Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/86 Thanks!
I think we can begin now, so Dimitri
is going to tell you something about
the security of the icy backside.
Please give him a warm round of applause.
All right, so unfortunately,
my my coauthors that I've done a lot of
this research with couldn't be
here, but so I get to do this alone,
but this wasn't by any means just
my work, but.
And so this is a nice for people who
maybe saw David Oswald's talk today.
He kind of did a nice introduction
to a lot of the concepts all covered
today in terms of security.
And also anyone who saw
the talk by the Infineon guy
just now, I'm sure got a very good
overview as well. But that was in German,
so I'll be covering a lot
of the same stuff, but in English.
So you're just a little bit about me.
So I'm a third year a Ph.D.
student on to Berlin at security and
telecommunications.
So one of the my main interests is
physical attacks. So what's a physical
attack against that? I see that's where
you actually go in and you
do something to the transistors.
So not externally connecting
an oscilloscope, it's where you
completely open up the device.
You go in, you put a needle down
or something along those lines.
So and also, we'll learn
what exactly these all these terms are.
So semi and fully invasive
analysis is kind of what we
did, which was never done before.
And an important thing
which which I mentioned and all
of my talk is failure analysis because
a lot of people think that, you know,
we're applying this to security and
no one has ever thought of this before.
And where, you know, how do people come
up with these crazy ideas to do all these
things? And it turns out there's a
there's a whole industry for this and the
industry is failure analysis.
So what failure analysis is, is
is basically you have
your when you're producing a chip and
something goes wrong, you don't know what
went wrong. So now you have to sit
there and you have to you basically
have to reverse engineer your own device
even though you designed it because you
don't know what went wrong.
So that's fairly nuts.
And so there's my, you know, Twitter.
And if you want to contact me by email
and I'm especially proud, it's my homage
to to Dan that I
got such a cool domain name.
So this is just kind of a
joke. So people who do electrical
engineering and maybe don't know this
well will appreciate this.
So this is kind of this was an
April Fool's joke done by synthetics many
years ago, and this
is this shows you from a conceptual
level.
Some of the main misconceptions that
people have when it comes to hardware
and if you apply to security, the
one of the main misconceptions
when it comes to security.
And so this as the joke
is, so this is a data
sheet. And what this is is a fully
encoded random access, right?
Only memory.
So I don't know if people
see the contradiction between
memory and right only, but it
doesn't make a lot of sense.
And actually, nowadays you do have right
only memory or certain types of right
only memories or things that are called
right only memory.
But this is back in the 70s, and this
literally meant something that you write
to and you can never get the data out.
And so they never get the data out is is
kind of expressed in some of the
applications.
My favorite of which is the first in
never old buffer.
So, so your data goes in
and it never gets out.
And this is the I mean, everyone
here is laughing and they see how absurd
this is. But when you when you talk to
vendors, when you talk to people doing
security or people who try
to build secure systems, they assume
they write the data onto the secure
hardware. And that's there's no way to
get it out. Because the hardware has
encryption, it's encrypting everything.
Everything's being executed, you know, on
the device and everything's being
processed on the device and never leaves
the device in an unencrypted form.
And that's all true, but that means
that it still gets decrypted on the
device. So on the device somewhere,
there's an area where you can find this
and basically, you know,
break the crypto by getting it
decrypted and the device does
all the decryption for you.
You don't even have to know how it works.
And so we'll we'll cover that a couple of
times as well.
So here's kind of let alone
for today. So I'm going to do some
background.
And so there's then I'm going to get into
I see reverse engineering and
then we'll talk about what the backside
is of an icy and why this is important.
And finally, we'll get into the
more exciting stuff that we did, which
was the kind of new research
the same way in full invasive
stuff.
So for that, I have a nice little
part of which is a nice also
a nice motivation, a nice part of a nice
BBC documentary, which was done.
And so I hope to let's hope the sound
works, OK?
And I TVs on digital had
picked one of those competitor systems.
It was made by a French company called
Canal Plus.
Their smart card had never been hacked
and
can now police technologies were so
confident in their ability
to supply a secure system
that they stated very openly that it
was unhackable.
The people who are setting us the
microprocessor in which we embedded our
software were telling us, I'm talking
about the largest companies in this world
of microprocessor cannot be broken.
Your software cannot be extracted.
But it could be an end, yes,
had the resources to do it.
All of the common and did crack open the
Canal Plus card.
Ends now possessed the competitor's
greatest commercial secrets.
Did people from the team and Haifa,
your team reverse engineer,
get a readout, understand the secrets
of the canal plus encryption system
of the kind of loose ideas?
OK, so you get the idea.
And so what happens is
you extract the software from a from a
smartcard and then you can build
something like this, which
I mean, I'll mention it also later, we're
going to be hanging around. So if anyone
wants to see all this kind of stuff
because, I mean, it's impressive to me
how simple it is.
You can you can come and talk to me.
But so what this is is it's one of the
original pirate cards.
So once they extracted the software, they
knew how the cryptographic algorithm
worked. And now they could go and grab
a different microcontroller and make a
PCB that basically,
you know, fits into a pay TV
receiver and you stick the card in and
now you didn't pay anything, but you have
all the channels.
So this is what this is, what results
from it? So again, the thing is,
this is this is what used to be the
case for the industry, because now we
kind of shifted because it used to
be that the the office station
was the fact was kind of what we talked
about before. It was just the data.
The fact there was data on the chip was
considered to be
a big enough kind of protection mechanism
to protect anyone from
attacks because no one would ever
be able to extract the software from from
a chip. And now we know
that's not true. So it will
be kind of getting into is what is what
they do today, which is you implement the
cryptographic algorithm in hardware
instead, which makes it much more
difficult to attack.
But if you're more interested in this,
this there's a nice book on this topic.
So people who I
talked to call it the book
because it's pretty accurate
and it has all the people who you need to
know. And yeah, I
mean, there's some, you know, it also
covers the story of Tron, which
CCC people will
surely know, but it's basically
how how chips actually
get hacked. Because a lot of times when
you look at academic publications,
they talk about side channels and how it
takes millions of tracers and hours of
integration, et cetera.
