0:00:09.700,0:00:18.890 Marcus: Thank you for the kind[br]introduction. Welcome to our talk about 0:00:18.890,0:00:24.000 engaging microchips. So the background in[br]here is twofold. On the one hand side, we 0:00:24.000,0:00:28.630 would like to encourage you also to make[br]some own experiments and to see what is 0:00:28.630,0:00:38.090 inside a semiconductor device that means[br]what is inside a microchip. And so the 0:00:38.090,0:00:43.680 goal is that you also have some knowledge[br]how to open up a microchip and how to get 0:00:43.680,0:00:47.660 direct access to the silicon. On the other[br]hand, also, very often there's a rumor 0:00:47.660,0:00:50.087 that chip is highly secured because the[br]silicon is inside of plastic coverage. And 0:00:50.087,0:00:56.920 if a plastic package is really high[br]security, we can also explain today, 0:00:56.920,0:01:00.090 because very often even this amateur[br]equipment, it's possible to open up chips 0:01:00.090,0:01:03.739 and to get direct access to the silicon.[br]We are not only focusing on microchips, 0:01:03.739,0:01:07.100 but we are also focusing on more complex[br]systems, how to open up the system to get 0:01:07.100,0:01:10.649 access to the silicon in our background.[br]We have started more than 25 years ago 0:01:10.649,0:01:15.189 with analyzing the first telephone cards.[br]And so starting off with some experiments 0:01:15.189,0:01:21.780 at the Commodore 64, as well as working[br]with the first telephone card, it was our 0:01:21.780,0:01:25.859 major interest to find out what is the[br]functionality of this telephone card and 0:01:25.859,0:01:30.579 also what is inside. And of course, for[br]identifying what's inside. It was also our 0:01:30.579,0:01:35.299 target to open up stores, plastic cards[br]and to get access to the silicon chip 0:01:35.299,0:01:39.200 inside the telephone card. Nowadays, we[br]are also very often open up chips in order 0:01:39.200,0:01:45.850 to make some analysis or in order to apply[br]some high tech methods, for example, for 0:01:45.850,0:01:50.060 putting some over particular variation on[br]the top of the surface, also to apply some 0:01:50.060,0:01:52.549 laser. It's, of course, necessary to have[br]direct access to the silicon itself. And 0:01:52.549,0:01:57.939 therefore, also today we are utilizing a[br]lot of professional equipment in order to 0:01:57.939,0:02:00.409 observe chips. So today we would like to[br]give a short overview about the different 0:02:00.409,0:02:04.099 techniques and methods, how to open up[br]different kinds of chips, and also to 0:02:04.099,0:02:07.639 encourage you, because it is very[br]interesting also to open microchip 0:02:07.639,0:02:11.970 packages in order to get further analysis.[br]First of all, sometimes it's not quite 0:02:11.970,0:02:14.330 clear whether this is really a package[br]which contains a chip or whether there's 0:02:14.330,0:02:18.810 only a kind of label, as you can see, in[br]the lower picture. So in the lower 0:02:18.810,0:02:23.090 picture, it might be only a barcode labor,[br]but perhaps also an RFID chip might be in 0:02:23.090,0:02:28.379 there. And therefore, a first analysis.[br]It's the question, a inside the package. 0:02:28.379,0:02:30.379 And then, of course, also there's the[br]question, what is it about the chip 0:02:30.379,0:02:36.200 functionality itself? That means how many[br]functions are implemented in such a chip? 0:02:36.200,0:02:41.410 This is only a memory. Ship ourselves for[br]some logic inside there. And what kind of 0:02:41.410,0:02:48.019 logic is implemented here? And by the way,[br]on the most of the chips are also so- 0:02:48.019,0:02:52.670 called time markings. That means some[br]small numbers and these identified as the 0:02:52.670,0:02:55.989 silicon itself and these same markings as[br]possible to make some research and some, 0:02:55.989,0:02:58.790 um, findings from literature, as well as[br]also from tools in order to get more 0:02:58.790,0:02:59.890 information about the chip itself. And[br]finally, watching on the silicon itself 0:02:59.890,0:03:00.890 indicates also, if this is a more modern[br]chip, that means smaller technology or 0:03:00.890,0:03:07.540 whether this is an old fashioned chip. And[br]so you cannot expect so much functionality 0:03:07.540,0:03:11.599 or security funds the chip itself. So from[br]this perspective, these are some 0:03:11.599,0:03:15.090 motivation which also may encourage you to[br]open up some microchip packages and to 0:03:15.090,0:03:20.040 find out what's really inside there. We[br]have fought also three examples, um, to 0:03:20.040,0:03:24.390 show what is a potential finding out of[br]this. For example, it's well known that 0:03:24.390,0:03:29.540 some goods are tracked down with RFID[br]chips. And so recently we also got a t 0:03:29.540,0:03:36.069 shirt with a dedicated label inside here.[br]And it was not clear whether this label is 0:03:36.069,0:03:41.359 just about label or whether there are some[br]more, um, techniques inside the specialty 0:03:41.359,0:03:48.850 and RFID chip. So as you can see in the[br]second picture, it's quite easy to 0:03:48.850,0:03:52.349 identify if this is more than a barcode[br]label, because simply with a torch limb, 0:03:52.349,0:03:57.430 it's possible to eliminate those from the[br]back side. And so the flash indicates a. 0:03:57.430,0:04:03.349 There's something more than a bar code[br]inside there and indeed is some structure 0:04:03.349,0:04:11.400 inside. We have put this into a glass of[br]acetone and after a short while is the 0:04:11.400,0:04:14.790 label has to eliminate it. And so we can[br]got we got the final picture with the 0:04:14.790,0:04:20.700 antenna inside here. And in the middle of[br]the antenna is a small, dark spot. And 0:04:20.700,0:04:26.500 this is a chip. So it was clearly from the[br]antenna size, such as communicating in UHF 0:04:26.500,0:04:34.330 frequency range and also the small dot.[br]It's an hour edition. So now it's prepared 0:04:34.330,0:04:42.430 for further analysis with a microscope. So[br]you see, it might be very simple to get 0:04:42.430,0:04:45.040 some more information out here. Another[br]example brings us back where we back to 0:04:45.040,0:04:48.490 the history. And as I mentioned before, we[br]have started this investigation on 0:04:48.490,0:04:54.630 telephone cards. And, of course, not only[br]the telephone calls, but also the 0:04:54.630,0:04:57.530 telephone card system has been of high[br]interest for us. And so we were in lucky 0:04:57.530,0:05:02.870 situations that we found some, uh, printed[br]circuit boards from Cox Telephone where we 0:05:02.870,0:05:07.840 only got access to those because those car[br]telephones has been burned down 0:05:07.840,0:05:13.260 completely. So it was a huge fire. And so[br]inside is this area and so is the, um, uh, 0:05:13.260,0:05:16.860 telephone also get burned? Anyhow, we[br]managed to get those printed circuit 0:05:16.860,0:05:23.090 board. And in the second picture, you can[br]also see that the X-ray picture of the 0:05:23.090,0:05:30.160 printed circuit board, uh, clearly shows[br]that all the borrowings are still OK. So 0:05:30.160,0:05:35.820 it was possible for us to draw a dramatic,[br]uh, schematic and, uh, to see how the 0:05:35.820,0:05:40.110 different pins of this, uh, printed[br]circuit boards are connected. Well, 0:05:40.110,0:05:44.520 anyhow, it was not clear what are the[br]different shapes, because due to the heat, 0:05:44.520,0:05:49.680 simply the marking on the chip itself has[br]been vanished. So from this perspective, 0:05:49.680,0:05:53.030 we have used some, uh, capitulation method[br]in order to get the singer chips, the 0:05:53.030,0:05:57.020 silicone chips out of those devices. And[br]as you can see in the lower picture, then, 0:05:57.020,0:06:00.530 uh, with some, uh, microscopy work, we[br]were able to find out what is each single 0:06:00.530,0:06:02.930 chip. And so, uh, identifying the[br]different names of those chips and also 0:06:02.930,0:06:06.170 combining this was a schematic. It was[br]possible for us to, uh, resolve the main 0:06:06.170,0:06:10.830 function in those days from the