Peter Laackmann, Marcus Janke: Uncaging Microchips

Marcus: Thank you for the kind
introduction. Welcome to our talk about

engaging microchips. So the background in
here is twofold. On the one hand side, we

would like to encourage you also to make
some own experiments and to see what is

inside a semiconductor device that means
what is inside a microchip. And so the

goal is that you also have some knowledge
how to open up a microchip and how to get

direct access to the silicon. On the other
hand, also, very often there's a rumor

that chip is highly secured because the
silicon is inside of plastic coverage. And

if a plastic package is really high
security, we can also explain today,

because very often even this amateur
equipment, it's possible to open up chips

and to get direct access to the silicon.
We are not only focusing on microchips,

but we are also focusing on more complex
systems, how to open up the system to get

access to the silicon in our background.
We have started more than 25 years ago

with analyzing the first telephone cards.
And so starting off with some experiments

at the Commodore 64, as well as working
with the first telephone card, it was our

major interest to find out what is the
functionality of this telephone card and

also what is inside. And of course, for
identifying what's inside. It was also our

target to open up stores, plastic cards
and to get access to the silicon chip

inside the telephone card. Nowadays, we
are also very often open up chips in order

to make some analysis or in order to apply
some high tech methods, for example, for

putting some over particular variation on
the top of the surface, also to apply some

laser. It's, of course, necessary to have
direct access to the silicon itself. And

therefore, also today we are utilizing a
lot of professional equipment in order to

observe chips. So today we would like to
give a short overview about the different

techniques and methods, how to open up
different kinds of chips, and also to

encourage you, because it is very
interesting also to open microchip

packages in order to get further analysis.
First of all, sometimes it's not quite

clear whether this is really a package
which contains a chip or whether there's

only a kind of label, as you can see, in
the lower picture. So in the lower

picture, it might be only a barcode labor,
but perhaps also an RFID chip might be in

there. And therefore, a first analysis.
It's the question, a inside the package.

And then, of course, also there's the
question, what is it about the chip

functionality itself? That means how many
functions are implemented in such a chip?

This is only a memory. Ship ourselves for
some logic inside there. And what kind of

logic is implemented here? And by the way,
on the most of the chips are also so-

called time markings. That means some
small numbers and these identified as the

silicon itself and these same markings as
possible to make some research and some,

um, findings from literature, as well as
also from tools in order to get more

information about the chip itself. And
finally, watching on the silicon itself

indicates also, if this is a more modern
chip, that means smaller technology or

whether this is an old fashioned chip. And
so you cannot expect so much functionality

or security funds the chip itself. So from
this perspective, these are some

motivation which also may encourage you to
open up some microchip packages and to

find out what's really inside there. We
have fought also three examples, um, to

show what is a potential finding out of
this. For example, it's well known that

some goods are tracked down with RFID
chips. And so recently we also got a t

shirt with a dedicated label inside here.
And it was not clear whether this label is

just about label or whether there are some
more, um, techniques inside the specialty

and RFID chip. So as you can see in the
second picture, it's quite easy to

identify if this is more than a barcode
label, because simply with a torch limb,

it's possible to eliminate those from the
back side. And so the flash indicates a.

There's something more than a bar code
inside there and indeed is some structure

inside. We have put this into a glass of
acetone and after a short while is the

label has to eliminate it. And so we can
got we got the final picture with the

antenna inside here. And in the middle of
the antenna is a small, dark spot. And

this is a chip. So it was clearly from the
antenna size, such as communicating in UHF

frequency range and also the small dot.
It's an hour edition. So now it's prepared

for further analysis with a microscope. So
you see, it might be very simple to get

some more information out here. Another
example brings us back where we back to

the history. And as I mentioned before, we
have started this investigation on

telephone cards. And, of course, not only
the telephone calls, but also the

telephone card system has been of high
interest for us. And so we were in lucky

situations that we found some, uh, printed
circuit boards from Cox Telephone where we

only got access to those because those car
telephones has been burned down

completely. So it was a huge fire. And so
inside is this area and so is the, um, uh,

