Marcus: Thank you for the kind
introduction. Welcome to our talk about
engaging microchips. So the background in
here is twofold. On the one hand side, we
would like to encourage you also to make
some own experiments and to see what is
inside a semiconductor device that means
what is inside a microchip. And so the
goal is that you also have some knowledge
how to open up a microchip and how to get
direct access to the silicon. On the other
hand, also, very often there's a rumor
that chip is highly secured because the
silicon is inside of plastic coverage. And
if a plastic package is really high
security, we can also explain today,
because very often even this amateur
equipment, it's possible to open up chips
and to get direct access to the silicon.
We are not only focusing on microchips,
but we are also focusing on more complex
systems, how to open up the system to get
access to the silicon in our background.
We have started more than 25 years ago
with analyzing the first telephone cards.
And so starting off with some experiments
at the Commodore 64, as well as working
with the first telephone card, it was our
major interest to find out what is the
functionality of this telephone card and
also what is inside. And of course, for
identifying what's inside. It was also our
target to open up stores, plastic cards
and to get access to the silicon chip
inside the telephone card. Nowadays, we
are also very often open up chips in order
to make some analysis or in order to apply
some high tech methods, for example, for
putting some over particular variation on
the top of the surface, also to apply some
laser. It's, of course, necessary to have
direct access to the silicon itself. And
therefore, also today we are utilizing a
lot of professional equipment in order to
observe chips. So today we would like to
give a short overview about the different
techniques and methods, how to open up
different kinds of chips, and also to
encourage you, because it is very
interesting also to open microchip
packages in order to get further analysis.
First of all, sometimes it's not quite
clear whether this is really a package
which contains a chip or whether there's
only a kind of label, as you can see, in
the lower picture. So in the lower
picture, it might be only a barcode labor,
but perhaps also an RFID chip might be in
there. And therefore, a first analysis.
It's the question, a inside the package.
And then, of course, also there's the
question, what is it about the chip
functionality itself? That means how many
functions are implemented in such a chip?
This is only a memory. Ship ourselves for
some logic inside there. And what kind of
logic is implemented here? And by the way,
on the most of the chips are also so-
called time markings. That means some
small numbers and these identified as the
silicon itself and these same markings as
possible to make some research and some,
um, findings from literature, as well as
also from tools in order to get more
information about the chip itself. And
finally, watching on the silicon itself
indicates also, if this is a more modern
chip, that means smaller technology or
whether this is an old fashioned chip. And
so you cannot expect so much functionality
or security funds the chip itself. So from
this perspective, these are some
motivation which also may encourage you to
open up some microchip packages and to
find out what's really inside there. We
have fought also three examples, um, to
show what is a potential finding out of
this. For example, it's well known that
some goods are tracked down with RFID
chips. And so recently we also got a t
shirt with a dedicated label inside here.
And it was not clear whether this label is
just about label or whether there are some
more, um, techniques inside the specialty
and RFID chip. So as you can see in the
second picture, it's quite easy to
identify if this is more than a barcode
label, because simply with a torch limb,
it's possible to eliminate those from the
back side. And so the flash indicates a.
There's something more than a bar code
inside there and indeed is some structure
inside. We have put this into a glass of
acetone and after a short while is the
label has to eliminate it. And so we can
got we got the final picture with the
antenna inside here. And in the middle of
the antenna is a small, dark spot. And
this is a chip. So it was clearly from the
antenna size, such as communicating in UHF
frequency range and also the small dot.
It's an hour edition. So now it's prepared
for further analysis with a microscope. So
you see, it might be very simple to get
some more information out here. Another
example brings us back where we back to
the history. And as I mentioned before, we
have started this investigation on
telephone cards. And, of course, not only
the telephone calls, but also the
telephone card system has been of high
interest for us. And so we were in lucky
situations that we found some, uh, printed
circuit boards from Cox Telephone where we
only got access to those because those car
telephones has been burned down
completely. So it was a huge fire. And so
inside is this area and so is the, um, uh,
telephone also get burned? Anyhow, we
managed to get those printed circuit
board. And in the second picture, you can
also see that the X-ray picture of the
printed circuit board, uh, clearly shows
that all the borrowings are still OK. So
it was possible for us to draw a dramatic,
uh, schematic and, uh, to see how the
different pins of this, uh, printed
circuit boards are connected. Well,
anyhow, it was not clear what are the
different shapes, because due to the heat,
simply the marking on the chip itself has
been vanished. So from this perspective,
we have used some, uh, capitulation method
in order to get the singer chips, the
silicone chips out of those devices. And
as you can see in the lower picture, then,
uh, with some, uh, microscopy work, we
were able to find out what is each single
chip. And so, uh, identifying the
different names of those chips and also
combining this was a schematic. It was
possible for us to, uh, resolve the main
function in those days from the cartoon
itself. And this gives us a clear clue in
what direction the telephone has worked in
those days. Yeah. And finally, also, there
was something in the beginning of 2000
there was a price competition. And is this
price competition, um, mean such as the
small sticker, which has to be applied to
the, uh, TV set. And then in this
perspective, uh, it was also that a lot of
rumors, whether this kind of spacechip
inside Syria and you see on the lower side
says, uh, some, um, comment from the
Internet at those days that there should
be an electronic chip inside Syria. And
this electronics should not only record
what you are watching on TV, but also, um,
make some sound recording in order to find
out how many people are in the room
watching this show and so on and so on.