And in the real world, you know, it's
everyone wants to have success off the
first time and they don't want to tinker
with this. So they, you know, they get
out the bazooka and do what
is surely going to work.
So and yeah, so let's
get into that. So what you
kind of have this, you have to think of
classes of attacks when you talk about
hardware security and so on the left, you
have the the least expensive.
The most simple attacks are noninvasive
attacks. That's where you don't open up
the device at all.
So you connect to it externally,
you watch the power consumption, you do
something along those lines and some
invasive analysis. Now you're opening up
the package and now maybe you're trying
to hit it with with a laser, for example.
So using using a
laser to induce a fault.
Flip bits, et cetera.
And full invasive is what I explained
before, which is the stuff that I always
wanted to do is, you know,
there's a circuit manufactured on this
chip. I'm going to go in and change the
circuit so that I can get at the data.
So noninvasive techniques are
stuff like side channel analysis
and different types of glitching
and fuzzing, et cetera.
And so this is actually a project I did
together with Thorsten, who's up here in
the front row of the DOD in Kharkiv,
which is a nice little FPGA board to
play around with. And we'll also
mention how you can come and talk to us
about that at the end of the talk.
But so here you, you can really
do this low cost so you can do things
like there will be protocol errors.
So now if you can talk to the device, you
might be able to induce some
some errors and dump a couple of bytes
that way. Or you can play around with a
clock or the voltage, et cetera.
But so why is
this not applicable?
I kind of touched on this already.
So I mean, on the one hand, I mean, this
is kind of to compare and contrast.
On the one hand, you have limited
resources versus organizations
that are very well equipped.
And we kind of saw in the in the video,
right? This was a professional lab
from one of the competitors that
hacked this chip.
So, so in the real world,
it's not always, you know, somebody
in their garage, although there is also
Chris Darnovsky, who does all this stuff
in his garage, too. But I mean, the point
is, is that in general, you you
don't have the case where you have
limited resources, you have substantial
resources. That's kind of a
misrepresented in academia.
And so the thing like I said before,
you want to have a foolproof attack,
something you can do with a single trace
so you don't have to.
So like for sideshow analysis,
a lot of times you'll talk about millions
of traces. So what do people do to
prevent psychoanalysis?
They have a counter, and the counter
usually accounts to two to the
minus one. So the council sixty five
thousand. And then after that, the car
traces itself, and you're done.
You can't do anything on this card, so
you can't talk about doing
a million repetitions to to extract
some sort of key.
So the the again
high security attacks, you always assume
that you have kind of a black box, but
it doesn't stay a black box to you.
You actually reverse engineered it.
And you, you, you figure out
how the crypto system works, which which
is also kind of I found it interesting to
me when I saw David Stark.
He kind of touched on that as well.
This is that for even for their side
channel stuff, for for certain
applications, they really have to
understand how the crypto system works as
well. So anyway, but the main
thing is, you know, there there are
countermeasures and weird stuff
that people do on chips nowadays, and
you have that on the you have
that in every, you know,
chip that you buy. You know, it is this
relatively secure.
And this is enough to to
stop noninvasive techniques.
But high security kinds
of analysis will always be able to
circumvent any techniques implement
on the device because we can actually
change the circuit.
So what's a see reverse engineering?
So here we can kind of kind of look at
it. So, you know, transistors
are created at the surface of the silicon
wafer. And now on top of that,
we have interconnects going
around connecting the different circuit
nodes and basically you
passive nation around it.
So if you look on this
picture, you actually the MOSFET is
actually, you know, here in the in the
middle and around
it, you have passive Asian.
So so sorry, on top of it,
you have these this metal station.
So like I talked about, these are the
metal interconnects and around it, you
also have this isolation, which kind
of provides the chip structure,
and it allows you to deposit layers on
top of it, et cetera. And so this is also
something which a lot of people think
you know, that you look through a
microscope and you can see the tracks
running all across the chip.
But in reality, you know, there's layers
and layers of of of this.
It's literally glass that you have to
remove first before you can access the
the chip. So it's not visible to the eye,
but it's there.
And so, yeah, but
so just continuing.
So the the thing is, you now
have. So let me zoom
out, you know, sorry, next
slide. So the the thing
that you actually end up doing when
you're looking at a device is you begin
to you want to reconstruct the logical
function it's actually implement in the
hardware. And to do that is you do
what I have here.
You image the chip and so you don't have
one layer, you have multiple layers.
So usually like on a modern
smartcard, you might have five
to seven or eight metal layers.
If you have something like as complex as
an Intel CPU, you
have something like 15 layers, et cetera.
And so you even see the complexity
going up. It gets very complicated just
because of all the routing you have to
do. So but the process is
always the same. So you image the device,
you begin to identify the gates and
you begin to reconstruct the net loss.
So the net list is kind of the logical
function that the circuit represents.
So that's where you see like and
at the end gate kind
of like as a function.
And there, if you sit there with a pen
and paper, you can say, OK, what if I
have a one here and a zero here?
What do I get at the output, et cetera,
of of a very complex, multi-stage
circuit? So anyway, but the
thing we want to do is now that we have
the net list, we can see where is the
data decrypted and now we can isolate
that logic and we can basically extract
the secret data there, because now the
chip decrypted the data for us.
And so now we can pinpoint that area
where it's decrypted and get the data out
from there.
So just to give you an idea if you're
just an example, so this is just a
simple should be a
nand gate. One of the classics.
And so you just have the the
A and B and the output.
And in this case, the outputs not
connected to anything because this was
a weird type of gate, but I'm not going
to get into that.
But the thing is like
another thing which people underestimate
when they think, you know, you do icy
stuff and how do you look at chips?
And that's unbelievable.
You know how how
you know how much experience is
behind it. And the reality is what a lot
of people, people just haven't seen these
kinds of images.
So which you do and the human
eye is very good for this as you look
at a chip and all of a sudden you see,
Hey, those look alike.