telephone also get burned? Anyhow, we
managed to get those printed circuit

board. And in the second picture, you can
also see that the X-ray picture of the

printed circuit board, uh, clearly shows
that all the borrowings are still OK. So

it was possible for us to draw a dramatic,
uh, schematic and, uh, to see how the

different pins of this, uh, printed
circuit boards are connected. Well,

anyhow, it was not clear what are the
different shapes, because due to the heat,

simply the marking on the chip itself has
been vanished. So from this perspective,

we have used some, uh, capitulation method
in order to get the singer chips, the

silicone chips out of those devices. And
as you can see in the lower picture, then,

uh, with some, uh, microscopy work, we
were able to find out what is each single

chip. And so, uh, identifying the
different names of those chips and also

combining this was a schematic. It was
possible for us to, uh, resolve the main

function in those days from the cartoon
itself. And this gives us a clear clue in

what direction the telephone has worked in
those days. Yeah. And finally, also, there

was something in the beginning of 2000
there was a price competition. And is this

price competition, um, mean such as the
small sticker, which has to be applied to

the, uh, TV set. And then in this
perspective, uh, it was also that a lot of

rumors, whether this kind of spacechip
inside Syria and you see on the lower side

says, uh, some, um, comment from the
Internet at those days that there should

be an electronic chip inside Syria. And
this electronics should not only record

what you are watching on TV, but also, um,
make some sound recording in order to find

out how many people are in the room
watching this show and so on and so on.

But anyhow, um, we clearly thought, well,
this is just a rumor. And so, of course,

we use our, uh, techniques in order to
open up this device and also to find out,

uh, what's inside there. And in the end of
the day, it was clearly that this was only

a dot mask and below officers, there were
some foom which is photosensitive. And

when you watch, uh, special TV shows and
this film has been illuminated and

therefore it was clearly identifiable
whether this show has been seen or not. So

it was clear for us that we could identify
there's no spacechip inside and this was

only a rumor. So also, therefore, the
preparation techniques are quite useful

and helps to understand what's going in
inside Syria.

Peter: All right. Some some somewhat to
the chips and the packages. So there are

many thousands of different packages for
troops today. And sometimes the

functionality of the chip that just inside
will directly determine the way, such as

packaged. And this is the case for these
troops here especially. And if you look on

the left, that's an interesting thing. A
fingerprint sensor, which is another from.

Even use today with his fingerprints, and
this is a specialty that the chip itself

can be directly touched with the finger.
Normally you would avoid such a situation,

but here you have the direct silicone
accessible and there's only a frame which

is covering the surrounding of the chip to
make it mountable and the device itself.

Then we have a webcam webcam shown here,
which is just covered by a thin plate of

glass. Of course, the picture or the
optical radiation has to reach the chip

and therefore the same is true for your
microscope. You can directly observe such

chips without further preparation. Um,
yeah, I think the older one of you know,

this is prom type of memory, old fashioned
thing, but sometimes it's still seen

today. You can electrically write such an
issue from memory, but if you want to

erase it, you have to put it under
ultraviolet light to make the erasing

function. And so this means also this
package has a window in this case that's

made of silica because this uses to be UV
transparent. And again, you can have a

look inside without any preparation, which
sometimes quite interesting. And then on

the right, we have an amplifier chip shown
here and which is an instrumentation

amplifier, and therefore it should be
sealed from the environment, but also from

electromagnetic radiation. And this is
done here in this case by a ceramic

package. And this package has a metal that
over it. And again, here, it's very easy

to open this package. We will see later on
and was just using a blade. So all of

these four packages are quite interesting
for an amateur. You don't need any

equipment at all to have a look inside.
But as we said, from open to amateur hour,

some more difficult shops to open. And
here on the left side, that's a typical

chip which you will encounter and millions
today and all consumer goods. It's a

plastic package here. We have an order,
one which is a plastic package. But you

also know the surface mounted devices and
so on. So this plastic packages are quite

robust against environment, but also they
are robust against chemicals. And this

means you need quite harsh conditions to
open them and the chemical weigh. Are you

when it laser, which we will see later on,
epoxy resin. And the same is true for the