But anyhow, um, we clearly thought, well,
this is just a rumor. And so, of course,
we use our, uh, techniques in order to
open up this device and also to find out,
uh, what's inside there. And in the end of
the day, it was clearly that this was only
a dot mask and below officers, there were
some foom which is photosensitive. And
when you watch, uh, special TV shows and
this film has been illuminated and
therefore it was clearly identifiable
whether this show has been seen or not. So
it was clear for us that we could identify
there's no spacechip inside and this was
only a rumor. So also, therefore, the
preparation techniques are quite useful
and helps to understand what's going in
inside Syria.
Peter: All right. Some some somewhat to
the chips and the packages. So there are
many thousands of different packages for
troops today. And sometimes the
functionality of the chip that just inside
will directly determine the way, such as
packaged. And this is the case for these
troops here especially. And if you look on
the left, that's an interesting thing. A
fingerprint sensor, which is another from.
Even use today with his fingerprints, and
this is a specialty that the chip itself
can be directly touched with the finger.
Normally you would avoid such a situation,
but here you have the direct silicone
accessible and there's only a frame which
is covering the surrounding of the chip to
make it mountable and the device itself.
Then we have a webcam webcam shown here,
which is just covered by a thin plate of
glass. Of course, the picture or the
optical radiation has to reach the chip
and therefore the same is true for your
microscope. You can directly observe such
chips without further preparation. Um,
yeah, I think the older one of you know,
this is prom type of memory, old fashioned
thing, but sometimes it's still seen
today. You can electrically write such an
issue from memory, but if you want to
erase it, you have to put it under
ultraviolet light to make the erasing
function. And so this means also this
package has a window in this case that's
made of silica because this uses to be UV
transparent. And again, you can have a
look inside without any preparation, which
sometimes quite interesting. And then on
the right, we have an amplifier chip shown
here and which is an instrumentation
amplifier, and therefore it should be
sealed from the environment, but also from
electromagnetic radiation. And this is
done here in this case by a ceramic
package. And this package has a metal that
over it. And again, here, it's very easy
to open this package. We will see later on
and was just using a blade. So all of
these four packages are quite interesting
for an amateur. You don't need any
equipment at all to have a look inside.
But as we said, from open to amateur hour,
some more difficult shops to open. And
here on the left side, that's a typical
chip which you will encounter and millions
today and all consumer goods. It's a
plastic package here. We have an order,
one which is a plastic package. But you
also know the surface mounted devices and
so on. So this plastic packages are quite
robust against environment, but also they
are robust against chemicals. And this
means you need quite harsh conditions to
open them and the chemical weigh. Are you
when it laser, which we will see later on,
epoxy resin. And the same is true for the
laptop package, which is a very low cost
kind of package, just as it is put on the
circuit board, then it's connected point
wires to the circuit board itself and then
afterwards just a drop of epoxy resin as
part of it. And you see, it's not a
rectangular form which should have. It's
more just a drop which put on top of
clocktower package is also seen here. And
the third picture, which is the smartcard
package, the typical one, if you would
turn this picture around, then you would
see on the other side that there are the
typical Golden Smartcard contacts. And
from the back side, it's a picture like
this. You have the chip and the chip is
connected, was bond wires to the
connection points and then afterwards to
hold it in place and also to make it
resistant from the environmental
conditions. It's also protected with a
blocked off package. So it just epoxy
resin is poured over it. And then finally
on the right is something which some
people call a security package. You see
that matterson hyphenation. Not only is it
dark so that you can see directly through
the through to the chip, but there's also
there can be some special Latisse, for
example, in this case, there's an
additional layer which is put on the chip,
which is also made of silicon itself. But
yeah, as we showed here, it's not I would
say it's not really security. And many
cases of this package, just because of the
security, does not start in the chip
itself. And I would say then it's a little
bit too late. All right. So what can you
see if you look inside such chips and we
have chosen some examples where you don't
need any preparation at all. Here you can
see some memories for beginning. It's
quite interesting to have a look at all
the chips which are sometimes available to
store. And that's because simple fact. And
the older days, the technologies were not
so small as today. So this means you can
see the structures. What's your barai or
maybe you need your grandfather's
magnifying glass, maybe, but you don't
need a high definition microscope. And so
here on the far left, that's a chip from
nineteen seventy six, very old one very
small memory. And you can directly see
with your eye all the structures inside
just through the window without opening it
at all. And then if we proceed in time
also to a vintage chip from nineteen
eighty eight, one megabit it from there.
