Return to Video

Peter Laackmann, Marcus Janke: Uncaging Microchips

  • 0:10 - 0:19
    Marcus: Thank you for the kind
    introduction. Welcome to our talk about
  • 0:19 - 0:24
    engaging microchips. So the background in
    here is twofold. On the one hand side, we
  • 0:24 - 0:29
    would like to encourage you also to make
    some own experiments and to see what is
  • 0:29 - 0:38
    inside a semiconductor device that means
    what is inside a microchip. And so the
  • 0:38 - 0:44
    goal is that you also have some knowledge
    how to open up a microchip and how to get
  • 0:44 - 0:48
    direct access to the silicon. On the other
    hand, also, very often there's a rumor
  • 0:48 - 0:50
    that chip is highly secured because the
    silicon is inside of plastic coverage. And
  • 0:50 - 0:57
    if a plastic package is really high
    security, we can also explain today,
  • 0:57 - 1:00
    because very often even this amateur
    equipment, it's possible to open up chips
  • 1:00 - 1:04
    and to get direct access to the silicon.
    We are not only focusing on microchips,
  • 1:04 - 1:07
    but we are also focusing on more complex
    systems, how to open up the system to get
  • 1:07 - 1:11
    access to the silicon in our background.
    We have started more than 25 years ago
  • 1:11 - 1:15
    with analyzing the first telephone cards.
    And so starting off with some experiments
  • 1:15 - 1:22
    at the Commodore 64, as well as working
    with the first telephone card, it was our
  • 1:22 - 1:26
    major interest to find out what is the
    functionality of this telephone card and
  • 1:26 - 1:31
    also what is inside. And of course, for
    identifying what's inside. It was also our
  • 1:31 - 1:35
    target to open up stores, plastic cards
    and to get access to the silicon chip
  • 1:35 - 1:39
    inside the telephone card. Nowadays, we
    are also very often open up chips in order
  • 1:39 - 1:46
    to make some analysis or in order to apply
    some high tech methods, for example, for
  • 1:46 - 1:50
    putting some over particular variation on
    the top of the surface, also to apply some
  • 1:50 - 1:53
    laser. It's, of course, necessary to have
    direct access to the silicon itself. And
  • 1:53 - 1:58
    therefore, also today we are utilizing a
    lot of professional equipment in order to
  • 1:58 - 2:00
    observe chips. So today we would like to
    give a short overview about the different
  • 2:00 - 2:04
    techniques and methods, how to open up
    different kinds of chips, and also to
  • 2:04 - 2:08
    encourage you, because it is very
    interesting also to open microchip
  • 2:08 - 2:12
    packages in order to get further analysis.
    First of all, sometimes it's not quite
  • 2:12 - 2:14
    clear whether this is really a package
    which contains a chip or whether there's
  • 2:14 - 2:19
    only a kind of label, as you can see, in
    the lower picture. So in the lower
  • 2:19 - 2:23
    picture, it might be only a barcode labor,
    but perhaps also an RFID chip might be in
  • 2:23 - 2:28
    there. And therefore, a first analysis.
    It's the question, a inside the package.
  • 2:28 - 2:30
    And then, of course, also there's the
    question, what is it about the chip
  • 2:30 - 2:36
    functionality itself? That means how many
    functions are implemented in such a chip?
  • 2:36 - 2:41
    This is only a memory. Ship ourselves for
    some logic inside there. And what kind of
  • 2:41 - 2:48
    logic is implemented here? And by the way,
    on the most of the chips are also so-
  • 2:48 - 2:53
    called time markings. That means some
    small numbers and these identified as the
  • 2:53 - 2:56
    silicon itself and these same markings as
    possible to make some research and some,
  • 2:56 - 2:59
    um, findings from literature, as well as
    also from tools in order to get more
  • 2:59 - 3:00
    information about the chip itself. And
    finally, watching on the silicon itself
  • 3:00 - 3:01
    indicates also, if this is a more modern
    chip, that means smaller technology or
  • 3:01 - 3:08
    whether this is an old fashioned chip. And
    so you cannot expect so much functionality
  • 3:08 - 3:12
    or security funds the chip itself. So from
    this perspective, these are some
  • 3:12 - 3:15
    motivation which also may encourage you to
    open up some microchip packages and to
  • 3:15 - 3:20
    find out what's really inside there. We
    have fought also three examples, um, to
  • 3:20 - 3:24
    show what is a potential finding out of
    this. For example, it's well known that
  • 3:24 - 3:30
    some goods are tracked down with RFID
    chips. And so recently we also got a t
  • 3:30 - 3:36
    shirt with a dedicated label inside here.
    And it was not clear whether this label is
  • 3:36 - 3:41
    just about label or whether there are some
    more, um, techniques inside the specialty
  • 3:41 - 3:49
    and RFID chip. So as you can see in the
    second picture, it's quite easy to
  • 3:49 - 3:52
    identify if this is more than a barcode
    label, because simply with a torch limb,
  • 3:52 - 3:57
    it's possible to eliminate those from the
    back side. And so the flash indicates a.
  • 3:57 - 4:03
    There's something more than a bar code
    inside there and indeed is some structure
  • 4:03 - 4:11
    inside. We have put this into a glass of
    acetone and after a short while is the
  • 4:11 - 4:15
    label has to eliminate it. And so we can
    got we got the final picture with the
  • 4:15 - 4:21
    antenna inside here. And in the middle of
    the antenna is a small, dark spot. And
  • 4:21 - 4:26
    this is a chip. So it was clearly from the
    antenna size, such as communicating in UHF
  • 4:26 - 4:34
    frequency range and also the small dot.
    It's an hour edition. So now it's prepared
  • 4:34 - 4:42
    for further analysis with a microscope. So
    you see, it might be very simple to get
  • 4:42 - 4:45
    some more information out here. Another
    example brings us back where we back to
  • 4:45 - 4:48
    the history. And as I mentioned before, we
    have started this investigation on
  • 4:48 - 4:55
    telephone cards. And, of course, not only
    the telephone calls, but also the
  • 4:55 - 4:58
    telephone card system has been of high
    interest for us. And so we were in lucky
  • 4:58 - 5:03
    situations that we found some, uh, printed
    circuit boards from Cox Telephone where we
  • 5:03 - 5:08
    only got access to those because those car
    telephones has been burned down
  • 5:08 - 5:13
    completely. So it was a huge fire. And so
    inside is this area and so is the, um, uh,
  • 5:13 - 5:17
    telephone also get burned? Anyhow, we
    managed to get those printed circuit
  • 5:17 - 5:23
    board. And in the second picture, you can
    also see that the X-ray picture of the
  • 5:23 - 5:30
    printed circuit board, uh, clearly shows
    that all the borrowings are still OK. So
  • 5:30 - 5:36
    it was possible for us to draw a dramatic,
    uh, schematic and, uh, to see how the
  • 5:36 - 5:40
    different pins of this, uh, printed
    circuit boards are connected. Well,
  • 5:40 - 5:45
    anyhow, it was not clear what are the
    different shapes, because due to the heat,
  • 5:45 - 5:50
    simply the marking on the chip itself has
    been vanished. So from this perspective,
  • 5:50 - 5:53
    we have used some, uh, capitulation method
    in order to get the singer chips, the
  • 5:53 - 5:57
    silicone chips out of those devices. And
    as you can see in the lower picture, then,
  • 5:57 - 6:01
    uh, with some, uh, microscopy work, we
    were able to find out what is each single
  • 6:01 - 6:03
    chip. And so, uh, identifying the
    different names of those chips and also
  • 6:03 - 6:06
    combining this was a schematic. It was
    possible for us to, uh, resolve the main
  • 6:06 - 6:11
    function in those days from the cartoon
    itself. And this gives us a clear clue in
  • 6:11 - 6:15
    what direction the telephone has worked in
    those days. Yeah. And finally, also, there
  • 6:15 - 6:19
    was something in the beginning of 2000
    there was a price competition. And is this
  • 6:19 - 6:24
    price competition, um, mean such as the
    small sticker, which has to be applied to
  • 6:24 - 6:28
    the, uh, TV set. And then in this
    perspective, uh, it was also that a lot of
  • 6:28 - 6:38
    rumors, whether this kind of spacechip
    inside Syria and you see on the lower side
  • 6:38 - 6:43
    says, uh, some, um, comment from the
    Internet at those days that there should
  • 6:43 - 6:48
    be an electronic chip inside Syria. And
    this electronics should not only record
  • 6:48 - 6:54
    what you are watching on TV, but also, um,
    make some sound recording in order to find
  • 6:54 - 7:01
    out how many people are in the room
    watching this show and so on and so on.
