This subtitle is not finished yet. If you are able to, please support us and watch the talk in amara for the last changes: https://c3subtitles.de/talk/382 Thanks!
Marcus: Thank you for the kind introduction. Welcome to our talk about
engaging microchips. So the background in here is twofold. On the one hand side, we
would like to encourage you also to make some own experiments and to see what is
inside a semiconductor device that means what is inside a microchip. And so the
goal is that you also have some knowledge how to open up a microchip and how to get
direct access to the silicon. On the other hand, also, very often there's a rumor
that chip is highly secured because the silicon is inside of plastic coverage. And
if a plastic package is really high security, we can also explain today,
because very often even this amateur equipment, it's possible to open up chips
and to get direct access to the silicon. We are not only focusing on microchips,
but we are also focusing on more complex systems, how to open up the system to get
access to the silicon in our background. We have started more than 25 years ago
with analyzing the first telephone cards. And so starting off with some experiments
at the Commodore 64, as well as working with the first telephone card, it was our
major interest to find out what is the functionality of this telephone card and
also what is inside. And of course, for identifying what's inside. It was also our
target to open up stores, plastic cards and to get access to the silicon chip
inside the telephone card. Nowadays, we are also very often open up chips in order
to make some analysis or in order to apply some high tech methods, for example, for
putting some over particular variation on the top of the surface, also to apply some
laser. It's, of course, necessary to have direct access to the silicon itself. And
therefore, also today we are utilizing a lot of professional equipment in order to
observe chips. So today we would like to give a short overview about the different
techniques and methods, how to open up different kinds of chips, and also to
encourage you, because it is very interesting also to open microchip
packages in order to get further analysis. First of all, sometimes it's not quite
clear whether this is really a package which contains a chip or whether there's
only a kind of label, as you can see, in the lower picture. So in the lower
picture, it might be only a barcode labor, but perhaps also an RFID chip might be in
there. And therefore, a first analysis. It's the question, a inside the package.
And then, of course, also there's the question, what is it about the chip
functionality itself? That means how many functions are implemented in such a chip?
This is only a memory. Ship ourselves for some logic inside there. And what kind of
logic is implemented here? And by the way, on the most of the chips are also so-
called time markings. That means some small numbers and these identified as the
silicon itself and these same markings as possible to make some research and some,
um, findings from literature, as well as also from tools in order to get more
information about the chip itself. And finally, watching on the silicon itself
indicates also, if this is a more modern chip, that means smaller technology or
whether this is an old fashioned chip. And so you cannot expect so much functionality
or security funds the chip itself. So from this perspective, these are some
motivation which also may encourage you to open up some microchip packages and to
find out what's really inside there. We have fought also three examples, um, to
show what is a potential finding out of this. For example, it's well known that
some goods are tracked down with RFID chips. And so recently we also got a t
shirt with a dedicated label inside here. And it was not clear whether this label is
just about label or whether there are some more, um, techniques inside the specialty
and RFID chip. So as you can see in the second picture, it's quite easy to
identify if this is more than a barcode label, because simply with a torch limb,
it's possible to eliminate those from the back side. And so the flash indicates a.
There's something more than a bar code inside there and indeed is some structure
inside. We have put this into a glass of acetone and after a short while is the
label has to eliminate it. And so we can got we got the final picture with the
antenna inside here. And in the middle of the antenna is a small, dark spot. And
this is a chip. So it was clearly from the antenna size, such as communicating in UHF
frequency range and also the small dot. It's an hour edition. So now it's prepared
for further analysis with a microscope. So you see, it might be very simple to get
some more information out here. Another example brings us back where we back to
the history. And as I mentioned before, we have started this investigation on
telephone cards. And, of course, not only the telephone calls, but also the
telephone card system has been of high interest for us. And so we were in lucky
situations that we found some, uh, printed circuit boards from Cox Telephone where we
only got access to those because those car telephones has been burned down
completely. So it was a huge fire. And so inside is this area and so is the, um, uh,
telephone also get burned? Anyhow, we managed to get those printed circuit
board. And in the second picture, you can also see that the X-ray picture of the
printed circuit board, uh, clearly shows that all the borrowings are still OK. So
it was possible for us to draw a dramatic, uh, schematic and, uh, to see how the
different pins of this, uh, printed circuit boards are connected. Well,
anyhow, it was not clear what are the different shapes, because due to the heat,
simply the marking on the chip itself has been vanished. So from this perspective,
we have used some, uh, capitulation method in order to get the singer chips, the
silicone chips out of those devices. And as you can see in the lower picture, then,
uh, with some, uh, microscopy work, we were able to find out what is each single
chip. And so, uh, identifying the different names of those chips and also
combining this was a schematic. It was possible for us to, uh, resolve the main
function in those days from the cartoon itself. And this gives us a clear clue in
what direction the telephone has worked in those days. Yeah. And finally, also, there
was something in the beginning of 2000 there was a price competition. And is this
price competition, um, mean such as the small sticker, which has to be applied to
the, uh, TV set. And then in this perspective, uh, it was also that a lot of
rumors, whether this kind of spacechip inside Syria and you see on the lower side
says, uh, some, um, comment from the Internet at those days that there should
be an electronic chip inside Syria. And this electronics should not only record
what you are watching on TV, but also, um, make some sound recording in order to find
out how many people are in the room watching this show and so on and so on.