See already it's more like a gray mass,
that's a memory cells and you definitely
would need a microscope to have a further
look inside how such a memory is built and
to analyze it. And then on the right.
That's also an interesting example of a
memory. But this memory has some access,
right. Tied to it, because that's the
telephone chip card. And here you have a
very small memory of only 88 bits. But the
rest is controlled logic so that only the
people who are or should be allowed to
load it and to erase it have this access
rights given to them. And if we look at
the little microcontroller units and they
are quite more interesting than just a
memory. And here again, we have four
different chips brought to you. Two of
those also have windows. You don't need
any preparation at all. And the one on the
left is, again, a chip from nineteen
seventy six, very old. One can see
directly all the different structures like
Rom Ram that you prompt part and also the
logic part which contains the CPU and also
some analog devices which are needed for
the functionality of the chip. I think
that pick 16, the second picture, you
know, and the flash version, which is very
common today, you just can program it and
erase it again and a normal device. But in
1988, these types of the control that were
made was EPROM. So this means you could
program it. And then if you want to erase
it again for reprograming, you have to put
it under ultraviolet lamp for five
minutes. So therefore, there are some
older versions of the controller. But what
you can see is that the technology is
smaller and that the chip is just a very
high density and comparison to the chip,
which is 12 years older. Interestingly,
the smart all the smart card controls look
quite the same, like these older devices.
And they also have from RAM you prom are
normally prom. So electrical eraser, a
programable rom. And so therefore the
smart card units, even those of in the 90s
look like the same, like the older and
serious. And finally, just for comparison,
we also brought a sixty eight case. If you
this has only cash but no nonvolatile
memory and was used in some old home
computers for example, but also in
instrumentation technology. So what do you
need if you want to start with preparing
microchips. Just to have a look, if it's
interesting for you to have a glimpse
inside. So what you definitely need is a
simple microscope. And we showed there a
student version that's about 300 euros.
But they are also quite interesting USB
microscopes today and which come ready for
use for about 150 euros. So that's quite
good tools. You need definitely some
mechanical tools like scalpels, tweezers,
which we have here sometimes some sort of
dentist tools, which also would serve
quite well, an ultrasonic cleaner. It's a
very good thing to have because this is
really nice for package preparation,
cleaning, but also removing particles and
also of the chip is prepared and ready.
Then you can remove all remaining residues
and particles from it. And finally, there
are three solvents which you need for
beginners, which is alcohol, ethanol and
acetone and also benzene. These are three
solvents from non polla to polla type. And
with these three solvents, you can open a
lot of different packages. Then for
upgrading such equipment, it's quite
interesting to have a 3-D view. So was a
stereo microscope. You can make
preparation with both your eyes. You have
a 3-D vision and you can directly see what
you are doing, which is sometimes quite
difficult. If you have on your monocular
side, then if you want to share your
results, a microscope camera could serve
your well, which is available for about
300 euros. But there are also some DIY
versions, for example, with no cameras
which are adapted to the microscope
itself. Some further chemicals can be
needed, which I will also show you later
on the table, which are not without
danger, I would say, and therefore also
typically a lab coat and some protective
wear would be used. So now we are in a
moment we will come to a different details
of how to open a package and and the steps
itself. And this will be sorted from
physical opening statements, the methods
or mechanical methods over to chemical
methods for you directly open. So device
with chemical means. But there's also a
mixture of both. And therefore, I would
like to hand over to Marcus.
Marcus: Yes, thank you. Let's go to the
workbench and open some packages. So
beginning, as Peter mentioned, with the
physical ones. And the first one is quite
easy. You just need advice. And as you
puts a chip inside vis a with the lower
part of the I see as depicted in the first
picture and then you just put some more
forces to the I see. Pictures save and
during the time device will be smaller and
smaller, the package will break up and the
upper part lift up. So as visible in the
third picture, you can use a simple
screwdriver to remove the upper limit. And
then finally, in the last picture, it's
visible that the bare silicon chip is
visible for your further analysis, also
connected to the lead frame. So the frame
which connects to the outer pins and to
the outer communication. So this is a
quite simple method. And indeed, this is
the first method we have also used in the
example of the copper telephone I have
explained earlier. So it was quite easy to
break up those chips in order to get the
silicon parts out of the ICS and then
analyzing them with a microscope, even if
the package will be a little bit more
hardened. For example, a ceramic housing
like use in eponyms, then it's also a good
idea to have fixes and device and just to
replace a screwdriver on the top part of
the see, and there's a small bump on the
back of the screwdriver. The upper limit
will be removed. And as you can see in the
chart picture directly, the access to the
chip is possible. So indeed, I think these
pictures clearly identify that this must
be not high, sophisticated techniques or
some sensors, sometimes really a normal
workbenches sufficient to get access to
very easy. It's in the case if there's a
special package, as Peter has explained,
with such a metal lid on top of this,
because this method to it is sold out on
the academic housing. And typically you
can think about where grindings as a way
or try to sold out or something like. But
there's a very easy method to open up
those kinds of packages. You just use a
blade as visible in the second picture
and, um, use a hammer for a small store.