cartoon[br]itself. And this gives us a clear clue in 0:06:10.830,0:06:14.910 what direction the telephone has worked in[br]those days. Yeah. And finally, also, there 0:06:14.910,0:06:18.840 was something in the beginning of 2000[br]there was a price competition. And is this 0:06:18.840,0:06:23.640 price competition, um, mean such as the[br]small sticker, which has to be applied to 0:06:23.640,0:06:28.120 the, uh, TV set. And then in this[br]perspective, uh, it was also that a lot of 0:06:28.120,0:06:38.340 rumors, whether this kind of spacechip[br]inside Syria and you see on the lower side 0:06:38.340,0:06:42.940 says, uh, some, um, comment from the[br]Internet at those days that there should 0:06:42.940,0:06:48.120 be an electronic chip inside Syria. And[br]this electronics should not only record 0:06:48.120,0:06:53.870 what you are watching on TV, but also, um,[br]make some sound recording in order to find 0:06:53.870,0:07:01.350 out how many people are in the room[br]watching this show and so on and so on. 0:07:01.350,0:07:08.450 But anyhow, um, we clearly thought, well,[br]this is just a rumor. And so, of course, 0:07:08.450,0:07:14.370 we use our, uh, techniques in order to[br]open up this device and also to find out, 0:07:14.370,0:07:23.570 uh, what's inside there. And in the end of[br]the day, it was clearly that this was only 0:07:23.570,0:07:30.460 a dot mask and below officers, there were[br]some foom which is photosensitive. And 0:07:30.460,0:07:37.050 when you watch, uh, special TV shows and[br]this film has been illuminated and 0:07:37.050,0:07:41.430 therefore it was clearly identifiable[br]whether this show has been seen or not. So 0:07:41.430,0:07:48.620 it was clear for us that we could identify[br]there's no spacechip inside and this was 0:07:48.620,0:07:51.650 only a rumor. So also, therefore, the[br]preparation techniques are quite useful 0:07:51.650,0:07:54.650 and helps to understand what's going in[br]inside Syria. 0:07:54.650,0:08:00.280 Peter: All right. Some some somewhat to[br]the chips and the packages. So there are 0:08:00.280,0:08:02.590 many thousands of different packages for[br]troops today. And sometimes the 0:08:02.590,0:08:04.920 functionality of the chip that just inside[br]will directly determine the way, such as 0:08:04.920,0:08:10.330 packaged. And this is the case for these[br]troops here especially. And if you look on 0:08:10.330,0:08:14.280 the left, that's an interesting thing. A[br]fingerprint sensor, which is another from. 0:08:14.280,0:08:21.210 Even use today with his fingerprints, and[br]this is a specialty that the chip itself 0:08:21.210,0:08:26.050 can be directly touched with the finger.[br]Normally you would avoid such a situation, 0:08:26.050,0:08:30.210 but here you have the direct silicone[br]accessible and there's only a frame which 0:08:30.210,0:08:34.969 is covering the surrounding of the chip to[br]make it mountable and the device itself. 0:08:34.969,0:08:40.050 Then we have a webcam webcam shown here,[br]which is just covered by a thin plate of 0:08:40.050,0:08:43.880 glass. Of course, the picture or the[br]optical radiation has to reach the chip 0:08:43.880,0:08:48.460 and therefore the same is true for your[br]microscope. You can directly observe such 0:08:48.460,0:08:54.570 chips without further preparation. Um,[br]yeah, I think the older one of you know, 0:08:54.570,0:08:58.600 this is prom type of memory, old fashioned[br]thing, but sometimes it's still seen 0:08:58.600,0:09:03.160 today. You can electrically write such an[br]issue from memory, but if you want to 0:09:03.160,0:09:06.990 erase it, you have to put it under[br]ultraviolet light to make the erasing 0:09:06.990,0:09:14.070 function. And so this means also this[br]package has a window in this case that's 0:09:14.070,0:09:21.920 made of silica because this uses to be UV[br]transparent. And again, you can have a 0:09:21.920,0:09:25.860 look inside without any preparation, which[br]sometimes quite interesting. And then on 0:09:25.860,0:09:30.460 the right, we have an amplifier chip shown[br]here and which is an instrumentation 0:09:30.460,0:09:34.200 amplifier, and therefore it should be[br]sealed from the environment, but also from 0:09:34.200,0:09:38.150 electromagnetic radiation. And this is[br]done here in this case by a ceramic 0:09:38.150,0:09:44.710 package. And this package has a metal that[br]over it. And again, here, it's very easy 0:09:44.710,0:09:50.520 to open this package. We will see later on[br]and was just using a blade. So all of 0:09:50.520,0:09:56.540 these four packages are quite interesting[br]for an amateur. You don't need any 0:09:56.540,0:10:03.540 equipment at all to have a look inside.[br]But as we said, from open to amateur hour, 0:10:03.540,0:10:07.529 some more difficult shops to open. And[br]here on the left side, that's a typical 0:10:07.529,0:10:10.310 chip which you will encounter and millions[br]today and all consumer goods. It's a 0:10:10.310,0:10:16.870 plastic package here. We have an order,[br]one which is a plastic package. But you 0:10:16.870,0:10:21.000 also know the surface mounted devices and[br]so on. So this plastic packages are quite 0:10:21.000,0:10:23.190 robust against environment, but also they[br]are robust against chemicals. And this 0:10:23.190,0:10:26.300 means you need quite harsh conditions to[br]open them and the chemical weigh. Are you 0:10:26.300,0:10:30.680 when it laser, which we will see later on,[br]epoxy resin. And the same is true for the 0:10:30.680,0:10:35.180 laptop package, which is a very low cost[br]kind of package, just as it is put on the 0:10:35.180,0:10:38.380 circuit board, then it's connected point[br]wires to the circuit board itself and then 0:10:38.380,0:10:44.491 afterwards just a drop of epoxy resin as[br]part of it. And you see, it's not a 0:10:44.491,0:10:50.830 rectangular form which should have. It's[br]more just a drop which put on top of 0:10:50.830,0:10:52.940 clocktower package is also seen here. And[br]the third picture, which is the smartcard 0:10:52.940,0:10:55.750 package, the typical one, if you would[br]turn this picture around, then you would 0:10:55.750,0:10:58.240 see on the other side that there are the[br]typical Golden Smartcard contacts. And 0:10:58.240,0:11:00.770 from the back side, it's a picture like[br]this. You have the chip and the chip is 0:11:00.770,0:11:07.200 connected, was bond wires to the[br]connection points and then afterwards to 0:11:07.200,0:11:13.860 hold it in place and also to make it[br]resistant from the environmental 0:11:13.860,0:11:19.040 conditions. It's also protected with a[br]blocked off package. So it just epoxy 0:11:19.040,0:11:24.900 resin is poured over it. And then finally[br]on the right is something which some 0:11:24.900,0:11:26.370 people call a security package. You see[br]that matterson hyphenation. Not only is it 0:11:26.370,0:11:30.480 dark so that you can see directly through[br]the through to the chip, but there's also 0:11:30.480,0:11:34.690 there can be some special Latisse, for[br]example, in this case, there's an 0:11:34.690,0:11:37.710 additional layer which is put on the chip,[br]which is also made of silicon itself. But 0:11:37.710,0:11:42.910 yeah, as we showed here, it's not I would[br]say it's not really security. And many 0:11:42.910,0:11:46.440 cases of this package, just because of the[br]security, does not start in the chip 0:11:46.440,0:11:50.950 itself. And I would say then it's a little[br]bit too late. All right. So what can you 0:11:50.950,0:11:57.040 see if you look inside such chips and we[br]have chosen some examples where you don't 0:11:57.040,0:12:01.810 need any preparation at all. Here you can[br]see some memories for beginning. It's 0:12:01.810,0:12:05.120 quite interesting to have a look at all[br]the chips which are sometimes available to 0:12:05.120,0:12:08.840 store. And that's because simple fact. And[br]the older days, the technologies were not 0:12:08.840,0:12:15.260 so small as today. So this means you can[br]see the structures. What's your barai or 0:12:15.260,0:12:18.310 maybe you need your grandfather's[br]magnifying glass, maybe, but you don't 0:12:18.310,0:12:22.172 need a high definition microscope. And so[br]here on the far left, that's a chip from 0:12:22.172,0:12:25.589 nineteen seventy six, very old one very[br]small memory. And you can directly see 0:12:25.589,0:12:28.650 with your eye all the structures inside[br]just through the window without opening it 0:12:28.650,0:12:31.070 at all. And then if we proceed in time[br]also to a vintage chip from nineteen 0:12:31.070,0:12:34.990 eighty eight, one megabit it from there.