But anyhow, um, we clearly thought, well, this is just a rumor. And so, of course,
we use our, uh, techniques in order to open up this device and also to find out,
uh, what's inside there. And in the end of the day, it was clearly that this was only
a dot mask and below officers, there were some foom which is photosensitive. And
when you watch, uh, special TV shows and this film has been illuminated and
therefore it was clearly identifiable whether this show has been seen or not. So
it was clear for us that we could identify there's no spacechip inside and this was
only a rumor. So also, therefore, the preparation techniques are quite useful
and helps to understand what's going in inside Syria.
Peter: All right. Some some somewhat to the chips and the packages. So there are
many thousands of different packages for troops today. And sometimes the
functionality of the chip that just inside will directly determine the way, such as
packaged. And this is the case for these troops here especially. And if you look on
the left, that's an interesting thing. A fingerprint sensor, which is another from.
Even use today with his fingerprints, and this is a specialty that the chip itself
can be directly touched with the finger. Normally you would avoid such a situation,
but here you have the direct silicone accessible and there's only a frame which
is covering the surrounding of the chip to make it mountable and the device itself.
Then we have a webcam webcam shown here, which is just covered by a thin plate of
glass. Of course, the picture or the optical radiation has to reach the chip
and therefore the same is true for your microscope. You can directly observe such
chips without further preparation. Um, yeah, I think the older one of you know,
this is prom type of memory, old fashioned thing, but sometimes it's still seen
today. You can electrically write such an issue from memory, but if you want to
erase it, you have to put it under ultraviolet light to make the erasing
function. And so this means also this package has a window in this case that's
made of silica because this uses to be UV transparent. And again, you can have a
look inside without any preparation, which sometimes quite interesting. And then on
the right, we have an amplifier chip shown here and which is an instrumentation
amplifier, and therefore it should be sealed from the environment, but also from
electromagnetic radiation. And this is done here in this case by a ceramic
package. And this package has a metal that over it. And again, here, it's very easy
to open this package. We will see later on and was just using a blade. So all of
these four packages are quite interesting for an amateur. You don't need any
equipment at all to have a look inside. But as we said, from open to amateur hour,
some more difficult shops to open. And here on the left side, that's a typical
chip which you will encounter and millions today and all consumer goods. It's a
plastic package here. We have an order, one which is a plastic package. But you
also know the surface mounted devices and so on. So this plastic packages are quite
robust against environment, but also they are robust against chemicals. And this
means you need quite harsh conditions to open them and the chemical weigh. Are you
when it laser, which we will see later on, epoxy resin. And the same is true for the
laptop package, which is a very low cost kind of package, just as it is put on the
circuit board, then it's connected point wires to the circuit board itself and then
afterwards just a drop of epoxy resin as part of it. And you see, it's not a
rectangular form which should have. It's more just a drop which put on top of
clocktower package is also seen here. And the third picture, which is the smartcard
package, the typical one, if you would turn this picture around, then you would
see on the other side that there are the typical Golden Smartcard contacts. And
from the back side, it's a picture like this. You have the chip and the chip is
connected, was bond wires to the connection points and then afterwards to
hold it in place and also to make it resistant from the environmental
conditions. It's also protected with a blocked off package. So it just epoxy
resin is poured over it. And then finally on the right is something which some
people call a security package. You see that matterson hyphenation. Not only is it
dark so that you can see directly through the through to the chip, but there's also
there can be some special Latisse, for example, in this case, there's an
additional layer which is put on the chip, which is also made of silicon itself. But
yeah, as we showed here, it's not I would say it's not really security. And many
cases of this package, just because of the security, does not start in the chip
itself. And I would say then it's a little bit too late. All right. So what can you
see if you look inside such chips and we have chosen some examples where you don't
need any preparation at all. Here you can see some memories for beginning. It's
quite interesting to have a look at all the chips which are sometimes available to
store. And that's because simple fact. And the older days, the technologies were not
so small as today. So this means you can see the structures. What's your barai or
maybe you need your grandfather's magnifying glass, maybe, but you don't
need a high definition microscope. And so here on the far left, that's a chip from
nineteen seventy six, very old one very small memory. And you can directly see
with your eye all the structures inside just through the window without opening it
at all. And then if we proceed in time also to a vintage chip from nineteen
eighty eight, one megabit it from there. See already it's more like a gray mass,
that's a memory cells and you definitely would need a microscope to have a further
look inside how such a memory is built and to analyze it. And then on the right.