And over here, those look alike on
the sides. So so what
this is is in the middle where you had
inverters and on the right and left you
have flip flops.
So you don't sit there figuring
out, you know, what the logical function
is. You one time with your eye, you
recognize that this is a flip flop.
And so you kind of scroll through the
device identifying,
Oh, that's a flip flop.
So let me maybe write that down if I'm if
I'm doing the on paper, et cetera.
And so the only thing that's missing is
this is just the gates.
So. But they're somehow logically
connected, so let's take a look at that.
And so here's an example.
This was some device and we'll get into
what we actually see here.
So we have a we have something that
starts down here and
and then it goes up
here and it ends,
but it doesn't actually end.
It goes down.
So now it goes down onto this layer.
And so now it goes to the left,
and now it goes down one more time.
And now, boom, we're in that gate.
So this is the input to the inverter.
And so now we have the we have the
the gate, and now we look at the output
because there's only one output and you
can actually see the the the
contact, you can actually see what's
going up. It's the dot.
So that's either the inputs or the
outputs, that's the actual connection to
the different to the other metal layers.
So now it's going up, obviously, because
they can't go down anymore.
That's the bottom metal layer.
So now it goes up over here.
And so now we know we can see it goes
over to the left and up and
boom, we hit the flip flop.
So that was the image we had before.
So if you actually reconstructed this, we
have some nonvolatile memory
because that's where we started off.
We know that the chip has its program
stored in nonvolatile memory.
And now we start going from there and
then we have an XOR.
And then for whatever reason, we have an
inverter because you can just have
inverters sometimes, and it doesn't
really affect anything.
It just flips a bit, right?
So and then we have our flip flop and
then all of a sudden and I didn't show it
here, you'll realize that after that you
have the ALU and all these parts, which
are actually parts of the core.
So but just keep that in mind.
So now just to just to give you a better
idea of of what it is.
So another thing that you
do. You don't just start making these
images. The first thing you do is you
make it like an overview of the chip.
So here you can already see
and get a lot of information about the
device so you can see that you have flash
up there because it's a big nonvolatile
memory. You can see the SRM
and E problem at the bottom.
And then here you have your actual
core. And how do I know that that's the
core? Well, it's just like when
you write, you know, write,
compile something logic.
So if you were to write assembler by
hand, you would get something which is
much more humanly readable
than something that GCSE
potentially spits out at you because it
will do tons of optimizations that you've
never heard of, etc.
And the same thing is the case here.
So you have this gray area which
doesn't have any any structure to it.
And the reason for that is it went
through synthesis.
It went through something which spit out
the most optimized code.
I mean, layout net lists that it could,
and that's what gets placed there.
And so in the middle, in the quarry, you
see completely irregular structures, so
it's almost depending on the device.
It'll look very gray or
something between, you know, black and
and copper or whatever.
So anyway, but the
thing to remember is that so we have the
flash and this data goes into the
course. So somewhere between the flash
and the core, we can find these wires,
which I had on the previous slide.
So this is the case if you're
extracting data from a device which
doesn't have encryption. So what is what
if it has encryption?
Well, we've kind of discussed this
already that a CPU, it can't process
encrypted data, so the
environment is encrypted.
And now this data comes out of the
nonvolatile memory and it goes
into the core. But before it gets to the
core, it has to be decrypted.
So now we know that we have a decryption
function here somewhere.
So now let's go back to this.
So in the case where we don't have
any encryption function, we would have
just nonvolatile memory shooting straight
through into our registers.
But now we have an extra
hint hint, which we don't even know
what the other input is.
And the other input is some sort of
encryption function, which we don't even
care about because the data we know for a
fact will be decrypted on the right side.
So that's just to give you an idea of the
of the kind of general workflow.
So you can also automate this process.
So this is like Digg aid for
professionals. So this is
Olivia Thomas's talk
from Recon. And so he actually did was he
did something much more advanced than
date. And this is literally a chip
where it's stitching the images in real
time, and he can just scroll around the
chip and see all the connections
and extract partial or full
net loss, et cetera.
And so this is kind of like,
I mean, there's you should you should.
I don't want to take anything away from
him because he did a really good talking
to explained a lot of the engineering
decisions because he also started with
something like Deckard and why he ended
up doing things like this and why this
works much better.
And it's kind of interesting, even from
an icy engineering point of view to
listen to this. But this is this is
kind of the direction that if you when
people ask me, you know, where do you
what do you think attacks are going to be
in the future? So now if everyone
is making their own, you know, custom
hardware, then you have
software like this to the obfuscated
for you because the obfuscation that you
did is you converted your algorithm from
software to hardware, put her on the
device. And you assume that no one will
ever be able to extract this.
And another thing which I already
had a discussion and kind of the speaker
room that I expect is with software
like this, you can also reconstruct the
masks. So now you can go
ahead and produce your own
copy of this chip if you want
it to. And so the interesting thing is,
let's say you have something like, let's
say somebody in the world was
was smart enough to build a bitcoin ASEC,
which was substantially better
than all the other bitcoin.
So now somebody in a country
which doesn't respect, you know, patent
and IP law as much as you do maybe
in Germany goes ahead
and constructs their own mask set and
sends it off to somewhere.
And now they get the best.
Effectively the best bitcoin exec
without spending a year
of development of this thing.
And now they can produce it for and save
money over going to the to the
manufacturer and having them produce the
system. So, I mean, the fact that you
can obfuscate hardware and automate this,
it makes it
opens up a lot of areas, new areas of
research that people haven't really
thought about. I mean, the other obvious
cases. So let's say you have PTV
again. So now you have a smart
card, which basically does some
sort of encryption on it.
And so now you go, you obfuscate
this, you extract the cryptographic,
you know, the hardware crypto
that's implemented on the device and now
you design the pirate card.
Except now, instead of having a
microcontroller as an FPGA because on the
FPGA, you can now synthesize
whatever the hardware function did.
Now again, you have piracy
everywhere.
OK. But this is all kind of
a background to I see security in
general, so let's get into what we
actually did. And so we did
stuff with the AC back site.