[br]See already it's more like a gray mass, 0:12:34.990,0:12:39.690 that's a memory cells and you definitely[br]would need a microscope to have a further 0:12:39.690,0:12:42.490 look inside how such a memory is built and[br]to analyze it. And then on the right. 0:12:42.490,0:12:44.640 That's also an interesting example of a[br]memory. But this memory has some access, 0:12:44.640,0:12:47.290 right. Tied to it, because that's the[br]telephone chip card. And here you have a 0:12:47.290,0:12:50.820 very small memory of only 88 bits. But the[br]rest is controlled logic so that only the 0:12:50.820,0:12:53.710 people who are or should be allowed to[br]load it and to erase it have this access 0:12:53.710,0:12:57.110 rights given to them. And if we look at[br]the little microcontroller units and they 0:12:57.110,0:13:00.650 are quite more interesting than just a[br]memory. And here again, we have four 0:13:00.650,0:13:05.220 different chips brought to you. Two of[br]those also have windows. You don't need 0:13:05.220,0:13:11.460 any preparation at all. And the one on the[br]left is, again, a chip from nineteen 0:13:11.460,0:13:14.680 seventy six, very old. One can see[br]directly all the different structures like 0:13:14.680,0:13:19.960 Rom Ram that you prompt part and also the[br]logic part which contains the CPU and also 0:13:19.960,0:13:23.779 some analog devices which are needed for[br]the functionality of the chip. I think 0:13:23.779,0:13:26.850 that pick 16, the second picture, you[br]know, and the flash version, which is very 0:13:26.850,0:13:33.330 common today, you just can program it and[br]erase it again and a normal device. But in 0:13:33.330,0:13:39.000 1988, these types of the control that were[br]made was EPROM. So this means you could 0:13:39.000,0:13:45.410 program it. And then if you want to erase[br]it again for reprograming, you have to put 0:13:45.410,0:13:50.110 it under ultraviolet lamp for five[br]minutes. So therefore, there are some 0:13:50.110,0:13:54.800 older versions of the controller. But what[br]you can see is that the technology is 0:13:54.800,0:13:59.720 smaller and that the chip is just a very[br]high density and comparison to the chip, 0:13:59.720,0:14:05.370 which is 12 years older. Interestingly,[br]the smart all the smart card controls look 0:14:05.370,0:14:10.240 quite the same, like these older devices.[br]And they also have from RAM you prom are 0:14:10.240,0:14:14.230 normally prom. So electrical eraser, a[br]programable rom. And so therefore the 0:14:14.230,0:14:19.750 smart card units, even those of in the 90s[br]look like the same, like the older and 0:14:19.750,0:14:24.390 serious. And finally, just for comparison,[br]we also brought a sixty eight case. If you 0:14:24.390,0:14:30.540 this has only cash but no nonvolatile[br]memory and was used in some old home 0:14:30.540,0:14:37.350 computers for example, but also in[br]instrumentation technology. So what do you 0:14:37.350,0:14:41.840 need if you want to start with preparing[br]microchips. Just to have a look, if it's 0:14:41.840,0:14:49.750 interesting for you to have a glimpse[br]inside. So what you definitely need is a 0:14:49.750,0:14:55.120 simple microscope. And we showed there a[br]student version that's about 300 euros. 0:14:55.120,0:14:59.530 But they are also quite interesting USB[br]microscopes today and which come ready for 0:14:59.530,0:15:03.940 use for about 150 euros. So that's quite[br]good tools. You need definitely some 0:15:03.940,0:15:08.040 mechanical tools like scalpels, tweezers,[br]which we have here sometimes some sort of 0:15:08.040,0:15:12.000 dentist tools, which also would serve[br]quite well, an ultrasonic cleaner. It's a 0:15:12.000,0:15:17.020 very good thing to have because this is[br]really nice for package preparation, 0:15:17.020,0:15:21.660 cleaning, but also removing particles and[br]also of the chip is prepared and ready. 0:15:21.660,0:15:25.890 Then you can remove all remaining residues[br]and particles from it. And finally, there 0:15:25.890,0:15:29.360 are three solvents which you need for[br]beginners, which is alcohol, ethanol and 0:15:29.360,0:15:33.610 acetone and also benzene. These are three[br]solvents from non polla to polla type. And 0:15:33.610,0:15:37.709 with these three solvents, you can open a[br]lot of different packages. Then for 0:15:37.709,0:15:43.990 upgrading such equipment, it's quite[br]interesting to have a 3-D view. So was a 0:15:43.990,0:15:46.210 stereo microscope. You can make[br]preparation with both your eyes. You have 0:15:46.210,0:15:49.040 a 3-D vision and you can directly see what[br]you are doing, which is sometimes quite 0:15:49.040,0:15:53.529 difficult. If you have on your monocular[br]side, then if you want to share your 0:15:53.529,0:15:56.320 results, a microscope camera could serve[br]your well, which is available for about 0:15:56.320,0:16:01.010 300 euros. But there are also some DIY[br]versions, for example, with no cameras 0:16:01.010,0:16:04.860 which are adapted to the microscope[br]itself. Some further chemicals can be 0:16:04.860,0:16:09.490 needed, which I will also show you later[br]on the table, which are not without 0:16:09.490,0:16:14.680 danger, I would say, and therefore also[br]typically a lab coat and some protective 0:16:14.680,0:16:22.380 wear would be used. So now we are in a[br]moment we will come to a different details 0:16:22.380,0:16:28.190 of how to open a package and and the steps[br]itself. And this will be sorted from 0:16:28.190,0:16:30.550 physical opening statements, the methods[br]or mechanical methods over to chemical 0:16:30.550,0:16:34.540 methods for you directly open. So device[br]with chemical means. But there's also a 0:16:34.540,0:16:36.100 mixture of both. And therefore, I would[br]like to hand over to Marcus. 0:16:36.100,0:16:38.690 Marcus: Yes, thank you. Let's go to the[br]workbench and open some packages. So 0:16:38.690,0:16:41.060 beginning, as Peter mentioned, with the[br]physical ones. And the first one is quite 0:16:41.060,0:16:44.670 easy. You just need advice. And as you[br]puts a chip inside vis a with the lower 0:16:44.670,0:16:50.380 part of the I see as depicted in the first[br]picture and then you just put some more 0:16:50.380,0:16:55.050 forces to the I see. Pictures save and[br]during the time device will be smaller and 0:16:55.050,0:17:01.450 smaller, the package will break up and the[br]upper part lift up. So as visible in the 0:17:01.450,0:17:03.940 third picture, you can use a simple[br]screwdriver to remove the upper limit. And 0:17:03.940,0:17:08.209 then finally, in the last picture, it's[br]visible that the bare silicon chip is 0:17:08.209,0:17:10.579 visible for your further analysis, also[br]connected to the lead frame. So the frame 0:17:10.579,0:17:13.439 which connects to the outer pins and to[br]the outer communication. So this is a 0:17:13.439,0:17:18.100 quite simple method. And indeed, this is[br]the first method we have also used in the 0:17:18.100,0:17:20.890 example of the copper telephone I have[br]explained earlier. So it was quite easy to 0:17:20.890,0:17:26.909 break up those chips in order to get the[br]silicon parts out of the ICS and then 0:17:26.909,0:17:35.210 analyzing them with a microscope, even if[br]the package will be a little bit more 0:17:35.210,0:17:42.139 hardened. For example, a ceramic housing[br]like use in eponyms, then it's also a good 0:17:42.139,0:17:49.070 idea to have fixes and device and just to[br]replace a screwdriver on the top part of 0:17:49.070,0:17:58.799 the see, and there's a small bump on the[br]back of the screwdriver. The upper limit 0:17:58.799,0:18:01.769 will be removed. And as you can see in the[br]chart picture directly, the access to the 0:18:01.769,0:18:06.029 chip is possible. So indeed, I think these[br]pictures clearly identify that this must 0:18:06.029,0:18:11.730 be not high, sophisticated techniques or[br]some sensors, sometimes really a normal 0:18:11.730,0:18:15.759 workbenches sufficient to get access to[br]very easy. It's in the case if there's a 0:18:15.759,0:18:21.590 special package, as Peter has explained,[br]with such a metal lid on top of this, 0:18:21.590,0:18:25.210 because this method to it is sold out on[br]the academic housing. And typically you 0:18:25.210,0:18:30.863 can think about where grindings as a way[br]or try to sold out or something like. But 0:18:30.863,0:18:32.060 there's a very easy method to open up[br]those kinds of packages. You just use a 0:18:32.060,0:18:36.739 blade as visible in the second picture[br]and, um, use a hammer for a small store. 