That's also an interesting example of a memory. But this memory has some access,
right. Tied to it, because that's the telephone chip card. And here you have a
very small memory of only 88 bits. But the rest is controlled logic so that only the
people who are or should be allowed to load it and to erase it have this access
rights given to them. And if we look at the little microcontroller units and they
are quite more interesting than just a memory. And here again, we have four
different chips brought to you. Two of those also have windows. You don't need
any preparation at all. And the one on the left is, again, a chip from nineteen
seventy six, very old. One can see directly all the different structures like
Rom Ram that you prompt part and also the logic part which contains the CPU and also
some analog devices which are needed for the functionality of the chip. I think
that pick 16, the second picture, you know, and the flash version, which is very
common today, you just can program it and erase it again and a normal device. But in
1988, these types of the control that were made was EPROM. So this means you could
program it. And then if you want to erase it again for reprograming, you have to put
it under ultraviolet lamp for five minutes. So therefore, there are some
older versions of the controller. But what you can see is that the technology is
smaller and that the chip is just a very high density and comparison to the chip,
which is 12 years older. Interestingly, the smart all the smart card controls look
quite the same, like these older devices. And they also have from RAM you prom are
normally prom. So electrical eraser, a programable rom. And so therefore the
smart card units, even those of in the 90s look like the same, like the older and
serious. And finally, just for comparison, we also brought a sixty eight case. If you
this has only cash but no nonvolatile memory and was used in some old home
computers for example, but also in instrumentation technology. So what do you
need if you want to start with preparing microchips. Just to have a look, if it's
interesting for you to have a glimpse inside. So what you definitely need is a
simple microscope. And we showed there a student version that's about 300 euros.
But they are also quite interesting USB microscopes today and which come ready for
use for about 150 euros. So that's quite good tools. You need definitely some
mechanical tools like scalpels, tweezers, which we have here sometimes some sort of
dentist tools, which also would serve quite well, an ultrasonic cleaner. It's a
very good thing to have because this is really nice for package preparation,
cleaning, but also removing particles and also of the chip is prepared and ready.
Then you can remove all remaining residues and particles from it. And finally, there
are three solvents which you need for beginners, which is alcohol, ethanol and
acetone and also benzene. These are three solvents from non polla to polla type. And
with these three solvents, you can open a lot of different packages. Then for
upgrading such equipment, it's quite interesting to have a 3-D view. So was a
stereo microscope. You can make preparation with both your eyes. You have
a 3-D vision and you can directly see what you are doing, which is sometimes quite
difficult. If you have on your monocular side, then if you want to share your
results, a microscope camera could serve your well, which is available for about
300 euros. But there are also some DIY versions, for example, with no cameras
which are adapted to the microscope itself. Some further chemicals can be
needed, which I will also show you later on the table, which are not without
danger, I would say, and therefore also typically a lab coat and some protective
wear would be used. So now we are in a moment we will come to a different details
of how to open a package and and the steps itself. And this will be sorted from
physical opening statements, the methods or mechanical methods over to chemical
methods for you directly open. So device with chemical means. But there's also a
mixture of both. And therefore, I would like to hand over to Marcus.
Marcus: Yes, thank you. Let's go to the workbench and open some packages. So
beginning, as Peter mentioned, with the physical ones. And the first one is quite
easy. You just need advice. And as you puts a chip inside vis a with the lower
part of the I see as depicted in the first picture and then you just put some more
forces to the I see. Pictures save and during the time device will be smaller and
smaller, the package will break up and the upper part lift up. So as visible in the
third picture, you can use a simple screwdriver to remove the upper limit. And
then finally, in the last picture, it's visible that the bare silicon chip is
visible for your further analysis, also connected to the lead frame. So the frame
which connects to the outer pins and to the outer communication. So this is a
quite simple method. And indeed, this is the first method we have also used in the
example of the copper telephone I have explained earlier. So it was quite easy to
break up those chips in order to get the silicon parts out of the ICS and then
analyzing them with a microscope, even if the package will be a little bit more
hardened. For example, a ceramic housing like use in eponyms, then it's also a good
idea to have fixes and device and just to replace a screwdriver on the top part of
the see, and there's a small bump on the back of the screwdriver. The upper limit
will be removed. And as you can see in the chart picture directly, the access to the
chip is possible. So indeed, I think these pictures clearly identify that this must
be not high, sophisticated techniques or some sensors, sometimes really a normal
workbenches sufficient to get access to very easy. It's in the case if there's a
special package, as Peter has explained, with such a metal lid on top of this,
because this method to it is sold out on the academic housing. And typically you
can think about where grindings as a way or try to sold out or something like. But
there's a very easy method to open up those kinds of packages. You just use a
blade as visible in the second picture and, um, use a hammer for a small store.