And then this blade drives and is this
metal dirt and you can simply lift off
this metal without any further, um,
effort. So it's just, uh, two seconds, uh,
work to open up those kinds of packages.
And even those blades are quite easy to
access because you can see in the lower
pictures that they are sold also in
discounters for, uh, cleaners of Deskovic.
So these blades are easy to use just with
the hammer. You can drive them below the
lid. And so this opens. So you see
physical mechanisms can be very easy. Now,
as also mentioned before, our first topic
has been to, uh, check what's inside a
telephone card. And, of course. Such a
physical preparation, it's more
complicated on a small plastic card, and
therefore it more goes into the direction
of physical chemical reaction on source
cards. And you can see here in this hall
of pictures, we have just played such a
smart card in it's. And after five
minutes, as was a in the second picture,
the plastic of the card absorbed some
acetone and therefore swails. After 15
minutes, you can just wait for those
minutes. Then the structure is fully
destroyed. And so it's quite easy to
remove the remaining plastic parts as
visible on the fourth picture in the
apple. So, again, just by waiting about 15
minutes in, etc. on the smart card is um.
Yeah, destroyed. And so, um, as visible in
the lower picture, all it's possible to
remove the antenna and censorchip itself.
And I think the result and the last
picture on the law, uh oh it's quite
impressive. It's a complete antenna,
including the chip has been resolved out
of this, uh, plastic card. And so, um, it
was quite easy to analyze the antenna and
the size and how this is implemented in
here. Anyhow, you may recognize that the
chip is still covered by, uh, uh, a
laptop. That means a small piece of, uh,
epoxy on top of this. And so it's a
question how to remove this here. It's
possible to use, for example, a laser
with, uh, um, infrared laser, especially
for about Servais flying of 10000
nanometers. Um, it's quite useful to open
up those kinds of pictures because the
silicon itself is transparent for such an
infrared radiation. So the chip itself
would be not directly affected by the
infrared radiation, but all the energy
will be absorbed by the package itself. So
it's just a trauma to, um, destruction of
the package as visible in the lower
picture. And especially also this is quite
useful to open up so-called secure
pictures, as Peter has explained. So even
those kinds of packages, uh, are just
applied with a laser and, um, it's opened
up so that all the, um, silicon can be
directly accessed. Anyhow, this, uh, may
also be some risk. It appears on the one
hand side, the risk that the chips to get
damage due to the fact that is, uh,
package components are heated up and
souless temperature could also be applied
to the silicon chip itself or make some,
uh, Tominaga medical attention and
therefore, chip may break down. On the
other hand, of course, infrared laser
radiation may also, um, make some, uh,
health, uh, difficulties. And therefore,
it's very important, um, to be careful
with those laser radiations. So question
is, OK, how to open up epoxy in other
ways, not, uh, having such a laser, and
therefore for us, again, a physical
preparation take place. So for applying
Shamika, it's it's very good to prepare
the chips with some, um, mechanical
preparation. And you see here again, the
chip and advise and then with a grinding
disk and some parallel movement as visible
in the, uh, third picture here. And this
whole small curve has been set up. And so
we have two advantages in here. The first
advantage is that already some material is
finished. And so therefore we have, uh,
faster access to the silicone and save. On
the other hand, also, we have some, uh,
area where some chemicals can be dropped
on and, uh, will take place here. So let's
go with the chip to the, uh, Shamika
treatment. And here again, in the first
two pictures, you'll see the preparation
by the mechanical grinding and censorchip
is, uh, put into a sandbaggers, which is
heated up. So at about 50 to 90 degrees
Celsius, send some nitric acid, uh, will
be dropped on there. And just after
overseer's epoxy will be removed and, uh,
you can get direct access to the silicone.
So after you have the desired result, that
means after all the epoxy has gone, you
can remove the rest of the. Set by using
some acetone, as was a boot in the lower
picture. Um, hole and also it's a good
idea to clean up, um, the chip into the
ultrasonic cleaner in order to remove the
remaining particles. If you don't want to
wait for a long time, then you can again
use some acetone in order to have some
carpet try drying. And finally, you have a
very good, uh, preparation where you have
access to the silicone, but also have, uh,
the connection. Uh, most of the cases do
OK for using the chip and operating the
chip in this environment. Anyhow, as this
is, it may also damage some parts of the
chips. And therefore, it's also the
question if you do not need to operate the
chip, but just for inspection, that's
another method to open up those kinds of
epoxy. And it's just using California or
in German, California. Um, so putting
parts of California together with a chip
into, um, glass, then you can heat up this
to the boiling point. It's about, uh,
three hundred twenty two or three hundred
sixty degrees Celsius. So it's possible to
use simply a heat gun and make this very
fast anyhow by using so, uh, such a heat
gun and, uh, heating up California. It
also makes some ugly smells. So be
prepared that this is not in your living
room because otherwise you won't access a
living room for the next days. Anyhow,
after a short while, about five to 20
minutes depend on the, uh, package itself,
how big this package is. Um, the epoxy is
completely dissolved and therefore the
chip could be, uh, taken out of this and
can be cleaned again in acetone. So you
see in the last picture on the top, oh,
it's a very good, uh, way to expect to
complete a chip and to get, uh, good
access to the silicone. But anyhow, in
this case, of course, the chip cannot be
operated any further. It's also the
connections, the bonding wires and solid
frame, uh, has been dissolved in the
California. And therefore, um, it's not
operational anymore. So you see there are
also some shemekia ways for using even as
an amateur and so for using those kinds of
Shamika, there's also the question of what
kind of chemicals can be used in here.