0:18:36.739,0:18:40.629 And then this blade drives and is this[br]metal dirt and you can simply lift off 0:18:40.629,0:18:44.220 this metal without any further, um,[br]effort. So it's just, uh, two seconds, uh, 0:18:44.220,0:18:48.230 work to open up those kinds of packages.[br]And even those blades are quite easy to 0:18:48.230,0:18:53.080 access because you can see in the lower[br]pictures that they are sold also in 0:18:53.080,0:18:57.549 discounters for, uh, cleaners of Deskovic.[br]So these blades are easy to use just with 0:18:57.549,0:19:07.960 the hammer. You can drive them below the[br]lid. And so this opens. So you see 0:19:07.960,0:19:11.340 physical mechanisms can be very easy. Now,[br]as also mentioned before, our first topic 0:19:11.340,0:19:13.650 has been to, uh, check what's inside a[br]telephone card. And, of course. Such a 0:19:13.650,0:19:16.309 physical preparation, it's more[br]complicated on a small plastic card, and 0:19:16.309,0:19:19.700 therefore it more goes into the direction[br]of physical chemical reaction on source 0:19:19.700,0:19:27.269 cards. And you can see here in this hall[br]of pictures, we have just played such a 0:19:27.269,0:19:32.740 smart card in it's. And after five[br]minutes, as was a in the second picture, 0:19:32.740,0:19:38.090 the plastic of the card absorbed some[br]acetone and therefore swails. After 15 0:19:38.090,0:19:41.779 minutes, you can just wait for those[br]minutes. Then the structure is fully 0:19:41.779,0:19:46.669 destroyed. And so it's quite easy to[br]remove the remaining plastic parts as 0:19:46.669,0:19:54.149 visible on the fourth picture in the[br]apple. So, again, just by waiting about 15 0:19:54.149,0:20:01.120 minutes in, etc. on the smart card is um.[br]Yeah, destroyed. And so, um, as visible in 0:20:01.120,0:20:05.700 the lower picture, all it's possible to[br]remove the antenna and censorchip itself. 0:20:05.700,0:20:13.010 And I think the result and the last[br]picture on the law, uh oh it's quite 0:20:13.010,0:20:15.880 impressive. It's a complete antenna,[br]including the chip has been resolved out 0:20:15.880,0:20:34.929 of this, uh, plastic card. And so, um, it[br]was quite easy to analyze the antenna and 0:20:34.929,0:20:40.610 the size and how this is implemented in[br]here. Anyhow, you may recognize that the 0:20:40.610,0:20:46.220 chip is still covered by, uh, uh, a[br]laptop. That means a small piece of, uh, 0:20:46.220,0:20:56.269 epoxy on top of this. And so it's a[br]question how to remove this here. It's 0:20:56.269,0:21:00.940 possible to use, for example, a laser[br]with, uh, um, infrared laser, especially 0:21:00.940,0:21:04.730 for about Servais flying of 10000[br]nanometers. Um, it's quite useful to open 0:21:04.730,0:21:09.850 up those kinds of pictures because the[br]silicon itself is transparent for such an 0:21:09.850,0:21:12.429 infrared radiation. So the chip itself[br]would be not directly affected by the 0:21:12.429,0:21:16.159 infrared radiation, but all the energy[br]will be absorbed by the package itself. So 0:21:16.159,0:21:17.960 it's just a trauma to, um, destruction of[br]the package as visible in the lower 0:21:17.960,0:21:22.340 picture. And especially also this is quite[br]useful to open up so-called secure 0:21:22.340,0:21:25.249 pictures, as Peter has explained. So even[br]those kinds of packages, uh, are just 0:21:25.249,0:21:31.889 applied with a laser and, um, it's opened[br]up so that all the, um, silicon can be 0:21:31.889,0:21:35.500 directly accessed. Anyhow, this, uh, may[br]also be some risk. It appears on the one 0:21:35.500,0:21:42.480 hand side, the risk that the chips to get[br]damage due to the fact that is, uh, 0:21:42.480,0:21:46.820 package components are heated up and[br]souless temperature could also be applied 0:21:46.820,0:21:52.139 to the silicon chip itself or make some,[br]uh, Tominaga medical attention and 0:21:52.139,0:21:57.090 therefore, chip may break down. On the[br]other hand, of course, infrared laser 0:21:57.090,0:22:01.929 radiation may also, um, make some, uh,[br]health, uh, difficulties. And therefore, 0:22:01.929,0:22:04.730 it's very important, um, to be careful[br]with those laser radiations. So question 0:22:04.730,0:22:11.639 is, OK, how to open up epoxy in other[br]ways, not, uh, having such a laser, and 0:22:11.639,0:22:16.470 therefore for us, again, a physical[br]preparation take place. So for applying 0:22:16.470,0:22:19.514 Shamika, it's it's very good to prepare[br]the chips with some, um, mechanical 0:22:19.514,0:22:23.620 preparation. And you see here again, the[br]chip and advise and then with a grinding 0:22:23.620,0:22:27.549 disk and some parallel movement as visible[br]in the, uh, third picture here. And this 0:22:27.549,0:22:36.859 whole small curve has been set up. And so[br]we have two advantages in here. The first 0:22:36.859,0:22:40.559 advantage is that already some material is[br]finished. And so therefore we have, uh, 0:22:40.559,0:22:45.629 faster access to the silicone and save. On[br]the other hand, also, we have some, uh, 0:22:45.629,0:22:52.379 area where some chemicals can be dropped[br]on and, uh, will take place here. So let's 0:22:52.379,0:22:56.940 go with the chip to the, uh, Shamika[br]treatment. And here again, in the first 0:22:56.940,0:23:00.010 two pictures, you'll see the preparation[br]by the mechanical grinding and censorchip 0:23:00.010,0:23:06.450 is, uh, put into a sandbaggers, which is[br]heated up. So at about 50 to 90 degrees 0:23:06.450,0:23:09.990 Celsius, send some nitric acid, uh, will[br]be dropped on there. And just after 0:23:09.990,0:23:15.000 overseer's epoxy will be removed and, uh,[br]you can get direct access to the silicone. 0:23:15.000,0:23:19.690 So after you have the desired result, that[br]means after all the epoxy has gone, you 0:23:19.690,0:23:24.610 can remove the rest of the. Set by using[br]some acetone, as was a boot in the lower 0:23:24.610,0:23:30.110 picture. Um, hole and also it's a good[br]idea to clean up, um, the chip into the 0:23:30.110,0:23:39.440 ultrasonic cleaner in order to remove the[br]remaining particles. If you don't want to 0:23:39.440,0:23:47.480 wait for a long time, then you can again[br]use some acetone in order to have some 0:23:47.480,0:23:54.159 carpet try drying. And finally, you have a[br]very good, uh, preparation where you have 0:23:54.159,0:23:58.570 access to the silicone, but also have, uh,[br]the connection. Uh, most of the cases do 0:23:58.570,0:24:04.419 OK for using the chip and operating the[br]chip in this environment. Anyhow, as this 0:24:04.419,0:24:07.600 is, it may also damage some parts of the[br]chips. And therefore, it's also the 0:24:07.600,0:24:14.789 question if you do not need to operate the[br]chip, but just for inspection, that's 0:24:14.789,0:24:19.389 another method to open up those kinds of[br]epoxy. And it's just using California or 0:24:19.389,0:24:23.710 in German, California. Um, so putting[br]parts of California together with a chip 0:24:23.710,0:24:30.740 into, um, glass, then you can heat up this[br]to the boiling point. It's about, uh, 0:24:30.740,0:24:34.929 three hundred twenty two or three hundred[br]sixty degrees Celsius. So it's possible to 0:24:34.929,0:24:40.200 use simply a heat gun and make this very[br]fast anyhow