And then this blade drives and is this metal dirt and you can simply lift off
this metal without any further, um, effort. So it's just, uh, two seconds, uh,
work to open up those kinds of packages. And even those blades are quite easy to
access because you can see in the lower pictures that they are sold also in
discounters for, uh, cleaners of Deskovic. So these blades are easy to use just with
the hammer. You can drive them below the lid. And so this opens. So you see
physical mechanisms can be very easy. Now, as also mentioned before, our first topic
has been to, uh, check what's inside a telephone card. And, of course. Such a
physical preparation, it's more complicated on a small plastic card, and
therefore it more goes into the direction of physical chemical reaction on source
cards. And you can see here in this hall of pictures, we have just played such a
smart card in it's. And after five minutes, as was a in the second picture,
the plastic of the card absorbed some acetone and therefore swails. After 15
minutes, you can just wait for those minutes. Then the structure is fully
destroyed. And so it's quite easy to remove the remaining plastic parts as
visible on the fourth picture in the apple. So, again, just by waiting about 15
minutes in, etc. on the smart card is um. Yeah, destroyed. And so, um, as visible in
the lower picture, all it's possible to remove the antenna and censorchip itself.
And I think the result and the last picture on the law, uh oh it's quite
impressive. It's a complete antenna, including the chip has been resolved out
of this, uh, plastic card. And so, um, it was quite easy to analyze the antenna and
the size and how this is implemented in here. Anyhow, you may recognize that the
chip is still covered by, uh, uh, a laptop. That means a small piece of, uh,
epoxy on top of this. And so it's a question how to remove this here. It's
possible to use, for example, a laser with, uh, um, infrared laser, especially
for about Servais flying of 10000 nanometers. Um, it's quite useful to open
up those kinds of pictures because the silicon itself is transparent for such an
infrared radiation. So the chip itself would be not directly affected by the
infrared radiation, but all the energy will be absorbed by the package itself. So
it's just a trauma to, um, destruction of the package as visible in the lower
picture. And especially also this is quite useful to open up so-called secure
pictures, as Peter has explained. So even those kinds of packages, uh, are just
applied with a laser and, um, it's opened up so that all the, um, silicon can be
directly accessed. Anyhow, this, uh, may also be some risk. It appears on the one
hand side, the risk that the chips to get damage due to the fact that is, uh,
package components are heated up and souless temperature could also be applied
to the silicon chip itself or make some, uh, Tominaga medical attention and
therefore, chip may break down. On the other hand, of course, infrared laser
radiation may also, um, make some, uh, health, uh, difficulties. And therefore,
it's very important, um, to be careful with those laser radiations. So question
is, OK, how to open up epoxy in other ways, not, uh, having such a laser, and
therefore for us, again, a physical preparation take place. So for applying
Shamika, it's it's very good to prepare the chips with some, um, mechanical
preparation. And you see here again, the chip and advise and then with a grinding
disk and some parallel movement as visible in the, uh, third picture here. And this
whole small curve has been set up. And so we have two advantages in here. The first
advantage is that already some material is finished. And so therefore we have, uh,
faster access to the silicone and save. On the other hand, also, we have some, uh,
area where some chemicals can be dropped on and, uh, will take place here. So let's
go with the chip to the, uh, Shamika treatment. And here again, in the first
two pictures, you'll see the preparation by the mechanical grinding and censorchip
is, uh, put into a sandbaggers, which is heated up. So at about 50 to 90 degrees
Celsius, send some nitric acid, uh, will be dropped on there. And just after
overseer's epoxy will be removed and, uh, you can get direct access to the silicone.
So after you have the desired result, that means after all the epoxy has gone, you
can remove the rest of the. Set by using some acetone, as was a boot in the lower
picture. Um, hole and also it's a good idea to clean up, um, the chip into the
ultrasonic cleaner in order to remove the remaining particles. If you don't want to
wait for a long time, then you can again use some acetone in order to have some
carpet try drying. And finally, you have a very good, uh, preparation where you have
access to the silicone, but also have, uh, the connection. Uh, most of the cases do
OK for using the chip and operating the chip in this environment. Anyhow, as this
is, it may also damage some parts of the chips. And therefore, it's also the
question if you do not need to operate the chip, but just for inspection, that's
another method to open up those kinds of epoxy. And it's just using California or
in German, California. Um, so putting parts of California together with a chip
into, um, glass, then you can heat up this to the boiling point. It's about, uh,
three hundred twenty two or three hundred sixty degrees Celsius. So it's possible to
use simply a heat gun and make this very fast anyhow by using so, uh, such a heat
gun and, uh, heating up California. It also makes some ugly smells. So be
prepared that this is not in your living room because otherwise you won't access a
living room for the next days. Anyhow, after a short while, about five to 20
minutes depend on the, uh, package itself, how big this package is. Um, the epoxy is
completely dissolved and therefore the chip could be, uh, taken out of this and
can be cleaned again in acetone. So you see in the last picture on the top, oh,
it's a very good, uh, way to expect to complete a chip and to get, uh, good
access to the silicone. But anyhow, in this case, of course, the chip cannot be
operated any further. It's also the connections, the bonding wires and solid
frame, uh, has been dissolved in the California. And therefore, um, it's not
operational anymore. So you see there are also some shemekia ways for using even as
an amateur and so for using those kinds of Shamika, there's also the question of what
kind of chemicals can be used in here. Peter: Marcus already showed you some
examples were in the process. You need some chemicals, and so typically a problem
with chemicals is that they are quite hard to obtain, especially for private persons.