Peter: Marcus already showed you some
examples were in the process. You need
some chemicals, and so typically a problem
with chemicals is that they are quite hard
to obtain, especially for private persons.
And they are typically, if they are pure,
quite expensive, especially if you buy
them in small quantities. And therefore,
we have set up a small list which contains
chemicals which are available readily from
household products, or we would say from
the supermarket. And these chemicals here
are listed. And alphanumeric order also
was a German name because they are quite
different from the English name. And what
mainly is available in supermarkets or
household products are quite pure
chemicals. And these are solvents. And
remember, we need solvents for opening
packages, especially if we want to
dissolve one kind of plastic, but not the
other. For example, opening an RFID label
are you don't want to destroy the antenna
itself, which is put on a plastic, but you
want to open the package where the antenna
is put inside the laminate. And so
therefore, we have put together several
chemicals from acetone, for example, over
benzene, ethanol, but also ethylene glycol
and PACULA ethylene, which are solvents
for different kinds of plastics, which you
can see in the US case, raw. That's a very
special solvent, which is the second last
one for tetra, hydro for rain. And because
this dissolves also Pevensie polyvinyl
chloride, which is normally robust and
could not be dissolved. But with this
special solvent, you can also dissolve
privacy. Then, of course, you need the
mineralized water or distilled water. It's
sometimes called the jar because we don't
want to leave residues on the on the
chips, especially if cleaning them, for
example, in the ultrasonic bath. And
there's also some chemicals like the
sodium bicarbonate and sodium hydroxide,
which is needed to neutralize acids. But
it also can be used, for example, to
dissolve aluminum. And aluminum is also
used, for example, for Antenna's on Earth
text. So you can dissolve it away and just
the chip is left open. Um, that's one
chemical which is not available in the
supermarket. I think that's also a good
idea. That's not there. And that's a
fuming nitric acid. And assuming nitric
acid is often used in professional
versions of packaged opening, that's we
will see later on for destroying epoxy
material. So directly oxidizers the
material and it's less an acid, then more
and Occident, at least if it's water free.
So if the water was just mixed with acid,
then it gets more acid characteristics and
then it will destroy metals and also the
chip itself, therefore. And if one uses
it, it should be water free. Um, of course
if it destroys epoxy materials and it can
also destroy skin, closer's your
furniture, everything, all your devices
are rusting away and so on. So that's
really a nasty and therefore appropriate
safety equipment must be used so it can be
bought. It's about 100 to 200 euro are
quite expensive and also quite difficult
to obtain because it's also used for some
other more dangerous purposes. But there's
also also a way of maybe doing it by
yourself. So. Thanks, so, of course, we
were looking for recipes on the Internet
which are there, but that's much cooler.
That's the book here, which I got from my
15th birthday. I think it's a science book
for kids from quote unquote, Wesolowski
and also contains a recipe for making
fuming nitric acid. Also also with some
600000 fuming nitric acid works on wood,
for example, when it gets burning and so
on. So that's that's the recipe. And then
you, of course, need the equipment. So the
reaction is that concentrated sulfuric
acid, which can be bought, for example,
and pharmacist reacts, was potassium
nitrate, also typical of Pharmacy Chemica.
And then the fuming nitric acid, which is
generated, is distilled from this mixture.
You can see this in the picture as well.
That's the normal distillation apparatus.
The one which is used here is much
simpler. And on the right, that's a micro
distillation, distillation, glassware,
which can be used, for example, if you
only need some milliliters of this acid.
So typically for opening one package, I
would suggest, for example, five to 10
million liters of acid. So it does not
make sense to have more than than that.
