Phantomdrive Open-Source USB Drive Conceals Encrypted Storage to Resist Coercion
Developer Ryan Walker has created Phantomdrive, an open-source USB storage device designed to protect users against forced decryption demands in jurisdictions with weak privacy laws. Unlike standard hidden-volume solutions such as VeraCrypt, Phantomdrive aims to prevent authorities from even detecting the existence of additional encrypted space.
The device presents itself to the host operating system as a conventional 8 GB drive upon first connection. Any data written to this visible area remains unencrypted until the user creates a text file containing the exact string password: PUTYOURPASSWORDHERE. The firmware then triggers a re-enumeration that exposes the hidden, AES-encrypted partition while simultaneously encrypting the previously visible area on the fly.
Hardware design centers on the CH569 microcontroller from the same family as the widely used CH340 USB-to-serial bridge. The chip provides native USB 3.0, SD/eMMC interfacing, and a hardware encryption block supporting the Chinese SM4 algorithm alongside standard AES operations. Storage is provided by an SD card rather than eMMC due to current pricing pressures; the entire assembly is sealed with epoxy resin so that physical access requires destruction of the enclosure.
Key derivation uses a per-device salt extracted from the USB serial number (for example, Phantomdrive:34FC1FA7145467F7) combined with 100,000 iterations of SHA-256. This approach eliminates rainbow-table attacks across multiple devices and raises the cost of brute-force attempts. The developer deliberately avoided memory-hard functions such as Argon2 because the limited RAM on the CH569 would make unlock times exceed acceptable limits.
Encryption defaults to AES-CTR mode, achieving approximately 9 MB/s write and 20 MB/s read throughput. AES-XTS is also implemented for users who prioritize resistance to ciphertext manipulation over speed, although it reduces performance to roughly 6 MB/s writes and 10 MB/s reads. Both modes were validated through functional tests and cross-checked against the OpenSSL reference implementation.
The firmware continuously inspects raw USB WRITE10 commands for the trigger string without interpreting any file system. When detected, the password is copied into RAM, the buffer is zeroed to prevent the secret from reaching the media, and the device switches partitions. Users are warned that high volumes of random data on the visible partition could theoretically produce a false-positive match.
All schematics, firmware sources, and mechanical files are released publicly, along with the supporting libraries originally developed for the hydrausb3 project. Pre-order pages are already live for those wishing to obtain early hardware units.
Related articles
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.
MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found
A Habra user named Slava_B conducted an experiment on September 8, 2026, to determine whether the MAX desktop client on Windows could detect or route traffic through a VPN configured at the router level. The setup used a Keenetic router that directed Russian resources directly while sending other connections via an OpenConnect tunnel to a European VPS, with no VPN client or virtual adapter present in Windows itself. Monitoring tools including Process Monitor, Wireshark, TCPView, and tcpdump revealed that MAX.exe and MAX-service.exe processes communicate locally and connect to MAX/ONEME infrastructure along with AppTracer services. The application repeatedly accessed MachineGuid, computer name, proxy settings, device IDs, and microphone/camera information, though these reads may support diagnostics and anti-fraud functions. No connections appeared on the VPN interface, and the client did not attempt to reach IP-checking services, Telegram, or WhatsApp. The researcher noted that TLS traffic was not decrypted, so actual transmission of identifiers could not be confirmed, and results apply only to this router-based configuration.
PII-Guard: Open-Source Detector for Personal Data in Russian Text
Andrey Ivanov, an NLP researcher at red_mad_robot, has released PII-Guard, an open-source system that detects and masks personal data in Russian text before it reaches language models. The tool combines rule-based checks with a fine-tuned ruBert-base NER model to handle names, addresses, phones, passports, INN, SNILS, bank cards and other entities. It replaces detected PII with structured XML-like tags that preserve grammatical information such as gender and entity ID, allowing models to generate coherent responses that are later restored with real values. The hybrid pipeline first applies normalization, pattern matching, Luhn and weighted checksum validation, and context windows with positive and negative keywords, then merges results with model predictions via an arbitration module. Evaluation on four public datasets, including Hivetrace, alexen2 and alrosait, shows PII-Guard outperforming other open solutions on both strict span matching and type-overlap micro-F1 metrics. The project, including datasets and code, is available on GitHub and aims to reduce leakage risks while maintaining downstream model utility.