And they are typically, if they are pure, quite expensive, especially if you buy
them in small quantities. And therefore, we have set up a small list which contains
chemicals which are available readily from household products, or we would say from
the supermarket. And these chemicals here are listed. And alphanumeric order also
was a German name because they are quite different from the English name. And what
mainly is available in supermarkets or household products are quite pure
chemicals. And these are solvents. And remember, we need solvents for opening
packages, especially if we want to dissolve one kind of plastic, but not the
other. For example, opening an RFID label are you don't want to destroy the antenna
itself, which is put on a plastic, but you want to open the package where the antenna
is put inside the laminate. And so therefore, we have put together several
chemicals from acetone, for example, over benzene, ethanol, but also ethylene glycol
and PACULA ethylene, which are solvents for different kinds of plastics, which you
can see in the US case, raw. That's a very special solvent, which is the second last
one for tetra, hydro for rain. And because this dissolves also Pevensie polyvinyl
chloride, which is normally robust and could not be dissolved. But with this
special solvent, you can also dissolve privacy. Then, of course, you need the
mineralized water or distilled water. It's sometimes called the jar because we don't
want to leave residues on the on the chips, especially if cleaning them, for
example, in the ultrasonic bath. And there's also some chemicals like the
sodium bicarbonate and sodium hydroxide, which is needed to neutralize acids. But
it also can be used, for example, to dissolve aluminum. And aluminum is also
used, for example, for Antenna's on Earth text. So you can dissolve it away and just
the chip is left open. Um, that's one chemical which is not available in the
supermarket. I think that's also a good idea. That's not there. And that's a
fuming nitric acid. And assuming nitric acid is often used in professional
versions of packaged opening, that's we will see later on for destroying epoxy
material. So directly oxidizers the material and it's less an acid, then more
and Occident, at least if it's water free. So if the water was just mixed with acid,
then it gets more acid characteristics and then it will destroy metals and also the
chip itself, therefore. And if one uses it, it should be water free. Um, of course
if it destroys epoxy materials and it can also destroy skin, closer's your
furniture, everything, all your devices are rusting away and so on. So that's
really a nasty and therefore appropriate safety equipment must be used so it can be
bought. It's about 100 to 200 euro are quite expensive and also quite difficult
to obtain because it's also used for some other more dangerous purposes. But there's
also also a way of maybe doing it by yourself. So. Thanks, so, of course, we
were looking for recipes on the Internet which are there, but that's much cooler.
That's the book here, which I got from my 15th birthday. I think it's a science book
for kids from quote unquote, Wesolowski and also contains a recipe for making
fuming nitric acid. Also also with some 600000 fuming nitric acid works on wood,
for example, when it gets burning and so on. So that's that's the recipe. And then
you, of course, need the equipment. So the reaction is that concentrated sulfuric
acid, which can be bought, for example, and pharmacist reacts, was potassium
nitrate, also typical of Pharmacy Chemica. And then the fuming nitric acid, which is
generated, is distilled from this mixture. You can see this in the picture as well.
That's the normal distillation apparatus. The one which is used here is much
simpler. And on the right, that's a micro distillation, distillation, glassware,
which can be used, for example, if you only need some milliliters of this acid.
So typically for opening one package, I would suggest, for example, five to 10
million liters of acid. So it does not make sense to have more than than that.