So this is these are things
that. So these are attacks that
go all the way through the
silicon substrate. And actually, I don't
have it on me.
I think it's in my bag, but I also have
the chips that we opened up.
So if you come and see me, I can let you
look at what they look like.
So, yeah,
so to understand the backside, let's talk
about the front side for us because the
front side is what was done up until
today. And so now
you kind of front side attacks are
becoming unattractive, which is why we
were motivated to look at the back side.
And the reason for that is you have lots
and lots of interconnect layers like I
described before, like on an Intel chip,
you would have no way
to do anything to the chip from the front
side. There's just too many metal layers.
You would spend too much time moving
signals out of the way just to interface
to the to the very, you know,
transistor level or to the very low level
of the device.
And the other thing is you have
countermeasures like active shields and
meshes. So what manufacturers do now
is you.
So let's say you buy a SIM card.
So if you buy a SIM card, you'll probably
have a not very secure device
because everyone wants their SIM card for
free, so no one's willing to pay a lot of
money for it. But if you go to
a big, you know,
smart card vendor and say, I want
the most secure card you have, what
they'll do is they'll take the SIM card
and they'll put another three layers of
metal on it and they'll say, You know,
now we implemented these crazy
protection schemes, these crazy
signals that go all the way around.
And just imagine you come down with your
needle and you'll end up shorting them.
And if you try to open them up using a
fib, you'll short them as well and we can
detect this. And so I mean, technically,
there are still ways around it which
Chris demonstrated a Black Hat in
2010, when he kind of showed
this on an Infineon chip, which had a
lot of the countermeasures.
But the thing is, it's still a nuisance.
So what it looks like this is kind of the
image we had before.
But the reality is you have something
like this on a on a modern smart card.
And what's completely irrelevant
to the actual circuit underneath is this
mesh. So these protective
layers on top.
So yeah, so that's why we want
to flip the chip over and go in through
the other side.
So we'll get into that in a bit
and you can do other stuff as well, so
you can actually do sensors.
So what you can do is assuming that the
density of of what you have on top of
the chip is so high you can assume that
no light will ever get through.
So if you ever see light underneath this
mesh, then you know that somebody open up
the chip. So stuff like that, and this is
really stuff that is implemented on
lots and lots of devices.
And interestingly enough, the smart card
industry remains the industry which has
the most, you know, secure devices.
I mean, I was talking to some,
some some of our colleagues and friends
and they say, you know, this is just
obscene how paranoid the smart card
industry is because you would think that
the value of data stored on something
like on some larger device to see on a
smartphone processor is much more
interesting. Anyway, long story short,
it actually gets easier too, which is
also something people don't want to
believe. So there's actually a machine to
do backside polishing.
So this is an election.
So it's a it's called a RCMP,
a chemical mechanical.
All Usher. And the thing is, it
doesn't have chemicals or electronics, so
to me, it's completely mechanical.
But basically what it does is it
does this. So there's some seventy four
series logic we threw on there,
just some chips.
For those who don't know who somebody for
series logic is.
And so what's happening is this machine
you kind of limit the motion that it has
in the X on the y axis and a kind of like
spins around and it hits
the one limiter and then it wobbles
around to the other side and up and down.
And so you let this run for a couple of
hours with as many
accurately said with some kind of slurry.
So you can use the like diamond based
slurry and stuff like this.
And basically, I mean, depending
on what you want to do, a lot of times
it's enough to actually just get a bit,
which is which is
manufactured for for the for the
packaging that you're going through.
But in any case, so you kind
of come in and you open up the chip from
the back and that's it.
Now you haven't used any of the fuming
nitric acid that David showed, and you
don't have any of this mess and you don't
need a chemical hood and and all this
so very, very nice, this backside
stuff.
So but so the thing
to remember, though, is that so the
devices, the actual transistors, we
can see, they're at the bottom so we can
actually access them directly.
Potentially, I mean, depending on the
size, this gets a little bit more hairy
if you're doing like 45 nanometers.
But if you're doing something like a
smart card like 90 matter nanometers,
this shouldn't be a problem.
And hundred and eighty nanometers is
gets even easier.
And stuff like older smart cards,
let's say, 240 nanometers, this shouldn't
be a problem at all.
And so anyway, but but the
countermeasures?
They're not there. There's no
countermeasures to protect against
backside attacks.
So. So.
And the other funny thing is is that
if you look at a modern SSD like
something that's in your smartphone,
it'll be this gigantic BGA package.
So how do they do these BGA packages?
They actually what they do is they they
have all the metal position on the top
and they flip the chip over onto kind of
this carrier and then they have the BGA
balls like directly underneath.
But so now your backside is actually
facing up, so it's even easier.
You just take your, you know, you could
even take it depending on how you do the
polishing. You could even take the whole
PCB and just polish down
the chip, just the one that you need and
now you would gain access to it.
But the thing, the thing that which kind
of which to me says or explains
why, why people never looks into
this is this which
is to scale image
of of what you actually have.
So the thickness of the substrate is
actually several times
the thickness of all of the active
devices and the wiring, et cetera.
And so, you know, people
would say, you're telling me I have to
remove, you know, I have to remove
instead of removing 10 micrometers
of this chip, I have to remove 300.
You know, how is that?
How does that make it any easier?
But the reality is you don't risk
damaging anything if you go through the
other side. You can safely thin
most chips to something like 10,
so 10 micrometers or even less
without affecting anything on
the chip other than it'll lose some.
It'll get a little bit more warm,
potentially because the substrates
actually really useful for transporting
heat away. So what this all
looks like is this and I remembered
because Colin always tells me I should
include these images. I remember to
include them this time.
So what it looks like is something like
this. So what we did here is so this is
the chip which was polished.
This is actually the backside.
So the label, the text on the chip
is on the other side. So the chips
actually mounted upside down in this
custom PCB, which we made with our
wonderful Leica F
proto modeling machine.
They should send us more parts
for free and
because we go through a lot, that machine
is actually pretty expensive to run.
I mean, the they know where the money is.
It's like the Gillette model on steroids.
So, so anyway.
