pricing in this sector has produced a lot of junk. This is mostly due to the fact that most customers can't or don't want to understand the differences between flash-products. For most people the only important bits for a storage card is size and price...so the marked responded and produced cheap crap at the right size. Some people look at "speed" meaning mostly any speed, so the marked produced flash that might reach a certain speed in very special occurrances (Something along the lines "Yes sir, your new Porsche goes 9.8 metres per second when dropped from a plane!" "Great speed, whatever this plane means, I buy it!")


This cleared everything in the "mid" section, meaning: decent quality for decent price, as either customers looked for the absolute cheapest (the mass) or more specialized customers went to the Top-Notch-Cards (Industrial, SLC-Flash, speedy&reliable cards for cameras, etc.). It happened 2007-2008 and this behaviour backfired very hard in my opinion. It lead to many companies giving up their previous quality because noone liked to pay for it. Now most flash products are cheap in every aspect ;)
 
Back
Top