  • 7:01 - 7:08
    But anyhow, um, we clearly thought, well,
    this is just a rumor. And so, of course,
  • 7:08 - 7:14
    we use our, uh, techniques in order to
    open up this device and also to find out,
  • 7:14 - 7:24
    uh, what's inside there. And in the end of
    the day, it was clearly that this was only
  • 7:24 - 7:30
    a dot mask and below officers, there were
    some foom which is photosensitive. And
  • 7:30 - 7:37
    when you watch, uh, special TV shows and
    this film has been illuminated and
  • 7:37 - 7:41
    therefore it was clearly identifiable
    whether this show has been seen or not. So
  • 7:41 - 7:49
    it was clear for us that we could identify
    there's no spacechip inside and this was
  • 7:49 - 7:52
    only a rumor. So also, therefore, the
    preparation techniques are quite useful
  • 7:52 - 7:55
    and helps to understand what's going in
    inside Syria.
  • 7:55 - 8:00
    Peter: All right. Some some somewhat to
    the chips and the packages. So there are
  • 8:00 - 8:03
    many thousands of different packages for
    troops today. And sometimes the
  • 8:03 - 8:05
    functionality of the chip that just inside
    will directly determine the way, such as
  • 8:05 - 8:10
    packaged. And this is the case for these
    troops here especially. And if you look on
  • 8:10 - 8:14
    the left, that's an interesting thing. A
    fingerprint sensor, which is another from.
  • 8:14 - 8:21
    Even use today with his fingerprints, and
    this is a specialty that the chip itself
  • 8:21 - 8:26
    can be directly touched with the finger.
    Normally you would avoid such a situation,
  • 8:26 - 8:30
    but here you have the direct silicone
    accessible and there's only a frame which
  • 8:30 - 8:35
    is covering the surrounding of the chip to
    make it mountable and the device itself.
  • 8:35 - 8:40
    Then we have a webcam webcam shown here,
    which is just covered by a thin plate of
  • 8:40 - 8:44
    glass. Of course, the picture or the
    optical radiation has to reach the chip
  • 8:44 - 8:48
    and therefore the same is true for your
    microscope. You can directly observe such
  • 8:48 - 8:55
    chips without further preparation. Um,
    yeah, I think the older one of you know,
  • 8:55 - 8:59
    this is prom type of memory, old fashioned
    thing, but sometimes it's still seen
  • 8:59 - 9:03
    today. You can electrically write such an
    issue from memory, but if you want to
  • 9:03 - 9:07
    erase it, you have to put it under
    ultraviolet light to make the erasing
  • 9:07 - 9:14
    function. And so this means also this
    package has a window in this case that's
  • 9:14 - 9:22
    made of silica because this uses to be UV
    transparent. And again, you can have a
  • 9:22 - 9:26
    look inside without any preparation, which
    sometimes quite interesting. And then on
  • 9:26 - 9:30
    the right, we have an amplifier chip shown
    here and which is an instrumentation
  • 9:30 - 9:34
    amplifier, and therefore it should be
    sealed from the environment, but also from
  • 9:34 - 9:38
    electromagnetic radiation. And this is
    done here in this case by a ceramic
  • 9:38 - 9:45
    package. And this package has a metal that
    over it. And again, here, it's very easy
  • 9:45 - 9:51
    to open this package. We will see later on
    and was just using a blade. So all of
  • 9:51 - 9:57
    these four packages are quite interesting
    for an amateur. You don't need any
  • 9:57 - 10:04
    equipment at all to have a look inside.
    But as we said, from open to amateur hour,
  • 10:04 - 10:08
    some more difficult shops to open. And
    here on the left side, that's a typical
  • 10:08 - 10:10
    chip which you will encounter and millions
    today and all consumer goods. It's a
  • 10:10 - 10:17
    plastic package here. We have an order,
    one which is a plastic package. But you
  • 10:17 - 10:21
    also know the surface mounted devices and
    so on. So this plastic packages are quite
  • 10:21 - 10:23
    robust against environment, but also they
    are robust against chemicals. And this
  • 10:23 - 10:26
    means you need quite harsh conditions to
    open them and the chemical weigh. Are you
  • 10:26 - 10:31
    when it laser, which we will see later on,
    epoxy resin. And the same is true for the
  • 10:31 - 10:35
    laptop package, which is a very low cost
    kind of package, just as it is put on the
  • 10:35 - 10:38
    circuit board, then it's connected point
    wires to the circuit board itself and then
  • 10:38 - 10:44
    afterwards just a drop of epoxy resin as
    part of it. And you see, it's not a
  • 10:44 - 10:51
    rectangular form which should have. It's
    more just a drop which put on top of
  • 10:51 - 10:53
    clocktower package is also seen here. And
    the third picture, which is the smartcard
  • 10:53 - 10:56
    package, the typical one, if you would
    turn this picture around, then you would
  • 10:56 - 10:58
    see on the other side that there are the
    typical Golden Smartcard contacts. And
  • 10:58 - 11:01
    from the back side, it's a picture like
    this. You have the chip and the chip is
  • 11:01 - 11:07
    connected, was bond wires to the
    connection points and then afterwards to
  • 11:07 - 11:14
    hold it in place and also to make it
    resistant from the environmental
  • 11:14 - 11:19
    conditions. It's also protected with a
    blocked off package. So it just epoxy
  • 11:19 - 11:25
    resin is poured over it. And then finally
    on the right is something which some
  • 11:25 - 11:26
    people call a security package. You see
    that matterson hyphenation. Not only is it
  • 11:26 - 11:30
    dark so that you can see directly through
    the through to the chip, but there's also
  • 11:30 - 11:35
    there can be some special Latisse, for
    example, in this case, there's an
  • 11:35 - 11:38
    additional layer which is put on the chip,
    which is also made of silicon itself. But
  • 11:38 - 11:43
    yeah, as we showed here, it's not I would
    say it's not really security. And many
  • 11:43 - 11:46
    cases of this package, just because of the
    security, does not start in the chip
  • 11:46 - 11:51
    itself. And I would say then it's a little
    bit too late. All right. So what can you
  • 11:51 - 11:57
    see if you look inside such chips and we
    have chosen some examples where you don't
  • 11:57 - 12:02
    need any preparation at all. Here you can
    see some memories for beginning. It's
  • 12:02 - 12:05
    quite interesting to have a look at all
    the chips which are sometimes available to
  • 12:05 - 12:09
    store. And that's because simple fact. And
    the older days, the technologies were not
  • 12:09 - 12:15
    so small as today. So this means you can
    see the structures. What's your barai or
  • 12:15 - 12:18
    maybe you need your grandfather's
    magnifying glass, maybe, but you don't
  • 12:18 - 12:22
    need a high definition microscope. And so
    here on the far left, that's a chip from
  • 12:22 - 12:26
    nineteen seventy six, very old one very
    small memory. And you can directly see
  • 12:26 - 12:29
    with your eye all the structures inside
    just through the window without opening it
  • 12:29 - 12:31
    at all. And then if we proceed in time
    also to a vintage chip from nineteen
  • 12:31 - 12:35
    eighty eight, one megabit it from there.