But this is a it's so
that's what it is. So it's a custom board
and the chips mounted upside down, so you
can kind of see it from the single even
better. So you can see the
you can actually see the silicon in
there. I was thinking about it holding
like some drawing on the other side
because you can you can see the
reflection rate, so it could have like a
face or something. But I didn't do it.
But I mean, but so that's that's
what you need to know. So now we take the
chip, we polish the backside and now
we're at 30 micrometers
of thickness and now the fun ensues.
So the first thing that we did a couple
of years ago was this.
So a lot of people have
never heard of this. So people have seen
my talk.
Obviously know about this. But what this
actually is is that you take an infrared
camera and you let it watch your chip
as it executes data and you get something
like this. You can actually see
the photons that transistors emit
because with a certain very low
probability, a transistor that switches
emit photons. But now, if you sit there
with your camera and you repeat this
operation many times, then you can
actually get an image like this.
And so what this is is in the middle.
You can see where
memory actually. This is happening in
SRM, and up top is the is
the actual address, so now I'm going to
let this run.
So now you can see the layout of
different addresses on the on the device.
And not only that, but you can find
data dependent parts of the circuit to
and how to. I'll let you figure out how
we know this is data dependent.
So at the beginning, when we were
starting to do this research, this is
what I expected to happen, you know,
like from the very beginning, and then it
took us like a year to find
an area of the chip where you could
actually see the data bus
like this. And that's what it is.
So this is actually a
region of the chip where the data bus
comes in and it's addressing the SRM.
So what you see is on the bottom right,
you see the lower address bits, et
cetera, or sorry, this is the data
bus, but it's kind of shared so depending
on on kind of how many, how much logic
it has to go through, depending on how
many stages because of how
it's structured. I mean, some people who
write HDL will understand where I'm
coming from. You need bigger transistors
because it goes through more logic, et
cetera. And so that kind of explains what
you see there. And so,
yeah, but the thing is
that so you you still
have the limitations that you have with a
lot of these noninvasive techniques.
So you need millions and millions and
millions of integration.
So to get a good image, you need
something like you need the loop to
execute, so you need the transistor.
So the fact that you see a transistor
approximately once every 10000
times the transistor switches means that
you need millions of switches before
you can see something as nice as this.
But you can also apply to other stuff as
well. So here is a chip that had an ace
on it, and so I couldn't find the
other image when I was clicking
my my slides together.
But so actually, when you look in this
very corner, you
this region, everything within that box
would completely disappear if the U.S.
wasn't running. And now, if the hardware
ace was running, you would see this blob
in the corner, and this is very nice.
So we never kind of verified
this, but I'm sure this is the ace
because you could see that with other
peripherals as well.
But so now the thing that
you have to think about is if light can
get out through the silicon substrate
because it's transparent to infrared
light, that means infrared light can also
get in, which is where we get this.
So what
you can do is actually use lasers
as well. So what this actually
is is it's instead of taking
the image from from the front of the
chip. What what you do is you
open it up and you don't even have to
thin it afterwards. You just have to
remove the package.
And so you take a laser scanning
microscope. So in our case, we have
one of the industry standards Hamamatsu
famous. But this is actually I mean,
I know that. So the research that
I've been presenting up until now was
done with our Optical Technologies
Research Group and those guys
like for them to build one of these.
It's like a month's work.
So anybody, any university group that
builds optics stuff like when they figure
out that this is interesting to people
doing security, they're shocked because
this is so, so it's such an easy task
for them. But basically, you get
a very good resolution because you're
actually scanning the laser.
So you get even though you don't have
the resolution that you know.
So even though you're using something
like a one micrometer laser, you get
a very nice you get a
better resolution than you would expect
because you're actually scanning the
laser and the overlaps, you can kind of
compute it out, et cetera.
But so you can get a nice image just like
this is the chip and you can kind of
already see what's on it without you.
So this is on a on a something like
a SIM card or a smart
card package. This is literally taking a
scalpel and just removing the ground
plane, which is which is the middle
contact. So you open it up, you have your
backside exposed.
You put it under the famous and you can
already see what kind of chip it is.
You can even read if I don't have it in
this image or actually, yeah, do I think
in one of the corners in the bottom right
one or in the bottom left one, you
actually see at M.
and what revision this is, et cetera.
So this is also very nice.
But the coolest thing that we did using
using this is thermal stimulation.
So what we actually did for this attack
was we basically
dropped. So what we do is we browned out
the device, so we supply
it. I believe the supply voltage we took
it down from like 1.8
on on on the Infineon ship was also
in a second and we dropped it to point
six, which is enough where the
data remains in the memory
because it's not enough to lose the data,
but it's not enough to execute anything
either. And so now the chip is stuck in
this zombie state and if you look very
closely. So what we can do now is we can
scan with the laser.
And so now the chip's not executing,
there's no switching and we can measure
the current with a very precise current
amplifier. And so we can get using
that technique is an image like this.
If you look very closely into the image,
you can see what the data is within the
SRM. So now what you're doing
is you're browning out the device.
The device is basically stuck in a zombie
state, like I said, and now you're
scanning across the device and based
on the laser coming in, you're
affecting kind of the leakage currents
that are remnant on the device.
And depending on whether there is a one
or a zero there, you'll get a different
kind of response in your image and
that's what you can see there.
So the nice thing was people always say
you. Oh, that's great, but you know,
who cares about this because, you
know, on a on a real smart card, the
memory will be encrypted, but so on
the media, which Karsten did
quite a bit of research on and
present in Black Hat, et cetera.
You actually have SRM to
store the keys that encrypt the
SRM, so that's not a
good solution. So you can kind of see
that you can begin to read them out
there. Although we didn't really take
this to the to the
final stages.
But the other thing is there's there's
other things being proposed.
There's also a big like if you get into
hardware, research and academia.
One of the big things now is pops and
the most popular kind of puff.
So puff is a physically and clonmel
function, and that means that you figure
out some way to have your device generate
you unique response.
So the easiest way to do this is you take
an SRM and each SRM will
have a different response.