laptop package, which is a very low cost
kind of package, just as it is put on the

circuit board, then it's connected point
wires to the circuit board itself and then

afterwards just a drop of epoxy resin as
part of it. And you see, it's not a

rectangular form which should have. It's
more just a drop which put on top of

clocktower package is also seen here. And
the third picture, which is the smartcard

package, the typical one, if you would
turn this picture around, then you would

see on the other side that there are the
typical Golden Smartcard contacts. And

from the back side, it's a picture like
this. You have the chip and the chip is

connected, was bond wires to the
connection points and then afterwards to

hold it in place and also to make it
resistant from the environmental

conditions. It's also protected with a
blocked off package. So it just epoxy

resin is poured over it. And then finally
on the right is something which some

people call a security package. You see
that matterson hyphenation. Not only is it

dark so that you can see directly through
the through to the chip, but there's also

there can be some special Latisse, for
example, in this case, there's an

additional layer which is put on the chip,
which is also made of silicon itself. But

yeah, as we showed here, it's not I would
say it's not really security. And many

cases of this package, just because of the
security, does not start in the chip

itself. And I would say then it's a little
bit too late. All right. So what can you

see if you look inside such chips and we
have chosen some examples where you don't

need any preparation at all. Here you can
see some memories for beginning. It's

quite interesting to have a look at all
the chips which are sometimes available to

store. And that's because simple fact. And
the older days, the technologies were not

so small as today. So this means you can
see the structures. What's your barai or

maybe you need your grandfather's
magnifying glass, maybe, but you don't

need a high definition microscope. And so
here on the far left, that's a chip from

nineteen seventy six, very old one very
small memory. And you can directly see

with your eye all the structures inside
just through the window without opening it

at all. And then if we proceed in time
also to a vintage chip from nineteen

eighty eight, one megabit it from there.
See already it's more like a gray mass,

that's a memory cells and you definitely
would need a microscope to have a further

look inside how such a memory is built and
to analyze it. And then on the right.

That's also an interesting example of a
memory. But this memory has some access,

right. Tied to it, because that's the
telephone chip card. And here you have a

very small memory of only 88 bits. But the
rest is controlled logic so that only the

people who are or should be allowed to
load it and to erase it have this access

rights given to them. And if we look at
the little microcontroller units and they

are quite more interesting than just a
memory. And here again, we have four

different chips brought to you. Two of
those also have windows. You don't need

any preparation at all. And the one on the
left is, again, a chip from nineteen

seventy six, very old. One can see
directly all the different structures like

Rom Ram that you prompt part and also the
logic part which contains the CPU and also

some analog devices which are needed for
the functionality of the chip. I think

that pick 16, the second picture, you
know, and the flash version, which is very

common today, you just can program it and
erase it again and a normal device. But in

1988, these types of the control that were
made was EPROM. So this means you could

program it. And then if you want to erase
it again for reprograming, you have to put

it under ultraviolet lamp for five
minutes. So therefore, there are some

older versions of the controller. But what
you can see is that the technology is

smaller and that the chip is just a very
high density and comparison to the chip,

which is 12 years older. Interestingly,
the smart all the smart card controls look

quite the same, like these older devices.
And they also have from RAM you prom are

normally prom. So electrical eraser, a
programable rom. And so therefore the

smart card units, even those of in the 90s
look like the same, like the older and

serious. And finally, just for comparison,
we also brought a sixty eight case. If you

this has only cash but no nonvolatile
memory and was used in some old home

computers for example, but also in
instrumentation technology. So what do you

need if you want to start with preparing
microchips. Just to have a look, if it's

interesting for you to have a glimpse
inside. So what you definitely need is a

simple microscope. And we showed there a
student version that's about 300 euros.

But they are also quite interesting USB
microscopes today and which come ready for

use for about 150 euros. So that's quite
good tools. You need definitely some

mechanical tools like scalpels, tweezers,
which we have here sometimes some sort of

dentist tools, which also would serve
quite well, an ultrasonic cleaner. It's a

very good thing to have because this is
really nice for package preparation,

cleaning, but also removing particles and
also of the chip is prepared and ready.