    See already it's more like a gray mass,
  • 12:35 - 12:40
    that's a memory cells and you definitely
    would need a microscope to have a further
  • 12:40 - 12:42
    look inside how such a memory is built and
    to analyze it. And then on the right.
  • 12:42 - 12:45
    That's also an interesting example of a
    memory. But this memory has some access,
  • 12:45 - 12:47
    right. Tied to it, because that's the
    telephone chip card. And here you have a
  • 12:47 - 12:51
    very small memory of only 88 bits. But the
    rest is controlled logic so that only the
  • 12:51 - 12:54
    people who are or should be allowed to
    load it and to erase it have this access
  • 12:54 - 12:57
    rights given to them. And if we look at
    the little microcontroller units and they
  • 12:57 - 13:01
    are quite more interesting than just a
    memory. And here again, we have four
  • 13:01 - 13:05
    different chips brought to you. Two of
    those also have windows. You don't need
  • 13:05 - 13:11
    any preparation at all. And the one on the
    left is, again, a chip from nineteen
  • 13:11 - 13:15
    seventy six, very old. One can see
    directly all the different structures like
  • 13:15 - 13:20
    Rom Ram that you prompt part and also the
    logic part which contains the CPU and also
  • 13:20 - 13:24
    some analog devices which are needed for
    the functionality of the chip. I think
  • 13:24 - 13:27
    that pick 16, the second picture, you
    know, and the flash version, which is very
  • 13:27 - 13:33
    common today, you just can program it and
    erase it again and a normal device. But in
  • 13:33 - 13:39
    1988, these types of the control that were
    made was EPROM. So this means you could
  • 13:39 - 13:45
    program it. And then if you want to erase
    it again for reprograming, you have to put
  • 13:45 - 13:50
    it under ultraviolet lamp for five
    minutes. So therefore, there are some
  • 13:50 - 13:55
    older versions of the controller. But what
    you can see is that the technology is
  • 13:55 - 14:00
    smaller and that the chip is just a very
    high density and comparison to the chip,
  • 14:00 - 14:05
    which is 12 years older. Interestingly,
    the smart all the smart card controls look
  • 14:05 - 14:10
    quite the same, like these older devices.
    And they also have from RAM you prom are
  • 14:10 - 14:14
    normally prom. So electrical eraser, a
    programable rom. And so therefore the
  • 14:14 - 14:20
    smart card units, even those of in the 90s
    look like the same, like the older and
  • 14:20 - 14:24
    serious. And finally, just for comparison,
    we also brought a sixty eight case. If you
  • 14:24 - 14:31
    this has only cash but no nonvolatile
    memory and was used in some old home
  • 14:31 - 14:37
    computers for example, but also in
    instrumentation technology. So what do you
  • 14:37 - 14:42
    need if you want to start with preparing
    microchips. Just to have a look, if it's
  • 14:42 - 14:50
    interesting for you to have a glimpse
    inside. So what you definitely need is a
  • 14:50 - 14:55
    simple microscope. And we showed there a
    student version that's about 300 euros.
  • 14:55 - 15:00
    But they are also quite interesting USB
    microscopes today and which come ready for
  • 15:00 - 15:04
    use for about 150 euros. So that's quite
    good tools. You need definitely some
  • 15:04 - 15:08
    mechanical tools like scalpels, tweezers,
    which we have here sometimes some sort of
  • 15:08 - 15:12
    dentist tools, which also would serve
    quite well, an ultrasonic cleaner. It's a
  • 15:12 - 15:17
    very good thing to have because this is
    really nice for package preparation,
  • 15:17 - 15:22
    cleaning, but also removing particles and
    also of the chip is prepared and ready.
  • 15:22 - 15:26
    Then you can remove all remaining residues
    and particles from it. And finally, there
  • 15:26 - 15:29
    are three solvents which you need for
    beginners, which is alcohol, ethanol and
  • 15:29 - 15:34
    acetone and also benzene. These are three
    solvents from non polla to polla type. And
  • 15:34 - 15:38
    with these three solvents, you can open a
    lot of different packages. Then for
  • 15:38 - 15:44
    upgrading such equipment, it's quite
    interesting to have a 3-D view. So was a
  • 15:44 - 15:46
    stereo microscope. You can make
    preparation with both your eyes. You have
  • 15:46 - 15:49
    a 3-D vision and you can directly see what
    you are doing, which is sometimes quite
  • 15:49 - 15:54
    difficult. If you have on your monocular
    side, then if you want to share your
  • 15:54 - 15:56
    results, a microscope camera could serve
    your well, which is available for about
  • 15:56 - 16:01
    300 euros. But there are also some DIY
    versions, for example, with no cameras
  • 16:01 - 16:05
    which are adapted to the microscope
    itself. Some further chemicals can be
  • 16:05 - 16:09
    needed, which I will also show you later
    on the table, which are not without
  • 16:09 - 16:15
    danger, I would say, and therefore also
    typically a lab coat and some protective
  • 16:15 - 16:22
    wear would be used. So now we are in a
    moment we will come to a different details
  • 16:22 - 16:28
    of how to open a package and and the steps
    itself. And this will be sorted from
  • 16:28 - 16:31
    physical opening statements, the methods
    or mechanical methods over to chemical
  • 16:31 - 16:35
    methods for you directly open. So device
    with chemical means. But there's also a
  • 16:35 - 16:36
    mixture of both. And therefore, I would
    like to hand over to Marcus.
  • 16:36 - 16:39
    Marcus: Yes, thank you. Let's go to the
    workbench and open some packages. So
  • 16:39 - 16:41
    beginning, as Peter mentioned, with the
    physical ones. And the first one is quite
  • 16:41 - 16:45
    easy. You just need advice. And as you
    puts a chip inside vis a with the lower
  • 16:45 - 16:50
    part of the I see as depicted in the first
    picture and then you just put some more
  • 16:50 - 16:55
    forces to the I see. Pictures save and
    during the time device will be smaller and
  • 16:55 - 17:01
    smaller, the package will break up and the
    upper part lift up. So as visible in the
  • 17:01 - 17:04
    third picture, you can use a simple
    screwdriver to remove the upper limit. And
  • 17:04 - 17:08
    then finally, in the last picture, it's
    visible that the bare silicon chip is
  • 17:08 - 17:11
    visible for your further analysis, also
    connected to the lead frame. So the frame
  • 17:11 - 17:13
    which connects to the outer pins and to
    the outer communication. So this is a
  • 17:13 - 17:18
    quite simple method. And indeed, this is
    the first method we have also used in the
  • 17:18 - 17:21
    example of the copper telephone I have
    explained earlier. So it was quite easy to
  • 17:21 - 17:27
    break up those chips in order to get the
    silicon parts out of the ICS and then
  • 17:27 - 17:35
    analyzing them with a microscope, even if
    the package will be a little bit more
  • 17:35 - 17:42
    hardened. For example, a ceramic housing
    like use in eponyms, then it's also a good
  • 17:42 - 17:49
    idea to have fixes and device and just to
    replace a screwdriver on the top part of
  • 17:49 - 17:59
    the see, and there's a small bump on the
    back of the screwdriver. The upper limit
  • 17:59 - 18:02
    will be removed. And as you can see in the
    chart picture directly, the access to the
  • 18:02 - 18:06
    chip is possible. So indeed, I think these
    pictures clearly identify that this must
  • 18:06 - 18:12
    be not high, sophisticated techniques or
    some sensors, sometimes really a normal
  • 18:12 - 18:16
    workbenches sufficient to get access to
    very easy. It's in the case if there's a
  • 18:16 - 18:22
    special package, as Peter has explained,
    with such a metal lid on top of this,
  • 18:22 - 18:25
    because this method to it is sold out on
    the academic housing. And typically you
  • 18:25 - 18:31
    can think about where grindings as a way
    or try to sold out or something like. But
  • 18:31 - 18:32
    there's a very easy method to open up
    those kinds of packages. You just use a
  • 18:32 - 18:37
    blade as visible in the second picture
    and, um, use a hammer for a small store.