by using so, uh, such a heat 0:24:40.200,0:24:43.239 gun and, uh, heating up California. It[br]also makes some ugly smells. So be 0:24:43.239,0:24:50.479 prepared that this is not in your living[br]room because otherwise you won't access a 0:24:50.479,0:24:57.100 living room for the next days. Anyhow,[br]after a short while, about five to 20 0:24:57.100,0:25:03.139 minutes depend on the, uh, package itself,[br]how big this package is. Um, the epoxy is 0:25:03.139,0:25:05.800 completely dissolved and therefore the[br]chip could be, uh, taken out of this and 0:25:05.800,0:25:07.489 can be cleaned again in acetone. So you[br]see in the last picture on the top, oh, 0:25:07.489,0:25:09.373 it's a very good, uh, way to expect to[br]complete a chip and to get, uh, good 0:25:09.373,0:25:13.690 access to the silicone. But anyhow, in[br]this case, of course, the chip cannot be 0:25:13.690,0:25:16.870 operated any further. It's also the[br]connections, the bonding wires and solid 0:25:16.870,0:25:20.059 frame, uh, has been dissolved in the[br]California. And therefore, um, it's not 0:25:20.059,0:25:27.870 operational anymore. So you see there are[br]also some shemekia ways for using even as 0:25:27.870,0:25:33.109 an amateur and so for using those kinds of[br]Shamika, there's also the question of what 0:25:33.109,0:25:38.049 kind of chemicals can be used in here.[br]Peter: Marcus already showed you some 0:25:38.049,0:25:42.769 examples were in the process. You need[br]some chemicals, and so typically a problem 0:25:42.769,0:25:49.570 with chemicals is that they are quite hard[br]to obtain, especially for private persons. 0:25:49.570,0:25:52.989 And they are typically, if they are pure,[br]quite expensive, especially if you buy 0:25:52.989,0:25:57.039 them in small quantities. And therefore,[br]we have set up a small list which contains 0:25:57.039,0:26:02.440 chemicals which are available readily from[br]household products, or we would say from 0:26:02.440,0:26:06.259 the supermarket. And these chemicals here[br]are listed. And alphanumeric order also 0:26:06.259,0:26:11.779 was a German name because they are quite[br]different from the English name. And what 0:26:11.779,0:26:16.190 mainly is available in supermarkets or[br]household products are quite pure 0:26:16.190,0:26:19.989 chemicals. And these are solvents. And[br]remember, we need solvents for opening 0:26:19.989,0:26:23.200 packages, especially if we want to[br]dissolve one kind of plastic, but not the 0:26:23.200,0:26:26.159 other. For example, opening an RFID label[br]are you don't want to destroy the antenna 0:26:26.159,0:26:31.440 itself, which is put on a plastic, but you[br]want to open the package where the antenna 0:26:31.440,0:26:35.940 is put inside the laminate. And so[br]therefore, we have put together several 0:26:35.940,0:26:41.059 chemicals from acetone, for example, over[br]benzene, ethanol, but also ethylene glycol 0:26:41.059,0:26:44.940 and PACULA ethylene, which are solvents[br]for different kinds of plastics, which you 0:26:44.940,0:26:49.009 can see in the US case, raw. That's a very[br]special solvent, which is the second last 0:26:49.009,0:26:52.470 one for tetra, hydro for rain. And because[br]this dissolves also Pevensie polyvinyl 0:26:52.470,0:26:56.269 chloride, which is normally robust and[br]could not be dissolved. But with this 0:26:56.269,0:27:00.309 special solvent, you can also dissolve[br]privacy. Then, of course, you need the 0:27:00.309,0:27:02.960 mineralized water or distilled water. It's[br]sometimes called the jar because we don't 0:27:02.960,0:27:08.700 want to leave residues on the on the[br]chips, especially if cleaning them, for 0:27:08.700,0:27:12.500 example, in the ultrasonic bath. And[br]there's also some chemicals like the 0:27:12.500,0:27:15.779 sodium bicarbonate and sodium hydroxide,[br]which is needed to neutralize acids. But 0:27:15.779,0:27:20.360 it also can be used, for example, to[br]dissolve aluminum. And aluminum is also 0:27:20.360,0:27:24.200 used, for example, for Antenna's on Earth[br]text. So you can dissolve it away and just 0:27:24.200,0:27:33.110 the chip is left open. Um, that's one[br]chemical which is not available in the 0:27:33.110,0:27:41.890 supermarket. I think that's also a good[br]idea. That's not there. And that's a 0:27:41.890,0:27:45.230 fuming nitric acid. And assuming nitric[br]acid is often used in professional 0:27:45.230,0:27:48.950 versions of packaged opening, that's we[br]will see later on for destroying epoxy 0:27:48.950,0:27:53.169 material. So directly oxidizers the[br]material and it's less an acid, then more 0:27:53.169,0:27:59.809 and Occident, at least if it's water free.[br]So if the water was just mixed with acid, 0:27:59.809,0:28:03.960 then it gets more acid characteristics and[br]then it will destroy metals and also the 0:28:03.960,0:28:09.260 chip itself, therefore. And if one uses[br]it, it should be water free. Um, of course 0:28:09.260,0:28:12.759 if it destroys epoxy materials and it can[br]also destroy skin, closer's your 0:28:12.759,0:28:16.019 furniture, everything, all your devices[br]are rusting away and so on. So that's 0:28:16.019,0:28:22.789 really a nasty and therefore appropriate[br]safety equipment must be used so it can be 0:28:22.789,0:28:27.269 bought. It's about 100 to 200 euro are[br]quite expensive and also quite difficult 0:28:27.269,0:28:30.859 to obtain because it's also used for some[br]other more dangerous purposes. But there's 0:28:30.859,0:28:34.960 also also a way of maybe doing it by[br]yourself. So. Thanks, so, of course, we 0:28:34.960,0:28:38.590 were looking for recipes on the Internet[br]which are there, but that's much cooler. 0:28:38.590,0:28:43.720 That's the book here, which I got from my[br]15th birthday. I think it's a science book 0:28:43.720,0:28:47.970 for kids from quote unquote, Wesolowski[br]and also contains a recipe for making 0:28:47.970,0:28:50.739 fuming nitric acid. Also also with some[br]600000 fuming nitric acid works on wood, 0:28:50.739,0:28:54.080 for example, when it gets burning and so[br]on. So that's that's the recipe. And then 0:28:54.080,0:28:55.789 you, of course, need the equipment. So the[br]reaction is that concentrated sulfuric 0:28:55.789,0:28:57.570 acid, which can be bought, for example,[br]and pharmacist reacts, was potassium 0:28:57.570,0:28:58.799 nitrate, also typical of Pharmacy Chemica.[br]And then the fuming nitric acid, which is 0:28:58.799,0:29:03.500 generated, is distilled from this mixture.[br]You can see this in the picture as well. 0:29:03.500,0:29:07.139 That's the normal distillation apparatus.[br]The one which is used here is much 0:29:07.139,0:29:09.749 simpler. And on the right, that's a micro[br]distillation, distillation, glassware, 0:29:09.749,0:29:13.580 which can be used, for example, if you[br]only need some milliliters of this acid. 0:29:13.580,0:29:17.129 So typically for opening one package, I[br]would suggest, for example, five to 10 0:29:17.129,0:29:21.809 million liters of acid. So it does not[br]make sense to have more than than that. 0:29:21.809,0:29:25.769 I'm talking about professional chemicals[br]that are some more of these. So you you're 0:29:25.769,0:29:33.639 already recognized as the hazard of[br]pictograms which are here on the right 0:29:33.639,0:29:38.909 side. So these are chemicals which are not[br]harmless. And so therefore also they are 0:29:38.909,0:29:42.849 typically only available in a professional[br]or from professional sources, just some 0:29:42.849,0:29:47.440 chemicals or some chemicals which are good[br]solvents for epoxy material. So this means 0:29:47.440,0:29:53.340 in this case, the epoxy is not oxidized,[br]but it's dissolved. Or I should rather say 0:29:53.340,0:29:58.080 that it's it's swollen. So the molecules[br]of the solvent go into the epoxy and then 0:29:58.080,0:30:02.129 it swells and you can brush it away. It's[br]not material. The solvent process in this 0:30:02.129,0:30:05.889 case, um, besides these epoxy dissolving[br]chemicals, there are also some specialties 0:30:05.889,0:30:11.950 for some of the first one. Colene, this is[br]used in industry for cheap cleaning, but 