http://www.youtube.com/watch?v=tnY7UVyaFiQ
shows Chris analysing a smart card. Clever stuff.
Chris Tarnovsky
Hired by satellite TV industry
Works independently in a San Diego lab
Remove metal smart card
Expose to acids
Remove white epoxy
Plastic breaks down after 10 minutes
Acetone in two beakers
Fuming nitric acid HNO3 applied to chip
Rinsed in one acetone beaker
Transferred to second "clean" beaker
Scrape off the surface
Ultrasound cleans off remaining residue
Checks chip is clean using microscope attached to a computer screen
Puts chip back in the credit card sized smartcard holder
Chip is made up of two layers with a third layer as a security layer on top
Need to burn a hole through the top layer to reach metal on the second layer
Hole is made using a mask (nail polish?)
Mask is left to dry
Micropositioner holds a sewing type needle to scratch a hole
Want to scratch a middle area where the databus is and a control line on the side
Leave the needle where it is and remove from under the microscrope
Drop of hydrofluoric acid (in "Rust Stain Remover" bottle) for 30 seconds
Hydrofluoric acid is resistant to nail polish and magic marker
Rinsed in water
Then check how deep the acid etched under a microscope
Repeat etching using 15 seconds (rate of etching increases with volume of acid and temperature)
Rince in acetone
Using UV light expose the lines of the chip (under microscope)
Sit on the data bus with the needle. Yellow line (on oscilloscope) is what the needle is touching. Blue line represents Chris resetting the card.
Build a log of what the chip does when it powers up
800 hexadecimal samples
Can send management message to the chip and see what is done to decrypt it
Can do anything at this point: read EEPROM, ROM
What Chris presented is a full break of the Infineon SLE66PE secure microcontroller, used in smart cards for applications such as pay TV. This is one of the best of the current generation of smart cards. All of them have a layer of metal mesh that allows the chip to detect probing attempts. This processor also has optical sensors below that mesh (defense in depth?) It has many other countermeasures to prevent invasive attacks.
Chris's work in this area is astounding. He's now using a FIB whereas before he was just using microscopes and chemicals. This allows him to burn holes or deposit metal in the low tens of nanometers range. Combined with his old skills, this makes for a formiddable platform for defeating chip security measures.
His work on this chip is not easy, nor is it easily replicated. However, once someone with the resources and skills performs this kind of attack, it can enable much cheaper attacks later. For example, using this method to dump the ROM and then finding a software flaw in it would allow for attacks using ordinary PCs, no more physical manipulation needed. Or, you can build a jig ("drill here") that lets it be replicated by less skilled people using microprobing needles and ordinary microscopes. This reduces the cost of subsequent attacks.
TPMs have a poor security model to begin with. The exposed wires on the LPC bus (4 x 16 mhz) can be used to MITM it. The entire design is not meant to resist even board-level attacks, let alone invasive chip work. Claiming his talk is about TPMs is like saying cryptanalysis of SHA-1 is about breaking Django authentication. Sure it does, but there are much more important affected applications.
I actually think this validates the SLE66PE design. The fact that it required this much work gives me much more confidence about using it. Hopefully Infineon uses the information from Chris's talk to improve the next generations.