  • 18:37 - 18:41
    And then this blade drives and is this
    metal dirt and you can simply lift off
  • 18:41 - 18:44
    this metal without any further, um,
    effort. So it's just, uh, two seconds, uh,
  • 18:44 - 18:48
    work to open up those kinds of packages.
    And even those blades are quite easy to
  • 18:48 - 18:53
    access because you can see in the lower
    pictures that they are sold also in
  • 18:53 - 18:58
    discounters for, uh, cleaners of Deskovic.
    So these blades are easy to use just with
  • 18:58 - 19:08
    the hammer. You can drive them below the
    lid. And so this opens. So you see
  • 19:08 - 19:11
    physical mechanisms can be very easy. Now,
    as also mentioned before, our first topic
  • 19:11 - 19:14
    has been to, uh, check what's inside a
    telephone card. And, of course. Such a
  • 19:14 - 19:16
    physical preparation, it's more
    complicated on a small plastic card, and
  • 19:16 - 19:20
    therefore it more goes into the direction
    of physical chemical reaction on source
  • 19:20 - 19:27
    cards. And you can see here in this hall
    of pictures, we have just played such a
  • 19:27 - 19:33
    smart card in it's. And after five
    minutes, as was a in the second picture,
  • 19:33 - 19:38
    the plastic of the card absorbed some
    acetone and therefore swails. After 15
  • 19:38 - 19:42
    minutes, you can just wait for those
    minutes. Then the structure is fully
  • 19:42 - 19:47
    destroyed. And so it's quite easy to
    remove the remaining plastic parts as
  • 19:47 - 19:54
    visible on the fourth picture in the
    apple. So, again, just by waiting about 15
  • 19:54 - 20:01
    minutes in, etc. on the smart card is um.
    Yeah, destroyed. And so, um, as visible in
  • 20:01 - 20:06
    the lower picture, all it's possible to
    remove the antenna and censorchip itself.
  • 20:06 - 20:13
    And I think the result and the last
    picture on the law, uh oh it's quite
  • 20:13 - 20:16
    impressive. It's a complete antenna,
    including the chip has been resolved out
  • 20:16 - 20:35
    of this, uh, plastic card. And so, um, it
    was quite easy to analyze the antenna and
  • 20:35 - 20:41
    the size and how this is implemented in
    here. Anyhow, you may recognize that the
  • 20:41 - 20:46
    chip is still covered by, uh, uh, a
    laptop. That means a small piece of, uh,
  • 20:46 - 20:56
    epoxy on top of this. And so it's a
    question how to remove this here. It's
  • 20:56 - 21:01
    possible to use, for example, a laser
    with, uh, um, infrared laser, especially
  • 21:01 - 21:05
    for about Servais flying of 10000
    nanometers. Um, it's quite useful to open
  • 21:05 - 21:10
    up those kinds of pictures because the
    silicon itself is transparent for such an
  • 21:10 - 21:12
    infrared radiation. So the chip itself
    would be not directly affected by the
  • 21:12 - 21:16
    infrared radiation, but all the energy
    will be absorbed by the package itself. So
  • 21:16 - 21:18
    it's just a trauma to, um, destruction of
    the package as visible in the lower
  • 21:18 - 21:22
    picture. And especially also this is quite
    useful to open up so-called secure
  • 21:22 - 21:25
    pictures, as Peter has explained. So even
    those kinds of packages, uh, are just
  • 21:25 - 21:32
    applied with a laser and, um, it's opened
    up so that all the, um, silicon can be
  • 21:32 - 21:36
    directly accessed. Anyhow, this, uh, may
    also be some risk. It appears on the one
  • 21:36 - 21:42
    hand side, the risk that the chips to get
    damage due to the fact that is, uh,
  • 21:42 - 21:47
    package components are heated up and
    souless temperature could also be applied
  • 21:47 - 21:52
    to the silicon chip itself or make some,
    uh, Tominaga medical attention and
  • 21:52 - 21:57
    therefore, chip may break down. On the
    other hand, of course, infrared laser
  • 21:57 - 22:02
    radiation may also, um, make some, uh,
    health, uh, difficulties. And therefore,
  • 22:02 - 22:05
    it's very important, um, to be careful
    with those laser radiations. So question
  • 22:05 - 22:12
    is, OK, how to open up epoxy in other
    ways, not, uh, having such a laser, and
  • 22:12 - 22:16
    therefore for us, again, a physical
    preparation take place. So for applying
  • 22:16 - 22:20
    Shamika, it's it's very good to prepare
    the chips with some, um, mechanical
  • 22:20 - 22:24
    preparation. And you see here again, the
    chip and advise and then with a grinding
  • 22:24 - 22:28
    disk and some parallel movement as visible
    in the, uh, third picture here. And this
  • 22:28 - 22:37
    whole small curve has been set up. And so
    we have two advantages in here. The first
  • 22:37 - 22:41
    advantage is that already some material is
    finished. And so therefore we have, uh,
  • 22:41 - 22:46
    faster access to the silicone and save. On
    the other hand, also, we have some, uh,
  • 22:46 - 22:52
    area where some chemicals can be dropped
    on and, uh, will take place here. So let's
  • 22:52 - 22:57
    go with the chip to the, uh, Shamika
    treatment. And here again, in the first
  • 22:57 - 23:00
    two pictures, you'll see the preparation
    by the mechanical grinding and censorchip
  • 23:00 - 23:06
    is, uh, put into a sandbaggers, which is
    heated up. So at about 50 to 90 degrees
  • 23:06 - 23:10
    Celsius, send some nitric acid, uh, will
    be dropped on there. And just after
  • 23:10 - 23:15
    overseer's epoxy will be removed and, uh,
    you can get direct access to the silicone.
  • 23:15 - 23:20
    So after you have the desired result, that
    means after all the epoxy has gone, you
  • 23:20 - 23:25
    can remove the rest of the. Set by using
    some acetone, as was a boot in the lower
  • 23:25 - 23:30
    picture. Um, hole and also it's a good
    idea to clean up, um, the chip into the
  • 23:30 - 23:39
    ultrasonic cleaner in order to remove the
    remaining particles. If you don't want to
  • 23:39 - 23:47
    wait for a long time, then you can again
    use some acetone in order to have some
  • 23:47 - 23:54
    carpet try drying. And finally, you have a
    very good, uh, preparation where you have
  • 23:54 - 23:59
    access to the silicone, but also have, uh,
    the connection. Uh, most of the cases do
  • 23:59 - 24:04
    OK for using the chip and operating the
    chip in this environment. Anyhow, as this
  • 24:04 - 24:08
    is, it may also damage some parts of the
    chips. And therefore, it's also the
  • 24:08 - 24:15
    question if you do not need to operate the
    chip, but just for inspection, that's
  • 24:15 - 24:19
    another method to open up those kinds of
    epoxy. And it's just using California or
  • 24:19 - 24:24
    in German, California. Um, so putting
    parts of California together with a chip
  • 24:24 - 24:31
    into, um, glass, then you can heat up this
    to the boiling point. It's about, uh,
  • 24:31 - 24:35
    three hundred twenty two or three hundred
    sixty degrees Celsius. So it's possible to
  • 24:35 - 24:40
    use simply a heat gun and make this very
    fast anyhow by using so, uh, such a heat
  • 24:40 - 24:43
    gun and, uh, heating up California. It
    also makes some ugly smells. So be
  • 24:43 - 24:50
    prepared that this is not in your living
    room because otherwise you won't access a
  • 24:50 - 24:57
    living room for the next days. Anyhow,
    after a short while, about five to 20
  • 24:57 - 25:03
    minutes depend on the, uh, package itself,
    how big this package is. Um, the epoxy is
  • 25:03 - 25:06
    completely dissolved and therefore the
    chip could be, uh, taken out of this and
  • 25:06 - 25:07
    can be cleaned again in acetone. So you
    see in the last picture on the top, oh,
  • 25:07 - 25:09
    it's a very good, uh, way to expect to
    complete a chip and to get, uh, good
  • 25:09 - 25:14
    access to the silicone. But anyhow, in
    this case, of course, the chip cannot be
  • 25:14 - 25:17
    operated any further. It's also the
    connections, the bonding wires and solid
  • 25:17 - 25:20
    frame, uh, has been dissolved in the
    California. And therefore, um, it's not
  • 25:20 - 25:28
    operational anymore. So you see there are
    also some shemekia ways for using even as
  • 25:28 - 25:33
    an amateur and so for using those kinds of
    Shamika, there's also the question of what
  • 25:33 - 25:38
    kind of chemicals can be used in here.