0:30:11.950,0:30:16.480 also for wafer cleaning. And then finally,[br]the three ones on the bottom. These are 0:30:16.480,0:30:20.309 the assets which are used for destructive[br]opening nitric acid. You are not already 0:30:20.309,0:30:24.159 now. And then we have two other ones,[br]sulfuric acid, which must be used in a hot 0:30:24.159,0:30:29.330 variant, and also the so-called Olian,[br]which is a more aggressive version of the 0:30:29.330,0:30:33.070 sulfuric acid, which can be used also at[br]room temperature. So looking at 0:30:33.070,0:30:35.659 professional methods which are available,[br]for example, for semiconductor 0:30:35.659,0:30:38.299 manufacturers, if they want to do a[br]failure analysis, for example, then also 0:30:38.299,0:30:42.179 we have brought you some examples. And[br]this one here uses also fuming nitric 0:30:42.179,0:30:46.789 acid. It's a chemical capsule later. It's[br]a typical tool for industry if packages 0:30:46.789,0:30:50.299 are to be opened, for example, for failure[br]analyzers or other means. And so in this 0:30:50.299,0:30:55.470 case here, the acid is not dropped onto[br]the surface of the package, but it's first 0:30:55.470,0:30:59.380 heated and then it's pumped through a[br]small nozzle, which is made of Teflon of 0:30:59.380,0:31:06.399 glass. And then a jet of hot acid is[br]pushed on the surface of the package 0:31:06.399,0:31:12.239 itself. So this means all the reaction[br]products are readily flushed away and are 0:31:12.239,0:31:20.450 purged and the chip only comes in[br]connection with pure nitric acid. So this 0:31:20.450,0:31:27.479 means it can also not be damaged by[br]reaction products, which is very good. So 0:31:27.479,0:31:31.210 typically such devices give very good[br]results, but that's a disadvantage. Of 0:31:31.210,0:31:37.099 course, on the one hand side, it's[br]professional equipment that's quite 0:31:37.099,0:31:42.809 expensive, on the other hand, and you need[br]much higher volumes of the FUMIE nitric 0:31:42.809,0:31:50.559 acid. Typically, if you do it manually,[br]you would need five milliliters or 10 and 0:31:50.559,0:31:55.159 here you need much more, maybe 50[br]milliliters or even more. This one is a 0:31:55.159,0:31:58.880 sincere milling machine, which we would[br]also be using, for example, and 0:31:58.880,0:32:04.830 professional environment, and I think they[br]are a lock picking people here. I would 0:32:04.830,0:32:09.450 like to have something like this, too.[br]That's really nice machine, which can make 0:32:09.450,0:32:14.070 he programed milling. It has done not just[br]preprogrammed inside, but it can also 0:32:14.070,0:32:17.679 launch new packages. And the interesting[br]thing is that you can also use diamond 0:32:17.679,0:32:22.059 drills and thereby open ceramic packages.[br]Also, for example, from the back side, if 0:32:22.059,0:32:27.090 you want to get access to the chip side[br]for a special purpose. Nevertheless, this 0:32:27.090,0:32:32.599 equipment is very expensive, also an[br]operation. So this diamond dress cost very 0:32:32.599,0:32:44.009 have a high cost and last but not least,[br]very heavy. So it cannot be used in all 0:32:44.009,0:32:49.520 laboratories. This one here is a laser,[br]the capsule later laser the capsule that 0:32:49.520,0:32:54.379 is mainly laser scanner. And I think you[br]saw some of these on the assembly already 0:32:54.379,0:32:58.259 for cutting what are Styrofoam and so on.[br]And that's nearly the same. But it works 0:32:58.259,0:33:04.320 more on a on the microscopic level or[br]millimeter level. And so then hit by a 0:33:04.320,0:33:07.759 complete plastic package, for example, can[br]be scanned with a focused laser and laser 0:33:07.759,0:33:11.090 just evaporates the material. That's an[br]inch on a few more so that the reaction 0:33:11.090,0:33:15.249 products are purged. And so therefore,[br]that's really a nice way of opening 0:33:15.249,0:33:19.429 packages. Again, like for the machine that[br]are preprogrammed packages, but it can 0:33:19.429,0:33:23.820 also learn to use new packages.[br]Nevertheless, there are also disadvantages 0:33:23.820,0:33:29.259 of such methods. Again here, like Mockus[br]already set for the laser, you have a 0:33:29.259,0:33:33.149 thermal stress to the chip, which[br]sometimes can lead to breaking the chip, 0:33:33.149,0:33:38.809 which you don't want. And also, again, the[br]costs are quite high milling. And also 0:33:38.809,0:33:43.340 this laser encapsulation are typically not[br]used to completely open a package. It is 0:33:43.340,0:33:47.059 more used for generating a recess, which[br]is then further treated by chemical 0:33:47.059,0:33:49.419 etching. So this means you would only make[br]a recess and the plastic package, which is 0:33:49.419,0:33:53.129 nicely fitting the capsule as a chemical[br]to capture that. And then afterwards, this 0:33:53.129,0:33:57.799 fuming nitric acid, you would do the final[br]opening of the package either manually or 0:33:57.799,0:34:01.289 with an automatic version. So if the trip[br]is properly prepared and here, for 0:34:01.289,0:34:08.169 example, on the right, you can see a trip[br]which has opened with a professional, um, 0:34:08.169,0:34:14.889 a device, then you can have full access[br]first with a microscope. Of course, you 0:34:14.889,0:34:19.230 can see if there's a chip in the package.[br]You can have a look if there are some dye 0:34:19.230,0:34:21.849 markings which can lead you to a more[br]material literature, data sheets and so 0:34:21.849,0:34:26.659 on. Um, have a look inside what the[br]function may be and what this is used for 0:34:26.659,0:34:30.119 and the device which you are currently[br]investigating. But, uh, sometimes after 0:34:30.119,0:34:33.460 you have done that and the real fun[br]starts, which means preparation of an 0:34:33.460,0:34:37.849 attack or finding attack vectors and then[br]finally also at doing such attacks. So 0:34:37.849,0:34:40.579 attacks could be further reverse[br]engineering, for example, making a 0:34:40.579,0:34:43.819 complete preparation of the chip, grinding[br]away the different layers of it for, uh, 0:34:43.819,0:34:48.339 doing a complete reverse engineering. And[br]then if the package is opened, you can do 0:34:48.339,0:34:50.559 some attacks, which you normally won't do[br]or can't do with packages, um, with chips 0:34:50.559,0:34:54.679 and side, which are, for example, laser[br]attacks that you focus on the focus laser 0:34:54.679,0:35:00.079 on the chip to make some false or to[br]induce some wrong calculations inside. 0:35:00.079,0:35:05.240 There are many other devices which have[br]ultraviolet fuzes which can be erased, for 0:35:05.240,0:35:08.859 example, against code protection. One can[br]do permanent manipulations, for example, 0:35:08.859,0:35:13.330 by focus on beam or laser cutter, if[br]that's what all the chips, um, one can do. 0:35:13.330,0:35:16.050 Alpha radiation attacks because alpha[br]radiation also would not penetrate a 0:35:16.050,0:35:20.400 package, but, uh, they will penetrate the[br]silicon and then make faults, for example, 0:35:20.400,0:35:25.460 electromagnetic attacks by applying a[br]probe on the top of the chip or on the 0:35:25.460,0:35:27.890 backside. And, um, the one which I have[br]left out a photon emission. Such an 0:35:27.890,0:35:33.049 analysis. That's quite interesting. Um,[br]that's a way of looking at the chip, how 0:35:33.049,0:35:35.930 it generates infrared photons, while[br]calculating, for example, if a transistor 0:35:35.930,0:35:40.230 switches and photons are emitted. And[br]that's that's a method which we are 0:35:40.230,0:35:44.829 professionally using since 2001. But[br]recently I read in the press that also 0:35:44.829,0:35:49.130 some other people looking for this method,[br]uh, for example, the German one does not 0:35:49.130,0:35:54.069 wants to get such a device to, um, which[br]sounds quite, um. Yeah. Quite reasonable 0:35:54.069,0:35:57.410 to me because there are some smart catch[br]chips today available which are not 0:35:57.410,0:36:02.400 prepared against such kind of a text. And[br]also this may be a way of using this 0:36:02.400,0:36:06.390 photon emission, such an analysis for, um,[br]exploiting a backdoor which could be 0:36:06.390,0:36:10.320 induced by physically unclogging other[br]functions. If you are interested. We made 0:36:10.320,0:36:15.559 talk last year and we have also a small[br]chapter about it. But this would lead to 0:36:15.559,0:36:23.810 far in this environment here. So, um, if[br]you are interested in the topic itself 0:36:23.810,0:36:28.880 and, uh, want to have an overview, then we[br]would recommend this book that's, um, 0:36:28.880,0:36:34.240 available in German. But also there's an[br]English version of it which we have put 0:36:34.240,0:36:39.460 under the literature here. It's from a[br]Siemens failure analysis guy and the 0:36:39.460,0:36:42.099 contents of the package opening, but also[br]a chip preparation techniques. And there's 0:36:42.099,0:36:44.950 a nice presentation about using fuming[br]nitric acid for the capitulations from on 0:36:44.950,0:36:51.510 semiconductor in 2008. Um, if you use, um,[br]colorfully or Rosana sometimes called, um, 0:36:51.510,0:36:57.309 then there are two interesting projects.