I'm talking about professional chemicals
that are some more of these. So you you're
already recognized as the hazard of
pictograms which are here on the right
side. So these are chemicals which are not
harmless. And so therefore also they are
typically only available in a professional
or from professional sources, just some
chemicals or some chemicals which are good
solvents for epoxy material. So this means
in this case, the epoxy is not oxidized,
but it's dissolved. Or I should rather say
that it's it's swollen. So the molecules
of the solvent go into the epoxy and then
it swells and you can brush it away. It's
not material. The solvent process in this
case, um, besides these epoxy dissolving
chemicals, there are also some specialties
for some of the first one. Colene, this is
used in industry for cheap cleaning, but
also for wafer cleaning. And then finally,
the three ones on the bottom. These are
the assets which are used for destructive
opening nitric acid. You are not already
now. And then we have two other ones,
sulfuric acid, which must be used in a hot
variant, and also the so-called Olian,
which is a more aggressive version of the
sulfuric acid, which can be used also at
room temperature. So looking at
professional methods which are available,
for example, for semiconductor
manufacturers, if they want to do a
failure analysis, for example, then also
we have brought you some examples. And
this one here uses also fuming nitric
acid. It's a chemical capsule later. It's
a typical tool for industry if packages
are to be opened, for example, for failure
analyzers or other means. And so in this
case here, the acid is not dropped onto
the surface of the package, but it's first
heated and then it's pumped through a
small nozzle, which is made of Teflon of
glass. And then a jet of hot acid is
pushed on the surface of the package
itself. So this means all the reaction
products are readily flushed away and are
purged and the chip only comes in
connection with pure nitric acid. So this
means it can also not be damaged by
reaction products, which is very good. So
typically such devices give very good
results, but that's a disadvantage. Of
course, on the one hand side, it's
professional equipment that's quite
expensive, on the other hand, and you need
much higher volumes of the FUMIE nitric
acid. Typically, if you do it manually,
you would need five milliliters or 10 and
here you need much more, maybe 50
milliliters or even more. This one is a
sincere milling machine, which we would
also be using, for example, and
professional environment, and I think they
are a lock picking people here. I would
like to have something like this, too.
That's really nice machine, which can make
he programed milling. It has done not just
preprogrammed inside, but it can also
launch new packages. And the interesting
thing is that you can also use diamond
drills and thereby open ceramic packages.
Also, for example, from the back side, if
you want to get access to the chip side
for a special purpose. Nevertheless, this
equipment is very expensive, also an
operation. So this diamond dress cost very
have a high cost and last but not least,
very heavy. So it cannot be used in all
laboratories. This one here is a laser,
the capsule later laser the capsule that
is mainly laser scanner. And I think you
saw some of these on the assembly already
for cutting what are Styrofoam and so on.
And that's nearly the same. But it works
more on a on the microscopic level or
millimeter level. And so then hit by a
complete plastic package, for example, can
be scanned with a focused laser and laser
just evaporates the material. That's an
inch on a few more so that the reaction
products are purged. And so therefore,
that's really a nice way of opening
packages. Again, like for the machine that
are preprogrammed packages, but it can
also learn to use new packages.
Nevertheless, there are also disadvantages
of such methods. Again here, like Mockus
already set for the laser, you have a
thermal stress to the chip, which
sometimes can lead to breaking the chip,
which you don't want. And also, again, the
costs are quite high milling. And also
this laser encapsulation are typically not
used to completely open a package. It is
more used for generating a recess, which
is then further treated by chemical
etching. So this means you would only make
a recess and the plastic package, which is
nicely fitting the capsule as a chemical
to capture that. And then afterwards, this
fuming nitric acid, you would do the final
opening of the package either manually or
with an automatic version. So if the trip
is properly prepared and here, for
example, on the right, you can see a trip
which has opened with a professional, um,
a device, then you can have full access
first with a microscope. Of course, you
can see if there's a chip in the package.
You can have a look if there are some dye
markings which can lead you to a more
material literature, data sheets and so
on. Um, have a look inside what the
function may be and what this is used for
and the device which you are currently
investigating. But, uh, sometimes after
you have done that and the real fun
starts, which means preparation of an
attack or finding attack vectors and then
finally also at doing such attacks. So
attacks could be further reverse
engineering, for example, making a
complete preparation of the chip, grinding
away the different layers of it for, uh,
doing a complete reverse engineering. And
then if the package is opened, you can do
some attacks, which you normally won't do
or can't do with packages, um, with chips
and side, which are, for example, laser
attacks that you focus on the focus laser
on the chip to make some false or to
induce some wrong calculations inside.
There are many other devices which have
ultraviolet fuzes which can be erased, for
example, against code protection. One can
do permanent manipulations, for example,
by focus on beam or laser cutter, if
that's what all the chips, um, one can do.
Alpha radiation attacks because alpha
radiation also would not penetrate a
package, but, uh, they will penetrate the
silicon and then make faults, for example,
electromagnetic attacks by applying a
probe on the top of the chip or on the
backside. And, um, the one which I have
left out a photon emission. Such an
analysis. That's quite interesting. Um,
that's a way of looking at the chip, how
it generates infrared photons, while
calculating, for example, if a transistor
switches and photons are emitted. And
that's that's a method which we are
professionally using since 2001. But
recently I read in the press that also
some other people looking for this method,
uh, for example, the German one does not
wants to get such a device to, um, which
sounds quite, um. Yeah. Quite reasonable
to me because there are some smart catch
chips today available which are not
prepared against such kind of a text. And
also this may be a way of using this
photon emission, such an analysis for, um,
exploiting a backdoor which could be
induced by physically unclogging other
functions. If you are interested. We made
talk last year and we have also a small
chapter about it. But this would lead to
far in this environment here. So, um, if
you are interested in the topic itself
and, uh, want to have an overview, then we
would recommend this book that's, um,
available in German. But also there's an
English version of it which we have put
under the literature here. It's from a
Siemens failure analysis guy and the
contents of the package opening, but also
a chip preparation techniques. And there's
a nice presentation about using fuming
nitric acid for the capitulations from on
semiconductor in 2008. Um, if you use, um,
colorfully or Rosana sometimes called, um,
then there are two interesting projects.
