Turns out that to correct errors, each SD card comes with a 100mhz microcontroller which reports on the size of the device and runs algorithms to block out certain errors. On at least one brand, the firmware loader is not secured. This opens up a host of possibilities, from a very cheap source of Arduino alternatives, to a smtp server that sends copies of your files to an external source, or more complexity, as sd cards tend to be trusted once inserted.