    Peter: Marcus already showed you some
  • 25:38 - 25:43
    examples were in the process. You need
    some chemicals, and so typically a problem
  • 25:43 - 25:50
    with chemicals is that they are quite hard
    to obtain, especially for private persons.
  • 25:50 - 25:53
    And they are typically, if they are pure,
    quite expensive, especially if you buy
  • 25:53 - 25:57
    them in small quantities. And therefore,
    we have set up a small list which contains
  • 25:57 - 26:02
    chemicals which are available readily from
    household products, or we would say from
  • 26:02 - 26:06
    the supermarket. And these chemicals here
    are listed. And alphanumeric order also
  • 26:06 - 26:12
    was a German name because they are quite
    different from the English name. And what
  • 26:12 - 26:16
    mainly is available in supermarkets or
    household products are quite pure
  • 26:16 - 26:20
    chemicals. And these are solvents. And
    remember, we need solvents for opening
  • 26:20 - 26:23
    packages, especially if we want to
    dissolve one kind of plastic, but not the
  • 26:23 - 26:26
    other. For example, opening an RFID label
    are you don't want to destroy the antenna
  • 26:26 - 26:31
    itself, which is put on a plastic, but you
    want to open the package where the antenna
  • 26:31 - 26:36
    is put inside the laminate. And so
    therefore, we have put together several
  • 26:36 - 26:41
    chemicals from acetone, for example, over
    benzene, ethanol, but also ethylene glycol
  • 26:41 - 26:45
    and PACULA ethylene, which are solvents
    for different kinds of plastics, which you
  • 26:45 - 26:49
    can see in the US case, raw. That's a very
    special solvent, which is the second last
  • 26:49 - 26:52
    one for tetra, hydro for rain. And because
    this dissolves also Pevensie polyvinyl
  • 26:52 - 26:56
    chloride, which is normally robust and
    could not be dissolved. But with this
  • 26:56 - 27:00
    special solvent, you can also dissolve
    privacy. Then, of course, you need the
  • 27:00 - 27:03
    mineralized water or distilled water. It's
    sometimes called the jar because we don't
  • 27:03 - 27:09
    want to leave residues on the on the
    chips, especially if cleaning them, for
  • 27:09 - 27:12
    example, in the ultrasonic bath. And
    there's also some chemicals like the
  • 27:12 - 27:16
    sodium bicarbonate and sodium hydroxide,
    which is needed to neutralize acids. But
  • 27:16 - 27:20
    it also can be used, for example, to
    dissolve aluminum. And aluminum is also
  • 27:20 - 27:24
    used, for example, for Antenna's on Earth
    text. So you can dissolve it away and just
  • 27:24 - 27:33
    the chip is left open. Um, that's one
    chemical which is not available in the
  • 27:33 - 27:42
    supermarket. I think that's also a good
    idea. That's not there. And that's a
  • 27:42 - 27:45
    fuming nitric acid. And assuming nitric
    acid is often used in professional
  • 27:45 - 27:49
    versions of packaged opening, that's we
    will see later on for destroying epoxy
  • 27:49 - 27:53
    material. So directly oxidizers the
    material and it's less an acid, then more
  • 27:53 - 28:00
    and Occident, at least if it's water free.
    So if the water was just mixed with acid,
  • 28:00 - 28:04
    then it gets more acid characteristics and
    then it will destroy metals and also the
  • 28:04 - 28:09
    chip itself, therefore. And if one uses
    it, it should be water free. Um, of course
  • 28:09 - 28:13
    if it destroys epoxy materials and it can
    also destroy skin, closer's your
  • 28:13 - 28:16
    furniture, everything, all your devices
    are rusting away and so on. So that's
  • 28:16 - 28:23
    really a nasty and therefore appropriate
    safety equipment must be used so it can be
  • 28:23 - 28:27
    bought. It's about 100 to 200 euro are
    quite expensive and also quite difficult
  • 28:27 - 28:31
    to obtain because it's also used for some
    other more dangerous purposes. But there's
  • 28:31 - 28:35
    also also a way of maybe doing it by
    yourself. So. Thanks, so, of course, we
  • 28:35 - 28:39
    were looking for recipes on the Internet
    which are there, but that's much cooler.
  • 28:39 - 28:44
    That's the book here, which I got from my
    15th birthday. I think it's a science book
  • 28:44 - 28:48
    for kids from quote unquote, Wesolowski
    and also contains a recipe for making
  • 28:48 - 28:51
    fuming nitric acid. Also also with some
    600000 fuming nitric acid works on wood,
  • 28:51 - 28:54
    for example, when it gets burning and so
    on. So that's that's the recipe. And then
  • 28:54 - 28:56
    you, of course, need the equipment. So the
    reaction is that concentrated sulfuric
  • 28:56 - 28:58
    acid, which can be bought, for example,
    and pharmacist reacts, was potassium
  • 28:58 - 28:59
    nitrate, also typical of Pharmacy Chemica.
    And then the fuming nitric acid, which is
  • 28:59 - 29:04
    generated, is distilled from this mixture.
    You can see this in the picture as well.
  • 29:04 - 29:07
    That's the normal distillation apparatus.
    The one which is used here is much
  • 29:07 - 29:10
    simpler. And on the right, that's a micro
    distillation, distillation, glassware,
  • 29:10 - 29:14
    which can be used, for example, if you
    only need some milliliters of this acid.
  • 29:14 - 29:17
    So typically for opening one package, I
    would suggest, for example, five to 10
  • 29:17 - 29:22
    million liters of acid. So it does not
    make sense to have more than than that.