So you just read, you give it, you power
it up, and it won't just give you back
ones either one or either zero.
It'll give you back some random,
you know, data that'll be it won't
be random. It'll be it'll
have data which differs from every other
chip, but it'll be the same every time
you power it on this device and power it
back up. It's like a unique fingerprint.
And so now you can see that you
this is really stupid to use Ethereum
as well, because this is a really
effective technique for for reading it
up.
But anyway, but then we got into kind of
fully invasive stuffs, stuff
that we did. And so now we want to
actually go through
and actually touch, you know, modify the
circuitry. So we kind of just
the first thing that we did was we
continued with this topic of puffs.
And so now we said we wanted to clone
a physically on colonial function.
So we read it, we could read it out and
we knew what the data was that was stored
in it. And so now we wanted to take a
second instance of the device and
basically turn it from this
to to the next one and actually see
a kind of screwed up these slides.
But I'll get I'll get into that in a
second. I have the wrong.
But actually, let me just comment on that
since this unexcited. So actually in this
in this one of our attacks
and this year or
the first issue of CT for 2014,
it mentions us, which is this is
ironically exactly what claimants
and I wear and when we're working on the
film. So it
actually describes a lot of the things
that I'll be talking about. So if you're
if you're curious, definitely take a look
at that. But so again, getting back to
the SRM, we knew what the SRM was.
So we could we could do a couple of
things there. So what we would do is we
would take a second SRM
area and we would prevent it from
ever storing the value that we didn't
want it to store. So we would program it
to only be able to store zero or only be
able to store one. And so that's the top
image. So you can actually see the holes
are actually going down to to
the actual context.
And so the transistor is completely gone
there or at least the gate the
gates no longer contacted, even if some
of the data is left.
And so the but it turned out, you know,
since we work with.
So all of this work was done in
collaboration with our semiconductor
devices, guys.
They said, You know, this is way too
simple. We can do it even better because
we had a bunch of research previously
on trimming transistors.
So now the bottom image, what we did was
you thin the transistor, and
it turns out that if you thin a
transistor, it becomes faster.
So now you can set the value that you
want to be at startup.
And so now, as opposed to the first image
where it basically became a ram.
The second image, it still behaves like
an SRM, but we can basically
program. It's it's startup behavior.
So that was that was really nice.
And these are actual images
from our focused ion beam workstation,
which I should actually also mention what
this is. So I think a lot of people are
familiar with with what
a semi or a scanning electron microscope.
This is like a SEM, except it's ions.
So no, OK.
But so what it actually means is that if
you have a Ironsi, have a lot more mass.
And what you can do is you can put
chemicals into into the vacuum chamber
where you actually have your device.
And so now you can basically stimulate
a reaction to happen with nanometer
precision. So now you deposit a guess
that etches the way the silicon
substrate, for example.
And so now you go over it with your ion
beam and you say only please
only this, you know, two by two.
Or let's say something more realistic.
Let's say only this 10 by 10
nanometers square on.
Please only react here and then this
is what a fib lets you do.
So this is what how you manipulate
devices. I mean, this is how the most
advanced the text works.
And the thing that I should also
mention here is, again, this is something
which is done when chips are produced.
So when they do an initial generation of
of some chips, they'll run into
tons and tons of issues.
So they'll have stuff that doesn't work.
And instead of creating a completely
new design and a completely new chip,
they have different ways and they've
developed different ways over the years
to. You basically do like a
hot fix. So do like a fix
to see if it fixes all the other issues
or without, you know, maybe they can kill
two birds with one stone before they have
to produce a new chip, etc.
anyway.
But so this is kind of this is kind
of the simple case, right?
We're just going, you know, shooting,
we're thinning the chip.
We're just completely removing the
transistors that we don't want because we
know what an SRM is.
S films always have almost identical
layouts independent of which device use,
et cetera. And so now
now, but we actually want to do is we
want to probe it and we want to extract
some, some data and we want to do
some other stuff too.
So this is what we did kind of
here and again.
So we send it to 25 micrometers
and then what we do is so let's
say we want to attack some
signal, which is, let's say, over here.
So what this looks like is we send it
and this is all approximately to scale.
So after we send it, we might leave, you
know, 25, 50 micrometers or something
like that. And so now after that, we
take the fib and now we make what's
called a flip trench.
And so now we make a trench approximately
like so and so now we have a
hole basically going up to where
our transistors are.
And now we again, we
wanted to target the wire in the middle.
So now we have to remove just
in that area, we have to just remove
stuff there. And so we do that and then
we deposit some, some metal.
So now you see that it's kind
of exposed.
That signal is exposed to the outside
world and now we can come in with a
probing needle. And this is also
approximately to scale.
This is a one micrometer probing needle
that you can't see with your eye, but you
can install, you know,
orders of magnitude bigger than the
actual transistors there.
So that kind of the the the steps
that we went through was we
had to figure out a way to to navigate
through the chip. So on the left is a is
an optical image of the device that we
I mean, these are actually images of the
crystal.
And this is actually so I
will use this opportunity to dimension if
anyone's ever had to work on this is a
training that you should all go and check
out. It's I know Carson did it
when Chris couldn't do it and Bunny did
it with with Carson, as well as a sort of
awesome training where you actually get
to put some probes down on a device,
etc. and you get to get your hands dirty
and you get an idea of how all this stuff
works. But so now we don't have an image
like this and we can't just look through
a microscope and see what's going on.
But what we can do in our fab is
the substrates then.
So now we can use an infrared camera,
which you can get for the fib to
approximately orient ourselves.
So this is this is actually.
So these are identical regions.
So something over there, which looks like
that an optical image, you know,
perfectly crisp looks completely blurred
over here. But just based on the spacing,
you can still figure out where it is.
And this was just a second example.
So now we find where we want to go and
we start making the trenches, which is
exactly what we have here.
And so the wire that we're actually
targeting is is this was
as far as I remember this, I think this
is metal three. So this was not.
So this is, you know, the transistors,
the transistors go up to metal one.
Then there's a metal two and metal three.