I'm talking about professional chemicals that are some more of these. So you you're
already recognized as the hazard of pictograms which are here on the right
side. So these are chemicals which are not harmless. And so therefore also they are
typically only available in a professional or from professional sources, just some
chemicals or some chemicals which are good solvents for epoxy material. So this means
in this case, the epoxy is not oxidized, but it's dissolved. Or I should rather say
that it's it's swollen. So the molecules of the solvent go into the epoxy and then
it swells and you can brush it away. It's not material. The solvent process in this
case, um, besides these epoxy dissolving chemicals, there are also some specialties
for some of the first one. Colene, this is used in industry for cheap cleaning, but
also for wafer cleaning. And then finally, the three ones on the bottom. These are
the assets which are used for destructive opening nitric acid. You are not already
now. And then we have two other ones, sulfuric acid, which must be used in a hot
variant, and also the so-called Olian, which is a more aggressive version of the
sulfuric acid, which can be used also at room temperature. So looking at
professional methods which are available, for example, for semiconductor
manufacturers, if they want to do a failure analysis, for example, then also
we have brought you some examples. And this one here uses also fuming nitric
acid. It's a chemical capsule later. It's a typical tool for industry if packages
are to be opened, for example, for failure analyzers or other means. And so in this
case here, the acid is not dropped onto the surface of the package, but it's first
heated and then it's pumped through a small nozzle, which is made of Teflon of
glass. And then a jet of hot acid is pushed on the surface of the package
itself. So this means all the reaction products are readily flushed away and are
purged and the chip only comes in connection with pure nitric acid. So this
means it can also not be damaged by reaction products, which is very good. So
typically such devices give very good results, but that's a disadvantage. Of
course, on the one hand side, it's professional equipment that's quite
expensive, on the other hand, and you need much higher volumes of the FUMIE nitric
acid. Typically, if you do it manually, you would need five milliliters or 10 and
here you need much more, maybe 50 milliliters or even more. This one is a
sincere milling machine, which we would also be using, for example, and
professional environment, and I think they are a lock picking people here. I would
like to have something like this, too. That's really nice machine, which can make
he programed milling. It has done not just preprogrammed inside, but it can also
launch new packages. And the interesting thing is that you can also use diamond
drills and thereby open ceramic packages. Also, for example, from the back side, if
you want to get access to the chip side for a special purpose. Nevertheless, this
equipment is very expensive, also an operation. So this diamond dress cost very
have a high cost and last but not least, very heavy. So it cannot be used in all
laboratories. This one here is a laser, the capsule later laser the capsule that
is mainly laser scanner. And I think you saw some of these on the assembly already
for cutting what are Styrofoam and so on. And that's nearly the same. But it works
more on a on the microscopic level or millimeter level. And so then hit by a
complete plastic package, for example, can be scanned with a focused laser and laser
just evaporates the material. That's an inch on a few more so that the reaction
products are purged. And so therefore, that's really a nice way of opening
packages. Again, like for the machine that are preprogrammed packages, but it can
also learn to use new packages. Nevertheless, there are also disadvantages
of such methods. Again here, like Mockus already set for the laser, you have a
thermal stress to the chip, which sometimes can lead to breaking the chip,
which you don't want. And also, again, the costs are quite high milling. And also
this laser encapsulation are typically not used to completely open a package. It is
more used for generating a recess, which is then further treated by chemical
etching. So this means you would only make a recess and the plastic package, which is
nicely fitting the capsule as a chemical to capture that. And then afterwards, this
fuming nitric acid, you would do the final opening of the package either manually or
with an automatic version. So if the trip is properly prepared and here, for
example, on the right, you can see a trip which has opened with a professional, um,
a device, then you can have full access first with a microscope. Of course, you
can see if there's a chip in the package. You can have a look if there are some dye
markings which can lead you to a more material literature, data sheets and so
on. Um, have a look inside what the function may be and what this is used for
and the device which you are currently investigating. But, uh, sometimes after
you have done that and the real fun starts, which means preparation of an
attack or finding attack vectors and then finally also at doing such attacks. So
attacks could be further reverse engineering, for example, making a
complete preparation of the chip, grinding away the different layers of it for, uh,
doing a complete reverse engineering. And then if the package is opened, you can do
some attacks, which you normally won't do or can't do with packages, um, with chips
and side, which are, for example, laser attacks that you focus on the focus laser
on the chip to make some false or to induce some wrong calculations inside.
There are many other devices which have ultraviolet fuzes which can be erased, for
example, against code protection. One can do permanent manipulations, for example,
by focus on beam or laser cutter, if that's what all the chips, um, one can do.