One is from the cost of Belene. Um, it's
along with California, unfortunately is
only in Germany, in German. And then
there's also a project from the LEP which
is called As a Californian User, which is
an automated way of opening packages, was
kind of funny. And then finally, there's
also an interesting thing about laser chip
access, how to open chips with laser and
3D techniques. So these are only a few
points. Um, this book we have also an
assembly. So if you want to have a look
inside, then be invited to visit us today.
Finally, if you have a look inside chips
and sometimes, uh, interesting things open
up not only technology, not only attack
vectors, but sometimes you also see some
artwork. Sometimes today there's not much
place left because that's also cost, and
so therefore this year art is getting less
and less. But these are some examples
which we found sailboard and here in the
upper right corner, that citya arms of
Hamburg, which belongs to Chip from
Philips. All right. So that's not
complete. Our small presentation about
Chip opening. And now we have some some
minutes for questions, of course.
Herald: Wow, amazing. I see my shopping
list grow. So are there any questions, I
would say from from the Web? Are you OK?
Signal Angel: Indeed. OK, that's one
question from the Internet, and it's
concerning the left overs of the
chemicals. Um, do you have any hints about
how to get rid of them after you practice
in your private environment?
Peter: All right. So first of all, I would
recommend not to buy any chemicals that
you don't need, because that's all
environmental pollution which is generated
just in the moment they are produced. And
so, therefore, buy only the chemicals you
need, um, buy only the amounts of
chemicals that you need, I would
recommend. And then afterwards, there are
also ways of neutralizing these agents,
for example, fuming nitric acid can be
neutralized with baking soda, which also
we have on our list here. And so
therefore, I would have a look inside
Internet sources, for example, to see what
are the special ways of neutralizing each
agent. So for a private person, it's, I
would say nearly the same. Like for
industry or certainly industry, this
chemical are neutralized and then given
away to the appropriate institutions.
Sometimes you can just flush it away after
neutralizing it, but sometimes as a
result, you may be toxic and then you have
to give it to a special institution.
Herald: Question answered. Guess, um, any
more questions from from the web. OK, um,
I would say we do some load balancing. You
start first please.
Mic: Oh. Is there a way to actually verify
where our chips are identical. So if you
have two chips or whatever, they are the
same or generated using the same mask set?
Or any mechanical way to actually verify
that?
Peter: If these chips are identical. OK.
So if there would be a way, for example,
to make an X-ray, this would be, of
course, fine, because then you don't need
any preparation at all. So some years ago,
I would have recommended to ask your
dentist, for example, because he has an
X-ray. But normally X-rays are today not
used for other purposes purposes. They are
intended to. So therefore, X-ray would be,
of course, the best one to have a look
inside the chip. Um, if these are
smartcards, then sometimes infrared can
serve well, because also with infrared,
you can look through the smartcard itself
sometimes and then see the surrounding.
And also chips have typically
characteristic bond wires. So this means
that the alignment of bond wires. So where
are the pads, for example, differ also
from chip to chip. And finally, of course,
the marking, because typically a marking
is only valid for for one specific chip
and another chip, which would be in next
generation, for example, would also have a
different chip marking then.
Marcus: But anyhow, of course, so you can
distinguish whether this is the same
hardware or not very often today. Also,
the chips are equipped with some flash.
And later, if you open up one chip, you
can identify whether there's a nonvolatile
memory on the chip. And of course, you
cannot distinguish by the microscope
whether the same flash content is in there
or not. So it might be that in different
operating system or different programmers
running on such a microcontroller
containing some flash, even if this is the
same hardware. But at least, you know, OK,
this is the same hardware. And you're also
learning, as you have done on a first
chip, you can also use on the same ship.
Herald: Question answered? All right,
let's go.
Mic: So have you ever opened up a package
just to find you've been hit by a
counterfeit part?
Peter: Personally, not so. I know that are
many counterfeits, especially from from
Asia Pacific Range. And sometimes it's
quite interesting. I've seen such devices.
I did not open them by myself, but
sometimes that's a totally different chip.
And. So it does not even match the type of
functionality which what you would expect,
for example, instead of microcontrollers
as a 74 something logic chip inside, which
would not work at all.
Marcus: But again, here also, if you open
up the chip package, you can see the dye
marking and have no clue about the chip
itself and also about the functionality,
because the logical chip, uh, 74 series,
it's much less complexity and so quite
clearly visible in the microscope compared
to a microcontroller or something. So it's
quite easy to identify whether the
printing on the package is correct or
whether this is just a fake chip.