[br]One is from the cost of Belene. Um, it's 0:36:57.309,0:37:00.950 along with California, unfortunately is[br]only in Germany, in German. And then 0:37:00.950,0:37:07.020 there's also a project from the LEP which[br]is called As a Californian User, which is 0:37:07.020,0:37:11.960 an automated way of opening packages, was[br]kind of funny. And then finally, there's 0:37:11.960,0:37:16.079 also an interesting thing about laser chip[br]access, how to open chips with laser and 0:37:16.079,0:37:19.069 3D techniques. So these are only a few[br]points. Um, this book we have also an 0:37:19.069,0:37:24.569 assembly. So if you want to have a look[br]inside, then be invited to visit us today. 0:37:24.569,0:37:27.869 Finally, if you have a look inside chips[br]and sometimes, uh, interesting things open 0:37:27.869,0:37:32.300 up not only technology, not only attack[br]vectors, but sometimes you also see some 0:37:32.300,0:37:36.352 artwork. Sometimes today there's not much[br]place left because that's also cost, and 0:37:36.352,0:37:40.520 so therefore this year art is getting less[br]and less. But these are some examples 0:37:40.520,0:37:44.710 which we found sailboard and here in the[br]upper right corner, that citya arms of 0:37:44.710,0:37:47.800 Hamburg, which belongs to Chip from[br]Philips. All right. So that's not 0:37:47.800,0:37:55.540 complete. Our small presentation about[br]Chip opening. And now we have some some 0:37:55.540,0:38:01.309 minutes for questions, of course. 0:38:01.309,0:38:08.589 Herald: Wow, amazing. I see my shopping[br]list grow. So are there any questions, I 0:38:08.589,0:38:10.590 would say from from the Web? Are you OK?[br]Signal Angel: Indeed. OK, that's one 0:38:10.590,0:38:15.700 question from the Internet, and it's[br]concerning the left overs of the 0:38:15.700,0:38:21.609 chemicals. Um, do you have any hints about[br]how to get rid of them after you practice 0:38:21.609,0:38:25.540 in your private environment?[br]Peter: All right. So first of all, I would 0:38:25.540,0:38:30.029 recommend not to buy any chemicals that[br]you don't need, because that's all 0:38:30.029,0:38:36.930 environmental pollution which is generated[br]just in the moment they are produced. And 0:38:36.930,0:38:40.660 so, therefore, buy only the chemicals you[br]need, um, buy only the amounts of 0:38:40.660,0:38:43.940 chemicals that you need, I would[br]recommend. And then afterwards, there are 0:38:43.940,0:38:46.779 also ways of neutralizing these agents,[br]for example, fuming nitric acid can be 0:38:46.779,0:38:51.170 neutralized with baking soda, which also[br]we have on our list here. And so 0:38:51.170,0:38:53.410 therefore, I would have a look inside[br]Internet sources, for example, to see what 0:38:53.410,0:38:57.520 are the special ways of neutralizing each[br]agent. So for a private person, it's, I 0:38:57.520,0:39:09.880 would say nearly the same. Like for[br]industry or certainly industry, this 0:39:09.880,0:39:21.789 chemical are neutralized and then given[br]away to the appropriate institutions. 0:39:21.789,0:39:27.960 Sometimes you can just flush it away after[br]neutralizing it, but sometimes as a 0:39:27.960,0:39:32.640 result, you may be toxic and then you have[br]to give it to a special institution. 0:39:32.640,0:39:37.610 Herald: Question answered. Guess, um, any[br]more questions from from the web. OK, um, 0:39:37.610,0:39:42.130 I would say we do some load balancing. You[br]start first please. 0:39:42.130,0:39:47.020 Mic: Oh. Is there a way to actually verify[br]where our chips are identical. So if you 0:39:47.020,0:39:50.543 have two chips or whatever, they are the[br]same or generated using the same mask set? 0:39:50.543,0:39:51.770 Or any mechanical way to actually verify[br]that? 0:39:51.770,0:39:57.970 Peter: If these chips are identical. OK.[br]So if there would be a way, for example, 0:39:57.970,0:40:01.020 to make an X-ray, this would be, of[br]course, fine, because then you don't need 0:40:01.020,0:40:05.950 any preparation at all. So some years ago,[br]I would have recommended to ask your 0:40:05.950,0:40:11.400 dentist, for example, because he has an[br]X-ray. But normally X-rays are today not 0:40:11.400,0:40:15.650 used for other purposes purposes. They are[br]intended to. So therefore, X-ray would be, 0:40:15.650,0:40:18.080 of course, the best one to have a look[br]inside the chip. Um, if these are 0:40:18.080,0:40:21.589 smartcards, then sometimes infrared can[br]serve well, because also with infrared, 0:40:21.589,0:40:26.539 you can look through the smartcard itself[br]sometimes and then see the surrounding. 0:40:26.539,0:40:30.960 And also chips have typically[br]characteristic bond wires. So this means 0:40:30.960,0:40:35.029 that the alignment of bond wires. So where[br]are the pads, for example, differ also 0:40:35.029,0:40:40.280 from chip to chip. And finally, of course,[br]the marking, because typically a marking 0:40:40.280,0:40:44.529 is only valid for for one specific chip[br]and another chip, which would be in next 0:40:44.529,0:40:47.099 generation, for example, would also have a[br]different chip marking then. 0:40:47.099,0:40:51.680 Marcus: But anyhow, of course, so you can[br]distinguish whether this is the same 0:40:51.680,0:40:56.170 hardware or not very often today. Also,[br]the chips are equipped with some flash. 0:40:56.170,0:41:01.130 And later, if you open up one chip, you[br]can identify whether there's a nonvolatile 0:41:01.130,0:41:06.960 memory on the chip. And of course, you[br]cannot distinguish by the microscope 0:41:06.960,0:41:12.960 whether the same flash content is in there[br]or not. So it might be that in different 0:41:12.960,0:41:16.490 operating system or different programmers[br]running on such a microcontroller 0:41:16.490,0:41:23.630 containing some flash, even if this is the[br]same hardware. But at least, you know, OK, 0:41:23.630,0:41:29.319 this is the same hardware. And you're also[br]learning, as you have done on a first 0:41:29.319,0:41:35.460 chip, you can also use on the same ship.[br]Herald: Question answered? All right, 0:41:35.460,0:41:38.329 let's go.[br]Mic: So have you ever opened up a package 0:41:38.329,0:41:40.869 just to find you've been hit by a[br]counterfeit part? 0:41:40.869,0:41:45.839 Peter: Personally, not so. I know that are[br]many counterfeits, especially from from 0:41:45.839,0:41:49.480 Asia Pacific Range. And sometimes it's[br]quite interesting. I've seen such devices. 0:41:49.480,0:41:53.109 I did not open them by myself, but[br]sometimes that's a totally different chip. 0:41:53.109,0:41:58.740 And. So it does not even match the type of[br]functionality which what you would expect, 0:41:58.740,0:42:03.020 for example, instead of microcontrollers[br]as a 74 something logic chip inside, which 0:42:03.020,0:42:07.079 would not work at all.