There is something connecting between two
gates. And this is where we're targeting
them. So we're going all the way from,
you know, basically effectively going
through three layers of the device
to to to probe it.
And so now we actually deposited
some metal, which is which
is you can see the conductor.
That's the kind of blob on the or is
the bar coming out?
And the interesting thing is, you know,
when I showed this to Chris, he said,
that's the dirtiest fib I've ever
seen in my life.
And he's he's he's he's right.
But the thing was, we screwed up.
So the first time we shorted out two
of the wires when we were doing this in a
fib. But the nice thing about the fibers,
if you screw up and you short two wires,
you can disconnect them with a different
gas and then connect to the wires using
a different gas where you're depositing
metal. And so now we fix the chip, and
now we can.
We can come down and probe the chip as we
wanted to before, which looks like.
So approximately.
So there I mean, claimants
also built a probing amplifier, which
which did its job.
I mean, he even used some space
simulations to to see how well
it'll it'll behave.
But I mean, in reality, you could do this
a lot more quick and dirty.
So anyway, but the
getting back just kind of as a summary so
the CPU can work on the encrypted data.
So now we isolate
a signal where the data has been
decrypted for us, and that's where we put
our needles down and extract the
encrypted data.
And yeah, I mean, that's
pretty much all there needs to be said.
So the the kind of
an interesting thing that we thought
of next was something
which was covered pretty well and in the
console hacking talk yesterday, which was
how do you do
in like modern days?
How do you do crypto?
So a lot of times what they do is they
have fuzes, which they do
to program.
I mean, they use one time programable
fuzes to program a key
into the associate.
And so what we
see here is an area on an
80 mega microcontroller because then we
could easily play around with the fuzes
and set them and clear them, etc..
And so now this is an area where we have
the fuzes. And you can actually see
if the Fuze is set or not, because those
those dots in the in
both rows. So here you have eight fuzes.
And so now you can see if the Fuze is set
or not. And the reason for that is how
the image that you get on the fib.
These are actually secondary electrons.
So these are electrons that could reflect
that off the device and come back and
basically into your imaging
system. And so here, because
of the fact that you have a Fuze and you
have a floating gate, the electrical
field, et cetera, is different and
there's some sort of charge there.
And so now you get a different contrast.
So you get a different amount of
electrons coming back at you and you can
see this. And so I remember when we
were sitting there, you know, so now we
can set and clear the Fuze the brute
force way, which is either connected with
wire or disconnected by
disconnecting the wire.
And I remember when we were sitting there
with, you know, Starbuck and claimants.
And as soon as as soon as
we were somebody, I think Starbuck was
sitting there just testing every argued.
And as soon as as soon as we,
you know, set it, you know, check
if you are doing, what are the fuzes set
to? And then, you know, it's like instead
of it being f f, it's all
of a sudden it's, you know, seven
f four or whatever. And then I just
remember, you know, we're jumping up and
down and high fiving.
You know, you're so happy.
But the nice thing is with these
contrasting images that you you can
actually also see, you can
actually also see how you're removing
the gate, which is what you see here.
So you can see that you can
see it. And the contrast is also
representative of the voltage that you
have where you're looking at it.
So if you see on the left and the right,
the dots are actually the contacts going
up until up to the metal layers of the
floating it. So as we remove the floating
gate, you'll see that the voltage
changes. So we've actually changed the
value stored in the Fuze because all of a
sudden the right side isn't the same
voltage level as the left side, it
changes in its color.
So that was kind of nice to see, too.
But anyway, so kind of the summary is,
you know, advanced.
A lot of these are kind of claims that we
hear a lot of times and a lot of claims
that you hear from
from, especially if you send in academic
papers that reviewers send back to you.
So like, you know, we have advanced
packaging, you know, invasive analysis,
you know, this is all never going to
happen. And the truth is like,
I showed you, we don't even need
chemicals anymore to open up these chips.
So now you have a backside polishing
machine and you put your chip in there
and you let it polish away and you get a
very nice result.
And after that, you only need AFib.
You don't need all of these disgusting
chemicals that nowadays
at universities who don't
want to get sued by, you know, health
insurance companies are very hard to get
to. So anyway, but then
the other claim is, you know,
attackers must first reverse engineer a
device to attack it.
And so this is only this is not, you
know, applicable to the real world
because who's going to reverse engineer
a device? And and although
that may be true, that
most of the cases and almost all the
cases, the attacker is not going to
reverse engineer the full integrated
circuit he's going to.
He doesn't even have to reverse
engineering that much. I showed you what
the what the processes are finding
the areas where the decryption is.
It's not it's not even reverse
engineering, it's just following the
lines anyway.
And so
the reverse engineering modernizes is
impossible. They're way too complex.
And in reality, you saw that, you
know, the gates, they appear again and
again. So like a
cell library on a chip, nowadays, it
might have something like 60 or 70
different types of gates.
So fine you spend two weeks studying all
the gates and now you have all the gates
on that device, you know, all of them.
So now you can say X or inverter
flip flop, you know, this type of flip
flop, that type of up, et cetera, you you
just know them, and you can literally
recognize them all with your eye when
you're sitting in front of the the
basically the images.
So, yeah, the other thing is, you know,
data and VM is encrypted.
So who cares?
And we saw, you know, if it's
encrypted, it has to get decrypted for
the chip to be able to do anything
sensible with it.
And the last one, which was my personal
favorite, is devices will stop working
if you do any kind of backside attacks on
them. And the truth is, I
can say, with 100 percent of certainty,
we've removed 99 percent of
the device and it still works fine
without, you know, literally 99
percent of the thickness of the backside
we removed and the device still
works. So that's not true at
all.
So just a couple of acknowledgments,
you know, Chris Oliver
Starbuck, who is a who's
who really got me motivated.
So starving back in the day and this kind
of gets into because I'm going to do
questions after this number one question
that I get, especially when people come
in and talk to me like offline, is
how do I get into this?
And Starbucks said.
Learn HDL, and he's right.
The best way to get into this is learn
HDL and try to try to implement, you
know, your own soft core processors
and start writing this because you'll get
into the mentality that the engineers
have designed these chips.