Mic: Well, that's not clear. But you know
what? After all.
Herald: Question answered? I guess. Yes,
please go. Go on.
Mic: So you said you can generally look at
chips using just optical microscopes, what
kind of magnification we can need for
different types of chips?
Peter: OK, so typically for a stereo
microscope, for preparation, you would
need only some five, four or twenty four
to magnification, but usually for looking
optically at chips, you would need a 100
fold to I would say five hundred fold
magnification. That's of course there's a
limit because of the technology gets
smaller than the wavelengths of light and
then you've got a problem. And so
therefore we also have recommended here
for amateurs or for beginners in this
topic to use all the chips, because you
have, for example, one point two
micrometer technology, which is far away
from from the wavelengths of the light.
But a few today would have, for example,
90 nanometer or 65 nanometers of the CPUs,
even 22 nanometers. So that's 20, 20 times
smaller than the wavelengths of light. And
then you don't see anything at all and
just colors.
Herald: Question answered?
Marcus: And please be invited to our
assembly later on because we have got a
microscope and some sample chips with us
so you can make some own experience in
there and watch the silicon and see what
kind of such you can see so please be
invited.
Herald: I'm totally sorry. I totally
overlooked Microphone four. Please, please
go ahead.
Mic: So if you have just a limited amount
of chips and want to maybe reuse them
again like we want them. Um..
Herald: Could you please repeat the
question with a microphone, because then
it's recorded.
Mic: Yeah, so if you have, like, only a
couple of chips and want to reuse them
again and dissolve epoxy, like what or
what method would you recommend to use?
Peter: All right. So if you want to use
them, um, after preparing, then it's very
important that there are no acid residues
left because we sometimes see, for
example, if you prepare a chip with fuming
nitric acid and there's just a small
amount of acid which is left, then after
one week or two week, the chips
deteriorate. And so this means that they
have to be and the acid has to be
neutralized very good. Rinsed with acetone
and then afterwards dry it carefully. So I
would recommend to to store them also
maybe, um, under dry conditions, but if
you are interesting. And afterwards you
could also contact us because we have some
methods also for conserving chips.
Herald: Question answered right from the
Internet, please.
Signal Angel: Yeah, there's another one.
Um, it's about have you noticed any
manufacturers implementing
countermeasures, new guards to decaping
the chips?
Marcus: So yes, indeed, there are some,
uh, countermeasures at advertised by, uh,
manufacturers who say, yes, we have a kind
of secure package. Uh, one of those secure
packages also shown in the presentation
where, for example, uh, special coverage
on top has been placed. Uh, but anyhow,
also there we have, uh, displayed some,
uh, methods in order to open up those
kinds of packages. So, uh, it's always a
trade off how much, uh, security you can
expect from the chip package. And so, in
my opinion, I think the package there are
so many, uh, methods to remove a package.
It could not be a completely secure
package just by the package itself. So if
you need to have some secrets inside a
chip, then really the chip hardware should
be secured and therefore protected against
spying out of those data. And this will be
more on logical ways, for example, using
encryption instead of using some, uh,
material in the package.
Peter: So there should be no trade off
between buying, uh, insecure or less
secure chip and then adding a package. We
think that the chip itself has to be
secure or secure enough, I should say, and
it cannot be afterwards put the security
cannot be put afterwards around the chip.
So that's not the way of, uh, of clean,
uh, engineering.
Herald: Right. Um, we have time for a last
question. If you could please keep short
and you guys also please go ahead.
Mic: I have a question about, uh, legal
problems. When you publish photos of the
internal parts, and maybe sharing in a
public database to to make education
better or I don't know.
Peter: Um, that's if you make photos of
chips themselves which you have prepared
by yourselves, then I think it should not
be critical. So we have also here are some
pictures which we made sometimes of our
own chips, sometimes of other chips. But
this does not contain any trade secrets,
for example. But of course, that's a
difficult question, especially if it goes,
for example, to pictures which contain
material where you see, for example code,
a ROM picture if you would publish a
picture of a ROM and then it could be that
this ROM contains code and then you would
publish this code. So it's very difficult
to tell which is which is right and which
is wrong. But, um, usually we don't think
that that just took pictures are critical.
Marcus: And it really depends also on the
resolution. If you have a complete chip
and a overal resolutions that you cannot
identify single lines and cannot use this
as a schematic to include such a chip,
then it's something different compared to
a high resolution picture where you can
draw a complete schematics in there, but
we can also talk later on in the assembly
more on this topic. And also I see some
further question, but I think we are
running out of time so we can do this
later on.
Herald: Yeah, great. Thank you very much.
Thank you for your questions.
applause
The guys with the open chips go to the
assembly and ask them if you have any more
questions, please. OK, thank you.
Subtitles created by c3subtitles.de
in the year 2021. Join, and help us!