  • 29:22 - 29:26
    I'm talking about professional chemicals
    that are some more of these. So you you're
  • 29:26 - 29:34
    already recognized as the hazard of
    pictograms which are here on the right
  • 29:34 - 29:39
    side. So these are chemicals which are not
    harmless. And so therefore also they are
  • 29:39 - 29:43
    typically only available in a professional
    or from professional sources, just some
  • 29:43 - 29:47
    chemicals or some chemicals which are good
    solvents for epoxy material. So this means
  • 29:47 - 29:53
    in this case, the epoxy is not oxidized,
    but it's dissolved. Or I should rather say
  • 29:53 - 29:58
    that it's it's swollen. So the molecules
    of the solvent go into the epoxy and then
  • 29:58 - 30:02
    it swells and you can brush it away. It's
    not material. The solvent process in this
  • 30:02 - 30:06
    case, um, besides these epoxy dissolving
    chemicals, there are also some specialties
  • 30:06 - 30:12
    for some of the first one. Colene, this is
    used in industry for cheap cleaning, but
  • 30:12 - 30:16
    also for wafer cleaning. And then finally,
    the three ones on the bottom. These are
  • 30:16 - 30:20
    the assets which are used for destructive
    opening nitric acid. You are not already
  • 30:20 - 30:24
    now. And then we have two other ones,
    sulfuric acid, which must be used in a hot
  • 30:24 - 30:29
    variant, and also the so-called Olian,
    which is a more aggressive version of the
  • 30:29 - 30:33
    sulfuric acid, which can be used also at
    room temperature. So looking at
  • 30:33 - 30:36
    professional methods which are available,
    for example, for semiconductor
  • 30:36 - 30:38
    manufacturers, if they want to do a
    failure analysis, for example, then also
  • 30:38 - 30:42
    we have brought you some examples. And
    this one here uses also fuming nitric
  • 30:42 - 30:47
    acid. It's a chemical capsule later. It's
    a typical tool for industry if packages
  • 30:47 - 30:50
    are to be opened, for example, for failure
    analyzers or other means. And so in this
  • 30:50 - 30:55
    case here, the acid is not dropped onto
    the surface of the package, but it's first
  • 30:55 - 30:59
    heated and then it's pumped through a
    small nozzle, which is made of Teflon of
  • 30:59 - 31:06
    glass. And then a jet of hot acid is
    pushed on the surface of the package
  • 31:06 - 31:12
    itself. So this means all the reaction
    products are readily flushed away and are
  • 31:12 - 31:20
    purged and the chip only comes in
    connection with pure nitric acid. So this
  • 31:20 - 31:27
    means it can also not be damaged by
    reaction products, which is very good. So
  • 31:27 - 31:31
    typically such devices give very good
    results, but that's a disadvantage. Of
  • 31:31 - 31:37
    course, on the one hand side, it's
    professional equipment that's quite
  • 31:37 - 31:43
    expensive, on the other hand, and you need
    much higher volumes of the FUMIE nitric
  • 31:43 - 31:51
    acid. Typically, if you do it manually,
    you would need five milliliters or 10 and
  • 31:51 - 31:55
    here you need much more, maybe 50
    milliliters or even more. This one is a
  • 31:55 - 31:59
    sincere milling machine, which we would
    also be using, for example, and
  • 31:59 - 32:05
    professional environment, and I think they
    are a lock picking people here. I would
  • 32:05 - 32:09
    like to have something like this, too.
    That's really nice machine, which can make
  • 32:09 - 32:14
    he programed milling. It has done not just
    preprogrammed inside, but it can also
  • 32:14 - 32:18
    launch new packages. And the interesting
    thing is that you can also use diamond
  • 32:18 - 32:22
    drills and thereby open ceramic packages.
    Also, for example, from the back side, if
  • 32:22 - 32:27
    you want to get access to the chip side
    for a special purpose. Nevertheless, this
  • 32:27 - 32:33
    equipment is very expensive, also an
    operation. So this diamond dress cost very
  • 32:33 - 32:44
    have a high cost and last but not least,
    very heavy. So it cannot be used in all
  • 32:44 - 32:50
    laboratories. This one here is a laser,
    the capsule later laser the capsule that
  • 32:50 - 32:54
    is mainly laser scanner. And I think you
    saw some of these on the assembly already
  • 32:54 - 32:58
    for cutting what are Styrofoam and so on.
    And that's nearly the same. But it works
  • 32:58 - 33:04
    more on a on the microscopic level or
    millimeter level. And so then hit by a
  • 33:04 - 33:08
    complete plastic package, for example, can
    be scanned with a focused laser and laser
  • 33:08 - 33:11
    just evaporates the material. That's an
    inch on a few more so that the reaction
  • 33:11 - 33:15
    products are purged. And so therefore,
    that's really a nice way of opening
  • 33:15 - 33:19
    packages. Again, like for the machine that
    are preprogrammed packages, but it can
  • 33:19 - 33:24
    also learn to use new packages.
    Nevertheless, there are also disadvantages
  • 33:24 - 33:29
    of such methods. Again here, like Mockus
    already set for the laser, you have a
  • 33:29 - 33:33
    thermal stress to the chip, which
    sometimes can lead to breaking the chip,
  • 33:33 - 33:39
    which you don't want. And also, again, the
    costs are quite high milling. And also
  • 33:39 - 33:43
    this laser encapsulation are typically not
    used to completely open a package. It is
  • 33:43 - 33:47
    more used for generating a recess, which
    is then further treated by chemical
  • 33:47 - 33:49
    etching. So this means you would only make
    a recess and the plastic package, which is
  • 33:49 - 33:53
    nicely fitting the capsule as a chemical
    to capture that. And then afterwards, this
  • 33:53 - 33:58
    fuming nitric acid, you would do the final
    opening of the package either manually or
  • 33:58 - 34:01
    with an automatic version. So if the trip
    is properly prepared and here, for
  • 34:01 - 34:08
    example, on the right, you can see a trip
    which has opened with a professional, um,
  • 34:08 - 34:15
    a device, then you can have full access
    first with a microscope. Of course, you
  • 34:15 - 34:19
    can see if there's a chip in the package.
    You can have a look if there are some dye
  • 34:19 - 34:22
    markings which can lead you to a more
    material literature, data sheets and so
  • 34:22 - 34:27
    on. Um, have a look inside what the
    function may be and what this is used for
  • 34:27 - 34:30
    and the device which you are currently
    investigating. But, uh, sometimes after
  • 34:30 - 34:33
    you have done that and the real fun
    starts, which means preparation of an
  • 34:33 - 34:38
    attack or finding attack vectors and then
    finally also at doing such attacks. So
  • 34:38 - 34:41
    attacks could be further reverse
    engineering, for example, making a
  • 34:41 - 34:44
    complete preparation of the chip, grinding
    away the different layers of it for, uh,
  • 34:44 - 34:48
    doing a complete reverse engineering. And
    then if the package is opened, you can do
  • 34:48 - 34:51
    some attacks, which you normally won't do
    or can't do with packages, um, with chips
  • 34:51 - 34:55
    and side, which are, for example, laser
    attacks that you focus on the focus laser
  • 34:55 - 35:00
    on the chip to make some false or to
    induce some wrong calculations inside.
  • 35:00 - 35:05
    There are many other devices which have
    ultraviolet fuzes which can be erased, for
  • 35:05 - 35:09
    example, against code protection. One can
    do permanent manipulations, for example,
  • 35:09 - 35:13
    by focus on beam or laser cutter, if
    that's what all the chips, um, one can do.
  • 35:13 - 35:16
    Alpha radiation attacks because alpha
    radiation also would not penetrate a
  • 35:16 - 35:20
    package, but, uh, they will penetrate the
    silicon and then make faults, for example,
  • 35:20 - 35:25
    electromagnetic attacks by applying a
    probe on the top of the chip or on the
  • 35:25 - 35:28
    backside. And, um, the one which I have
    left out a photon emission. Such an
  • 35:28 - 35:33
    analysis. That's quite interesting. Um,
    that's a way of looking at the chip, how
  • 35:33 - 35:36
    it generates infrared photons, while
    calculating, for example, if a transistor
  • 35:36 - 35:40
    switches and photons are emitted. And
    that's that's a method which we are
  • 35:40 - 35:45
    professionally using since 2001. But
    recently I read in the press that also
  • 35:45 - 35:49
    some other people looking for this method,
    uh, for example, the German one does not
  • 35:49 - 35:54
    wants to get such a device to, um, which
    sounds quite, um. Yeah. Quite reasonable
  • 35:54 - 35:57
    to me because there are some smart catch
    chips today available which are not
  • 35:57 - 36:02
    prepared against such kind of a text. And
    also this may be a way of using this
  • 36:02 - 36:06
    photon emission, such an analysis for, um,
    exploiting a backdoor which could be
  • 36:06 - 36:10
    induced by physically unclogging other
    functions. If you are interested. We made
  • 36:10 - 36:16
    talk last year and we have also a small
    chapter about it. But this would lead to
  • 36:16 - 36:24
    far in this environment here. So, um, if
    you are interested in the topic itself
  • 36:24 - 36:29
    and, uh, want to have an overview, then we
    would recommend this book that's, um,
  • 36:29 - 36:34
    available in German. But also there's an
    English version of it which we have put
  • 36:34 - 36:39
    under the literature here. It's from a
    Siemens failure analysis guy and the
  • 36:39 - 36:42
    contents of the package opening, but also
    a chip preparation techniques. And there's
  • 36:42 - 36:45
    a nice presentation about using fuming
    nitric acid for the capitulations from on
  • 36:45 - 36:52
    semiconductor in 2008. Um, if you use, um,
    colorfully or Rosana sometimes called, um,
  • 36:52 - 36:57
    then there are two interesting projects.