[br]Marcus: But again, here also, if you open 0:42:07.079,0:42:11.600 up the chip package, you can see the dye[br]marking and have no clue about the chip 0:42:11.600,0:42:16.190 itself and also about the functionality,[br]because the logical chip, uh, 74 series, 0:42:16.190,0:42:20.220 it's much less complexity and so quite[br]clearly visible in the microscope compared 0:42:20.220,0:42:26.500 to a microcontroller or something. So it's[br]quite easy to identify whether the 0:42:26.500,0:42:32.480 printing on the package is correct or[br]whether this is just a fake chip. 0:42:32.480,0:42:36.549 Mic: Well, that's not clear. But you know[br]what? After all. 0:42:36.549,0:42:40.390 Herald: Question answered? I guess. Yes,[br]please go. Go on. 0:42:40.390,0:42:46.150 Mic: So you said you can generally look at[br]chips using just optical microscopes, what 0:42:46.150,0:42:47.930 kind of magnification we can need for[br]different types of chips? 0:42:47.930,0:42:51.160 Peter: OK, so typically for a stereo[br]microscope, for preparation, you would 0:42:51.160,0:42:57.070 need only some five, four or twenty four[br]to magnification, but usually for looking 0:42:57.070,0:43:02.369 optically at chips, you would need a 100[br]fold to I would say five hundred fold 0:43:02.369,0:43:07.960 magnification. That's of course there's a[br]limit because of the technology gets 0:43:07.960,0:43:12.100 smaller than the wavelengths of light and[br]then you've got a problem. And so 0:43:12.100,0:43:14.369 therefore we also have recommended here[br]for amateurs or for beginners in this 0:43:14.369,0:43:18.550 topic to use all the chips, because you[br]have, for example, one point two 0:43:18.550,0:43:23.750 micrometer technology, which is far away[br]from from the wavelengths of the light. 0:43:23.750,0:43:31.500 But a few today would have, for example,[br]90 nanometer or 65 nanometers of the CPUs, 0:43:31.500,0:43:35.420 even 22 nanometers. So that's 20, 20 times[br]smaller than the wavelengths of light. And 0:43:35.420,0:43:40.070 then you don't see anything at all and[br]just colors. 0:43:40.070,0:43:43.190 Herald: Question answered?[br]Marcus: And please be invited to our 0:43:43.190,0:43:48.650 assembly later on because we have got a[br]microscope and some sample chips with us 0:43:48.650,0:43:55.089 so you can make some own experience in[br]there and watch the silicon and see what 0:43:55.089,0:43:59.269 kind of such you can see so please be[br]invited. 0:43:59.269,0:44:04.380 Herald: I'm totally sorry. I totally[br]overlooked Microphone four. Please, please 0:44:04.380,0:44:09.029 go ahead.[br]Mic: So if you have just a limited amount 0:44:09.029,0:44:12.279 of chips and want to maybe reuse them[br]again like we want them. Um.. 0:44:12.279,0:44:14.869 Herald: Could you please repeat the[br]question with a microphone, because then 0:44:14.869,0:44:17.240 it's recorded.[br]Mic: Yeah, so if you have, like, only a 0:44:17.240,0:44:20.410 couple of chips and want to reuse them[br]again and dissolve epoxy, like what or 0:44:20.410,0:44:26.799 what method would you recommend to use?[br]Peter: All right. So if you want to use 0:44:26.799,0:44:34.210 them, um, after preparing, then it's very[br]important that there are no acid residues 0:44:34.210,0:44:41.430 left because we sometimes see, for[br]example, if you prepare a chip with fuming 0:44:41.430,0:44:46.750 nitric acid and there's just a small[br]amount of acid which is left, then after 0:44:46.750,0:44:51.540 one week or two week, the chips[br]deteriorate. And so this means that they 0:44:51.540,0:44:53.450 have to be and the acid has to be[br]neutralized very good. Rinsed with acetone 0:44:53.450,0:45:00.200 and then afterwards dry it carefully. So I[br]would recommend to to store them also 0:45:00.200,0:45:04.329 maybe, um, under dry conditions, but if[br]you are interesting. And afterwards you 0:45:04.329,0:45:07.920 could also contact us because we have some[br]methods also for conserving chips. 0:45:07.920,0:45:10.519 Herald: Question answered right from the[br]Internet, please. 0:45:10.519,0:45:14.839 Signal Angel: Yeah, there's another one.[br]Um, it's about have you noticed any 0:45:14.839,0:45:15.839 manufacturers implementing[br]countermeasures, new guards to decaping 0:45:15.839,0:45:19.470 the chips?[br]Marcus: So yes, indeed, there are some, 0:45:19.470,0:45:25.700 uh, countermeasures at advertised by, uh,[br]manufacturers who say, yes, we have a kind 0:45:25.700,0:45:30.440 of secure package. Uh, one of those secure[br]packages also shown in the presentation 0:45:30.440,0:45:33.779 where, for example, uh, special coverage[br]on top has been placed. Uh, but anyhow, 0:45:33.779,0:45:37.230 also there we have, uh, displayed some,[br]uh, methods in order to open up those 0:45:37.230,0:45:42.609 kinds of packages. So, uh, it's always a[br]trade off how much, uh, security you can 0:45:42.609,0:45:48.720 expect from the chip package. And so, in[br]my opinion, I think the package there are 0:45:48.720,0:45:52.880 so many, uh, methods to remove a package.[br]It could not be a completely secure 0:45:52.880,0:45:57.030 package just by the package itself. So if[br]you need to have some secrets inside a 0:45:57.030,0:46:00.940 chip, then really the chip hardware should[br]be secured and therefore protected against 0:46:00.940,0:46:07.059 spying out of those data. And this will be[br]more on logical ways, for example, using 0:46:07.059,0:46:11.289 encryption instead of using some, uh,[br]material in the package. 0:46:11.289,0:46:16.690 Peter: So there should be no trade off[br]between buying, uh, insecure or less 0:46:16.690,0:46:22.260 secure chip and then adding a package. We[br]think that the chip itself has to be 0:46:22.260,0:46:28.619 secure or secure enough, I should say, and[br]it cannot be afterwards put the security 0:46:28.619,0:46:37.280 cannot be put afterwards around the chip.[br]So that's not the way of, uh, of clean, 0:46:37.280,0:46:42.490 uh, engineering.[br]Herald: Right. Um, we have time for a last 0:46:42.490,0:46:58.490 question. If you could please keep short[br]and you guys also please go ahead. 0:46:58.490,0:47:15.330 Mic: I have a question about, uh, legal[br]problems. When you publish photos of the 0:47:15.330,0:47:26.589 internal parts, and maybe sharing in a[br]public database to to make education 0:47:26.589,0:47:37.570 better or I don't know.[br]Peter: Um, that's if you make photos of 0:47:37.570,0:47:44.490 chips themselves which you have prepared[br]by yourselves, then I think it should not 0:47:44.490,0:48:09.079 be critical. So we have also here are some[br]pictures which we made sometimes of our 0:48:09.079,0:48:17.900 own chips, sometimes of other chips. But[br]this does not contain any trade secrets, 0:48:17.900,0:48:41.130 for example. But of course, that's a[br]difficult question, especially if it goes, 0:48:41.130,0:48:50.810 for example, to pictures which contain[br]material where you see, for example code, 0:48:50.810,0:48:57.839 a ROM picture if you would publish a[br]picture of a ROM and then it could be that 0:48:57.839,0:49:12.299 this ROM contains code and then you would[br]publish this code. So it's very difficult 0:49:12.299,0:49:25.299 to tell which is which is right and which[br]is wrong. But, um, usually we don't think 0:49:25.299,0:49:36.579 that that just took pictures are critical.[br]Marcus: And it really depends also on the 0:49:36.579,0:49:57.440 resolution. If you have a complete chip[br]and a overal resolutions that you cannot 0:49:57.440,0:50:14.170 identify single lines and cannot use this[br]as a schematic to include such a chip, 0:50:14.170,0:51:35.230 then it's something different compared to[br]a high resolution picture where you can 0:51:35.230,0:52:26.570 draw a complete schematics in there, but[br]we can also talk later on in the assembly 0:52:26.570,0:52:51.039 more on this topic. And also I see some[br]further question, but I think we are 0:52:51.039,0:53:44.180 running out of time so we can do this[br]later on. 0:53:44.180,0:54:38.359 Herald: Yeah, great. Thank you very much.[br]Thank you for your questions. 0:54:38.359,0:54:42.539 applause 0:54:42.539,0:55:20.499 The guys with the open chips go to the[br]assembly and ask them if you have any more 0:55:20.499,1:01:41.631 questions, please. OK, thank you. 1:01:41.631,1:01:56.000 Subtitles created by c3subtitles.de[br]in the year 2021. Join, and help us!