Alpha radiation attacks because alpha radiation also would not penetrate a
package, but, uh, they will penetrate the silicon and then make faults, for example,
electromagnetic attacks by applying a probe on the top of the chip or on the
backside. And, um, the one which I have left out a photon emission. Such an
analysis. That's quite interesting. Um, that's a way of looking at the chip, how
it generates infrared photons, while calculating, for example, if a transistor
switches and photons are emitted. And that's that's a method which we are
professionally using since 2001. But recently I read in the press that also
some other people looking for this method, uh, for example, the German one does not
wants to get such a device to, um, which sounds quite, um. Yeah. Quite reasonable
to me because there are some smart catch chips today available which are not
prepared against such kind of a text. And also this may be a way of using this
photon emission, such an analysis for, um, exploiting a backdoor which could be
induced by physically unclogging other functions. If you are interested. We made
talk last year and we have also a small chapter about it. But this would lead to
far in this environment here. So, um, if you are interested in the topic itself
and, uh, want to have an overview, then we would recommend this book that's, um,
available in German. But also there's an English version of it which we have put
under the literature here. It's from a Siemens failure analysis guy and the
contents of the package opening, but also a chip preparation techniques. And there's
a nice presentation about using fuming nitric acid for the capitulations from on
semiconductor in 2008. Um, if you use, um, colorfully or Rosana sometimes called, um,
then there are two interesting projects. One is from the cost of Belene. Um, it's
along with California, unfortunately is only in Germany, in German. And then
there's also a project from the LEP which is called As a Californian User, which is
an automated way of opening packages, was kind of funny. And then finally, there's
also an interesting thing about laser chip access, how to open chips with laser and
3D techniques. So these are only a few points. Um, this book we have also an
assembly. So if you want to have a look inside, then be invited to visit us today.
Finally, if you have a look inside chips and sometimes, uh, interesting things open
up not only technology, not only attack vectors, but sometimes you also see some
artwork. Sometimes today there's not much place left because that's also cost, and
so therefore this year art is getting less and less. But these are some examples
which we found sailboard and here in the upper right corner, that citya arms of
Hamburg, which belongs to Chip from Philips. All right. So that's not
complete. Our small presentation about Chip opening. And now we have some some
minutes for questions, of course.
Herald: Wow, amazing. I see my shopping list grow. So are there any questions, I
would say from from the Web? Are you OK? Signal Angel: Indeed. OK, that's one
question from the Internet, and it's concerning the left overs of the
chemicals. Um, do you have any hints about how to get rid of them after you practice
in your private environment? Peter: All right. So first of all, I would
recommend not to buy any chemicals that you don't need, because that's all
environmental pollution which is generated just in the moment they are produced. And
so, therefore, buy only the chemicals you need, um, buy only the amounts of
chemicals that you need, I would recommend. And then afterwards, there are
also ways of neutralizing these agents, for example, fuming nitric acid can be
neutralized with baking soda, which also we have on our list here. And so
therefore, I would have a look inside Internet sources, for example, to see what
are the special ways of neutralizing each agent. So for a private person, it's, I
would say nearly the same. Like for industry or certainly industry, this
chemical are neutralized and then given away to the appropriate institutions.
Sometimes you can just flush it away after neutralizing it, but sometimes as a
result, you may be toxic and then you have to give it to a special institution.
Herald: Question answered. Guess, um, any more questions from from the web. OK, um,
I would say we do some load balancing. You start first please.
Mic: Oh. Is there a way to actually verify where our chips are identical. So if you
have two chips or whatever, they are the same or generated using the same mask set?
Or any mechanical way to actually verify that?
Peter: If these chips are identical. OK. So if there would be a way, for example,
to make an X-ray, this would be, of course, fine, because then you don't need
any preparation at all. So some years ago, I would have recommended to ask your
dentist, for example, because he has an X-ray. But normally X-rays are today not
used for other purposes purposes. They are intended to. So therefore, X-ray would be,
of course, the best one to have a look inside the chip. Um, if these are
smartcards, then sometimes infrared can serve well, because also with infrared,
you can look through the smartcard itself sometimes and then see the surrounding.
And also chips have typically characteristic bond wires. So this means
that the alignment of bond wires. So where are the pads, for example, differ also
from chip to chip. And finally, of course, the marking, because typically a marking
is only valid for for one specific chip and another chip, which would be in next
generation, for example, would also have a different chip marking then.
Marcus: But anyhow, of course, so you can distinguish whether this is the same
hardware or not very often today. Also, the chips are equipped with some flash.
And later, if you open up one chip, you can identify whether there's a nonvolatile
memory on the chip. And of course, you cannot distinguish by the microscope
whether the same flash content is in there or not. So it might be that in different
operating system or different programmers running on such a microcontroller
containing some flash, even if this is the same hardware. But at least, you know, OK,
this is the same hardware. And you're also learning, as you have done on a first
chip, you can also use on the same ship. Herald: Question answered? All right,
let's go. Mic: So have you ever opened up a package
just to find you've been hit by a counterfeit part?
Peter: Personally, not so. I know that are many counterfeits, especially from from
Asia Pacific Range. And sometimes it's quite interesting. I've seen such devices.
I did not open them by myself, but sometimes that's a totally different chip.
And. So it does not even match the type of functionality which what you would expect,
for example, instead of microcontrollers as a 74 something logic chip inside, which
would not work at all. Marcus: But again, here also, if you open
up the chip package, you can see the dye marking and have no clue about the chip
itself and also about the functionality, because the logical chip, uh, 74 series,
it's much less complexity and so quite clearly visible in the microscope compared
to a microcontroller or something. So it's quite easy to identify whether the
printing on the package is correct or whether this is just a fake chip.