    One is from the cost of Belene. Um, it's
  • 36:57 - 37:01
    along with California, unfortunately is
    only in Germany, in German. And then
  • 37:01 - 37:07
    there's also a project from the LEP which
    is called As a Californian User, which is
  • 37:07 - 37:12
    an automated way of opening packages, was
    kind of funny. And then finally, there's
  • 37:12 - 37:16
    also an interesting thing about laser chip
    access, how to open chips with laser and
  • 37:16 - 37:19
    3D techniques. So these are only a few
    points. Um, this book we have also an
  • 37:19 - 37:25
    assembly. So if you want to have a look
    inside, then be invited to visit us today.
  • 37:25 - 37:28
    Finally, if you have a look inside chips
    and sometimes, uh, interesting things open
  • 37:28 - 37:32
    up not only technology, not only attack
    vectors, but sometimes you also see some
  • 37:32 - 37:36
    artwork. Sometimes today there's not much
    place left because that's also cost, and
  • 37:36 - 37:41
    so therefore this year art is getting less
    and less. But these are some examples
  • 37:41 - 37:45
    which we found sailboard and here in the
    upper right corner, that citya arms of
  • 37:45 - 37:48
    Hamburg, which belongs to Chip from
    Philips. All right. So that's not
  • 37:48 - 37:56
    complete. Our small presentation about
    Chip opening. And now we have some some
  • 37:56 - 38:01
    minutes for questions, of course.
  • 38:01 - 38:09
    Herald: Wow, amazing. I see my shopping
    list grow. So are there any questions, I
  • 38:09 - 38:11
    would say from from the Web? Are you OK?
    Signal Angel: Indeed. OK, that's one
  • 38:11 - 38:16
    question from the Internet, and it's
    concerning the left overs of the
  • 38:16 - 38:22
    chemicals. Um, do you have any hints about
    how to get rid of them after you practice
  • 38:22 - 38:26
    in your private environment?
    Peter: All right. So first of all, I would
  • 38:26 - 38:30
    recommend not to buy any chemicals that
    you don't need, because that's all
  • 38:30 - 38:37
    environmental pollution which is generated
    just in the moment they are produced. And
  • 38:37 - 38:41
    so, therefore, buy only the chemicals you
    need, um, buy only the amounts of
  • 38:41 - 38:44
    chemicals that you need, I would
    recommend. And then afterwards, there are
  • 38:44 - 38:47
    also ways of neutralizing these agents,
    for example, fuming nitric acid can be
  • 38:47 - 38:51
    neutralized with baking soda, which also
    we have on our list here. And so
  • 38:51 - 38:53
    therefore, I would have a look inside
    Internet sources, for example, to see what
  • 38:53 - 38:58
    are the special ways of neutralizing each
    agent. So for a private person, it's, I
  • 38:58 - 39:10
    would say nearly the same. Like for
    industry or certainly industry, this
  • 39:10 - 39:22
    chemical are neutralized and then given
    away to the appropriate institutions.
  • 39:22 - 39:28
    Sometimes you can just flush it away after
    neutralizing it, but sometimes as a
  • 39:28 - 39:33
    result, you may be toxic and then you have
    to give it to a special institution.
  • 39:33 - 39:38
    Herald: Question answered. Guess, um, any
    more questions from from the web. OK, um,
  • 39:38 - 39:42
    I would say we do some load balancing. You
    start first please.
  • 39:42 - 39:47
    Mic: Oh. Is there a way to actually verify
    where our chips are identical. So if you
  • 39:47 - 39:51
    have two chips or whatever, they are the
    same or generated using the same mask set?
  • 39:51 - 39:52
    Or any mechanical way to actually verify
    that?
  • 39:52 - 39:58
    Peter: If these chips are identical. OK.
    So if there would be a way, for example,
  • 39:58 - 40:01
    to make an X-ray, this would be, of
    course, fine, because then you don't need
  • 40:01 - 40:06
    any preparation at all. So some years ago,
    I would have recommended to ask your
  • 40:06 - 40:11
    dentist, for example, because he has an
    X-ray. But normally X-rays are today not
  • 40:11 - 40:16
    used for other purposes purposes. They are
    intended to. So therefore, X-ray would be,
  • 40:16 - 40:18
    of course, the best one to have a look
    inside the chip. Um, if these are
  • 40:18 - 40:22
    smartcards, then sometimes infrared can
    serve well, because also with infrared,
  • 40:22 - 40:27
    you can look through the smartcard itself
    sometimes and then see the surrounding.
  • 40:27 - 40:31
    And also chips have typically
    characteristic bond wires. So this means
  • 40:31 - 40:35
    that the alignment of bond wires. So where
    are the pads, for example, differ also
  • 40:35 - 40:40
    from chip to chip. And finally, of course,
    the marking, because typically a marking
  • 40:40 - 40:45
    is only valid for for one specific chip
    and another chip, which would be in next
  • 40:45 - 40:47
    generation, for example, would also have a
    different chip marking then.
  • 40:47 - 40:52
    Marcus: But anyhow, of course, so you can
    distinguish whether this is the same
  • 40:52 - 40:56
    hardware or not very often today. Also,
    the chips are equipped with some flash.
  • 40:56 - 41:01
    And later, if you open up one chip, you
    can identify whether there's a nonvolatile
  • 41:01 - 41:07
    memory on the chip. And of course, you
    cannot distinguish by the microscope
  • 41:07 - 41:13
    whether the same flash content is in there
    or not. So it might be that in different
  • 41:13 - 41:16
    operating system or different programmers
    running on such a microcontroller
  • 41:16 - 41:24
    containing some flash, even if this is the
    same hardware. But at least, you know, OK,
  • 41:24 - 41:29
    this is the same hardware. And you're also
    learning, as you have done on a first
  • 41:29 - 41:35
    chip, you can also use on the same ship.
    Herald: Question answered? All right,
  • 41:35 - 41:38
    let's go.
    Mic: So have you ever opened up a package
  • 41:38 - 41:41
    just to find you've been hit by a
    counterfeit part?
  • 41:41 - 41:46
    Peter: Personally, not so. I know that are
    many counterfeits, especially from from
  • 41:46 - 41:49
    Asia Pacific Range. And sometimes it's
    quite interesting. I've seen such devices.
  • 41:49 - 41:53
    I did not open them by myself, but
    sometimes that's a totally different chip.
  • 41:53 - 41:59
    And. So it does not even match the type of
    functionality which what you would expect,
  • 41:59 - 42:03
    for example, instead of microcontrollers
    as a 74 something logic chip inside, which
  • 42:03 - 42:07
    would not work at all.
    Marcus: But again, here also, if you open
  • 42:07 - 42:12
    up the chip package, you can see the dye
    marking and have no clue about the chip
  • 42:12 - 42:16
    itself and also about the functionality,
    because the logical chip, uh, 74 series,
  • 42:16 - 42:20
    it's much less complexity and so quite
    clearly visible in the microscope compared
  • 42:20 - 42:26
    to a microcontroller or something. So it's
    quite easy to identify whether the
  • 42:26 - 42:32
    printing on the package is correct or
    whether this is just a fake chip.