And it's not rocket science, it's quantum
physics.
But it's no I'm
kidding, of course, because from a
logical point of view, it's much it's
much simpler than that even.
So yeah, and the other two people I'd
like to sincerely thank or my colleagues
claimants who did all of the kind of
invasive crazy stuff, and Alex
who was basically there as she on all
the optics stuff that we used for our
experiments.
So questions, oh, and I should before
I'll use this as all usurped this as a
small opportunity to say whoever
wants to talk to me and see
all of the lovely devices that I have
with me or wants to potentially
buy this lovely device called the Don
Crocker can come and
find us in the hack center.
So we're kind of in the bottom and to the
left and one of the alleys.
And you can find us there.
You can look. I took a picture
for the Don Crocker
Twitter account if you want to find it
there, but I guess I don't know how much
time I have for questions.
Yeah, OK, thank you very much for this
interesting talk.
So we we still have a couple of
minutes for questions, so if you have a
question, just get up and get in front of
one of the mics.
Do we have a question from the internet?
Yeah, form is asking
what the usual amount of destroyed chips
is. You need to get the information
you're looking for typically.
So I mean, that really depends.
If you're so the answer is
kind of complicated, right?
So in terms of
usually when you're studying, so I
can I can name a number that I know from
Chris. When Chris was attacking the
Infineon 66 six before he had
his first success, he destroyed something
like 80 chips.
So he spent 80 times, you know,
on the average, you know, for six hours
of work before he succeeded.
But this is a really secure device.
So if you're attacking something simpler
than this, you won't go through
as many chips.
And the other thing is, once you've done
this for for so let's say
so in general, you'll you'll see,
you know, this chip might not only be
used on one device, it might be used in
lots of devices. So once you have the
layout, once you know what the chip looks
like, you don't have to repeat this
again. So you have to.
I mean, you you know what the layout is.
So at that point, it's one chip, one
success.
So but kind of this this practicing
and education stage is
less trivial. You need a you need to
understand how the chip works to reverse
engineer, etc. So there are engineering
needs a couple of devices.
OK, then, Mike, three, please.
This is a really interesting talk.
Thanks.
The intel
are Angie doping
problem that you may have seen earlier
today. Yeah.
Do you think that through any applications
to backside scanning to try to
detect so you don't even have some?
I mean, anyway, so this this
was an interesting, interesting
paper, and a lot of the claims in there
are valid and I would agree with
especially everything that they say in
terms of, you know, inducing additional
psi channel leakage that I completely
agree with. But the thing is, there are
ways to detect this, you know, and the
industry has faced this problem too,
because sometimes you produce a chip and
for whatever reason, the transistor is
not working. And it's because, you know,
you have some creep of your of
whatever doping theory depositing
over into the next well.
And so what you can do is
what's done with ROMs.
So you basically use
you use other chemicals and you
basically doped them again to make them
stand out in an a scanning electron
microscope image. But you wouldn't do
this through the back side.
What you would do is completely declare
the device.
We're completely removing all the metal
and just be left with your your basically
your wells and then you would basically
color them, you know, stain them so that
you can see them in a SEM image.
This would be this would be one way to
verify this. But of course, the claim is
true that you know, how realistic is
it for Intel to do this after
they have some production going?
You know, can they do this every week and
they do this every month?
Can they do this every time they they
produce something? I would say a company
like Intel? Yes, but when you get into
low cost smart cards, I would agree that
you might have better success in hiding
something there.
Thank you.
OK, then microphone
number two, please.
Hi. Thank you for the talk.
I've actually a detailed question about
the Asaram readout with
the infrared laser.
I was wondering if that actually worked
with the standard amplifier that came
with the famous and whether you needed
to probe the device for that or
if that worked
on the external leads?
No. So we were just looking at the supply
voltage, so it wasn't using the it was
literally measuring the current through
the supply voltage of the device.
And this was I mean, this was again
working on smart cards and working on
microcontrollers.
So even did it on a hundred and
thirty nanometer
MSP for 30, and this worked great there.
And but the other question,
I think it works with the famous model,
with the famous amplifier, the standard
one. But ours was broken, so we used
a different one. And so that's actually
another thing for people who don't work
with failure analysis equipment.
It's it's like a matter of
you sitting there and praying that your
equipment works on whichever day you want
to use it. Because I mean, like for some
of the people, I'll tell this
story because people will appreciate.
I just remember when we were doing these
Fitbits, we lost the X
and the Y stage we're in.
No, sorry. Yeah, yeah, the X and
the Y stage on the fib.
So afterwards we were using nanometer
screws, so one of us was standing there
and actually moving the fib stage across
the chip. But the thing is, once you
approximately get it, you can still scan
with a beam. That's not mechanical.
You just have to approximately get to
that area. But I mean, we would still
have crazy stuff like sit there with a
screwdriver, tapping on the relays
until they until they let go, so the
stage can go a little bit, etc.
So it's horrible, you know?
Anyway, I see the
kind of people ask us, how how well do
these attacks scale?
And I say we attacked.
We more than successfully attacked
10 year old or five year old chips with
the 10 year old fib.
So now if we got a new fib today,
we could attack newer chips
as well. But I mean, your question was
kind of the laser scanning,
but failure analysis equipment is a
nightmare.
OK, then maybe one short question
from the internet do you have one
trick users can?
Wouldn't asynchronous processor
design render the analysis a lot more
difficult? To the point, it's practically
impossible.
So I'm not sure what
they mean from an asynchronous
processor design.
I mean, you have a lot of
I mean, I would say
I don't know how that would affect
anything. I mean, in terms
of obfuscation, yes, but I mean,
the the kinds of attacks that we were
presenting were understanding what
the the, you know, the actual
algorithm is or being able to reproduce
the device, produce a clone of it, etc.
So I'm not I'm not entirely sure
if the person was here I could ask for.
OK, then our time is up.
The people at the mikes can grip Dimitri
after the talk and ask him, so
give him a warm round of applause again.
Thank you.