Mic: Well, that's not clear. But you know what? After all.
Herald: Question answered? I guess. Yes, please go. Go on.
Mic: So you said you can generally look at chips using just optical microscopes, what
kind of magnification we can need for different types of chips?
Peter: OK, so typically for a stereo microscope, for preparation, you would
need only some five, four or twenty four to magnification, but usually for looking
optically at chips, you would need a 100 fold to I would say five hundred fold
magnification. That's of course there's a limit because of the technology gets
smaller than the wavelengths of light and then you've got a problem. And so
therefore we also have recommended here for amateurs or for beginners in this
topic to use all the chips, because you have, for example, one point two
micrometer technology, which is far away from from the wavelengths of the light.
But a few today would have, for example, 90 nanometer or 65 nanometers of the CPUs,
even 22 nanometers. So that's 20, 20 times smaller than the wavelengths of light. And
then you don't see anything at all and just colors.
Herald: Question answered? Marcus: And please be invited to our
assembly later on because we have got a microscope and some sample chips with us
so you can make some own experience in there and watch the silicon and see what
kind of such you can see so please be invited.
Herald: I'm totally sorry. I totally overlooked Microphone four. Please, please
go ahead. Mic: So if you have just a limited amount
of chips and want to maybe reuse them again like we want them. Um..
Herald: Could you please repeat the question with a microphone, because then
it's recorded. Mic: Yeah, so if you have, like, only a
couple of chips and want to reuse them again and dissolve epoxy, like what or
what method would you recommend to use? Peter: All right. So if you want to use
them, um, after preparing, then it's very important that there are no acid residues
left because we sometimes see, for example, if you prepare a chip with fuming
nitric acid and there's just a small amount of acid which is left, then after
one week or two week, the chips deteriorate. And so this means that they
have to be and the acid has to be neutralized very good. Rinsed with acetone
and then afterwards dry it carefully. So I would recommend to to store them also
maybe, um, under dry conditions, but if you are interesting. And afterwards you
could also contact us because we have some methods also for conserving chips.
Herald: Question answered right from the Internet, please.
Signal Angel: Yeah, there's another one. Um, it's about have you noticed any
manufacturers implementing countermeasures, new guards to decaping
the chips? Marcus: So yes, indeed, there are some,
uh, countermeasures at advertised by, uh, manufacturers who say, yes, we have a kind
of secure package. Uh, one of those secure packages also shown in the presentation
where, for example, uh, special coverage on top has been placed. Uh, but anyhow,
also there we have, uh, displayed some, uh, methods in order to open up those
kinds of packages. So, uh, it's always a trade off how much, uh, security you can
expect from the chip package. And so, in my opinion, I think the package there are
so many, uh, methods to remove a package. It could not be a completely secure
package just by the package itself. So if you need to have some secrets inside a
chip, then really the chip hardware should be secured and therefore protected against
spying out of those data. And this will be more on logical ways, for example, using
encryption instead of using some, uh, material in the package.
Peter: So there should be no trade off between buying, uh, insecure or less
secure chip and then adding a package. We think that the chip itself has to be
secure or secure enough, I should say, and it cannot be afterwards put the security
cannot be put afterwards around the chip. So that's not the way of, uh, of clean,
uh, engineering. Herald: Right. Um, we have time for a last
question. If you could please keep short and you guys also please go ahead.
Mic: I have a question about, uh, legal problems. When you publish photos of the
internal parts, and maybe sharing in a public database to to make education
better or I don't know. Peter: Um, that's if you make photos of
chips themselves which you have prepared by yourselves, then I think it should not
be critical. So we have also here are some pictures which we made sometimes of our
own chips, sometimes of other chips. But this does not contain any trade secrets,
for example. But of course, that's a difficult question, especially if it goes,
for example, to pictures which contain material where you see, for example code,
a ROM picture if you would publish a picture of a ROM and then it could be that
this ROM contains code and then you would publish this code. So it's very difficult
to tell which is which is right and which is wrong. But, um, usually we don't think
that that just took pictures are critical. Marcus: And it really depends also on the
resolution. If you have a complete chip and a overal resolutions that you cannot
identify single lines and cannot use this as a schematic to include such a chip,
then it's something different compared to a high resolution picture where you can
draw a complete schematics in there, but we can also talk later on in the assembly
more on this topic. And also I see some further question, but I think we are
running out of time so we can do this later on.
Herald: Yeah, great. Thank you very much. Thank you for your questions.
*applause*
The guys with the open chips go to the assembly and ask them if you have any more
questions, please. OK, thank you.
Subtitles created by c3subtitles.de in the year 2021. Join, and help us!