  • 42:32 - 42:37
    Mic: Well, that's not clear. But you know
    what? After all.
  • 42:37 - 42:40
    Herald: Question answered? I guess. Yes,
    please go. Go on.
  • 42:40 - 42:46
    Mic: So you said you can generally look at
    chips using just optical microscopes, what
  • 42:46 - 42:48
    kind of magnification we can need for
    different types of chips?
  • 42:48 - 42:51
    Peter: OK, so typically for a stereo
    microscope, for preparation, you would
  • 42:51 - 42:57
    need only some five, four or twenty four
    to magnification, but usually for looking
  • 42:57 - 43:02
    optically at chips, you would need a 100
    fold to I would say five hundred fold
  • 43:02 - 43:08
    magnification. That's of course there's a
    limit because of the technology gets
  • 43:08 - 43:12
    smaller than the wavelengths of light and
    then you've got a problem. And so
  • 43:12 - 43:14
    therefore we also have recommended here
    for amateurs or for beginners in this
  • 43:14 - 43:19
    topic to use all the chips, because you
    have, for example, one point two
  • 43:19 - 43:24
    micrometer technology, which is far away
    from from the wavelengths of the light.
  • 43:24 - 43:32
    But a few today would have, for example,
    90 nanometer or 65 nanometers of the CPUs,
  • 43:32 - 43:35
    even 22 nanometers. So that's 20, 20 times
    smaller than the wavelengths of light. And
  • 43:35 - 43:40
    then you don't see anything at all and
    just colors.
  • 43:40 - 43:43
    Herald: Question answered?
    Marcus: And please be invited to our
  • 43:43 - 43:49
    assembly later on because we have got a
    microscope and some sample chips with us
  • 43:49 - 43:55
    so you can make some own experience in
    there and watch the silicon and see what
  • 43:55 - 43:59
    kind of such you can see so please be
    invited.
  • 43:59 - 44:04
    Herald: I'm totally sorry. I totally
    overlooked Microphone four. Please, please
  • 44:04 - 44:09
    go ahead.
    Mic: So if you have just a limited amount
  • 44:09 - 44:12
    of chips and want to maybe reuse them
    again like we want them. Um..
  • 44:12 - 44:15
    Herald: Could you please repeat the
    question with a microphone, because then
  • 44:15 - 44:17
    it's recorded.
    Mic: Yeah, so if you have, like, only a
  • 44:17 - 44:20
    couple of chips and want to reuse them
    again and dissolve epoxy, like what or
  • 44:20 - 44:27
    what method would you recommend to use?
    Peter: All right. So if you want to use
  • 44:27 - 44:34
    them, um, after preparing, then it's very
    important that there are no acid residues
  • 44:34 - 44:41
    left because we sometimes see, for
    example, if you prepare a chip with fuming
  • 44:41 - 44:47
    nitric acid and there's just a small
    amount of acid which is left, then after
  • 44:47 - 44:52
    one week or two week, the chips
    deteriorate. And so this means that they
  • 44:52 - 44:53
    have to be and the acid has to be
    neutralized very good. Rinsed with acetone
  • 44:53 - 45:00
    and then afterwards dry it carefully. So I
    would recommend to to store them also
  • 45:00 - 45:04
    maybe, um, under dry conditions, but if
    you are interesting. And afterwards you
  • 45:04 - 45:08
    could also contact us because we have some
    methods also for conserving chips.
  • 45:08 - 45:11
    Herald: Question answered right from the
    Internet, please.
  • 45:11 - 45:15
    Signal Angel: Yeah, there's another one.
    Um, it's about have you noticed any
  • 45:15 - 45:16
    manufacturers implementing
    countermeasures, new guards to decaping
  • 45:16 - 45:19
    the chips?
    Marcus: So yes, indeed, there are some,
  • 45:19 - 45:26
    uh, countermeasures at advertised by, uh,
    manufacturers who say, yes, we have a kind
  • 45:26 - 45:30
    of secure package. Uh, one of those secure
    packages also shown in the presentation
  • 45:30 - 45:34
    where, for example, uh, special coverage
    on top has been placed. Uh, but anyhow,
  • 45:34 - 45:37
    also there we have, uh, displayed some,
    uh, methods in order to open up those
  • 45:37 - 45:43
    kinds of packages. So, uh, it's always a
    trade off how much, uh, security you can
  • 45:43 - 45:49
    expect from the chip package. And so, in
    my opinion, I think the package there are
  • 45:49 - 45:53
    so many, uh, methods to remove a package.
    It could not be a completely secure
  • 45:53 - 45:57
    package just by the package itself. So if
    you need to have some secrets inside a
  • 45:57 - 46:01
    chip, then really the chip hardware should
    be secured and therefore protected against
  • 46:01 - 46:07
    spying out of those data. And this will be
    more on logical ways, for example, using
  • 46:07 - 46:11
    encryption instead of using some, uh,
    material in the package.
  • 46:11 - 46:17
    Peter: So there should be no trade off
    between buying, uh, insecure or less
  • 46:17 - 46:22
    secure chip and then adding a package. We
    think that the chip itself has to be
  • 46:22 - 46:29
    secure or secure enough, I should say, and
    it cannot be afterwards put the security
  • 46:29 - 46:37
    cannot be put afterwards around the chip.
    So that's not the way of, uh, of clean,
  • 46:37 - 46:42
    uh, engineering.
    Herald: Right. Um, we have time for a last
  • 46:42 - 46:58
    question. If you could please keep short
    and you guys also please go ahead.
  • 46:58 - 47:15
    Mic: I have a question about, uh, legal
    problems. When you publish photos of the
  • 47:15 - 47:27
    internal parts, and maybe sharing in a
    public database to to make education
  • 47:27 - 47:38
    better or I don't know.
    Peter: Um, that's if you make photos of
  • 47:38 - 47:44
    chips themselves which you have prepared
    by yourselves, then I think it should not
  • 47:44 - 48:09
    be critical. So we have also here are some
    pictures which we made sometimes of our
  • 48:09 - 48:18
    own chips, sometimes of other chips. But
    this does not contain any trade secrets,
  • 48:18 - 48:41
    for example. But of course, that's a
    difficult question, especially if it goes,
  • 48:41 - 48:51
    for example, to pictures which contain
    material where you see, for example code,
  • 48:51 - 48:58
    a ROM picture if you would publish a
    picture of a ROM and then it could be that
  • 48:58 - 49:12
    this ROM contains code and then you would
    publish this code. So it's very difficult
  • 49:12 - 49:25
    to tell which is which is right and which
    is wrong. But, um, usually we don't think
  • 49:25 - 49:37
    that that just took pictures are critical.
    Marcus: And it really depends also on the
  • 49:37 - 49:57
    resolution. If you have a complete chip
    and a overal resolutions that you cannot
  • 49:57 - 50:14
    identify single lines and cannot use this
    as a schematic to include such a chip,
  • 50:14 - 51:35
    then it's something different compared to
    a high resolution picture where you can
  • 51:35 - 52:27
    draw a complete schematics in there, but
    we can also talk later on in the assembly
  • 52:27 - 52:51
    more on this topic. And also I see some
    further question, but I think we are
  • 52:51 - 53:44
    running out of time so we can do this
    later on.
  • 53:44 - 54:38
    Herald: Yeah, great. Thank you very much.
    Thank you for your questions.
  • 54:38 - 54:43
    applause
  • 54:43 - 55:20
    The guys with the open chips go to the
    assembly and ask them if you have any more
  • 55:20 - 61:42
    questions, please. OK, thank you.
  • 61:42 - 61:56
    Subtitles created by c3subtitles.de
    in the year 2021. Join, and help us!
Title:
Peter Laackmann, Marcus Janke: Uncaging Microchips
Description:

more » « less
Video Language:
English
Duration:
01:01:56

English subtitles

Incomplete

Revisions Compare revisions