Then you can remove all remaining residues
and particles from it. And finally, there

are three solvents which you need for
beginners, which is alcohol, ethanol and

acetone and also benzene. These are three
solvents from non polla to polla type. And

with these three solvents, you can open a
lot of different packages. Then for

upgrading such equipment, it's quite
interesting to have a 3-D view. So was a

stereo microscope. You can make
preparation with both your eyes. You have

a 3-D vision and you can directly see what
you are doing, which is sometimes quite

difficult. If you have on your monocular
side, then if you want to share your

results, a microscope camera could serve
your well, which is available for about

300 euros. But there are also some DIY
versions, for example, with no cameras

which are adapted to the microscope
itself. Some further chemicals can be

needed, which I will also show you later
on the table, which are not without

danger, I would say, and therefore also
typically a lab coat and some protective

wear would be used. So now we are in a
moment we will come to a different details

of how to open a package and and the steps
itself. And this will be sorted from

physical opening statements, the methods
or mechanical methods over to chemical

methods for you directly open. So device
with chemical means. But there's also a

mixture of both. And therefore, I would
like to hand over to Marcus.

Marcus: Yes, thank you. Let's go to the
workbench and open some packages. So

beginning, as Peter mentioned, with the
physical ones. And the first one is quite

easy. You just need advice. And as you
puts a chip inside vis a with the lower

part of the I see as depicted in the first
picture and then you just put some more

forces to the I see. Pictures save and
during the time device will be smaller and

smaller, the package will break up and the
upper part lift up. So as visible in the

third picture, you can use a simple
screwdriver to remove the upper limit. And

then finally, in the last picture, it's
visible that the bare silicon chip is

visible for your further analysis, also
connected to the lead frame. So the frame

which connects to the outer pins and to
the outer communication. So this is a

quite simple method. And indeed, this is
the first method we have also used in the

example of the copper telephone I have
explained earlier. So it was quite easy to

break up those chips in order to get the
silicon parts out of the ICS and then

analyzing them with a microscope, even if
the package will be a little bit more

hardened. For example, a ceramic housing
like use in eponyms, then it's also a good

idea to have fixes and device and just to
replace a screwdriver on the top part of

the see, and there's a small bump on the
back of the screwdriver. The upper limit

will be removed. And as you can see in the
chart picture directly, the access to the

chip is possible. So indeed, I think these
pictures clearly identify that this must

be not high, sophisticated techniques or
some sensors, sometimes really a normal

workbenches sufficient to get access to
very easy. It's in the case if there's a

special package, as Peter has explained,
with such a metal lid on top of this,

because this method to it is sold out on
the academic housing. And typically you

can think about where grindings as a way
or try to sold out or something like. But

there's a very easy method to open up
those kinds of packages. You just use a

blade as visible in the second picture
and, um, use a hammer for a small store.

And then this blade drives and is this
metal dirt and you can simply lift off

this metal without any further, um,
effort. So it's just, uh, two seconds, uh,

work to open up those kinds of packages.
And even those blades are quite easy to

access because you can see in the lower
pictures that they are sold also in

discounters for, uh, cleaners of Deskovic.
So these blades are easy to use just with

the hammer. You can drive them below the
lid. And so this opens. So you see

physical mechanisms can be very easy. Now,
as also mentioned before, our first topic

has been to, uh, check what's inside a
telephone card. And, of course. Such a

physical preparation, it's more
complicated on a small plastic card, and

therefore it more goes into the direction
of physical chemical reaction on source

cards. And you can see here in this hall
of pictures, we have just played such a

smart card in it's. And after five
minutes, as was a in the second picture,

the plastic of the card absorbed some
acetone and therefore swails. After 15

minutes, you can just wait for those
minutes. Then the structure is fully

destroyed. And so it's quite easy to
remove the remaining plastic parts as

visible on the fourth picture in the
apple. So, again, just by waiting about 15

minutes in, etc. on the smart card is um.
Yeah, destroyed. And so, um, as visible in

the lower picture, all it's possible to
remove the antenna and censorchip itself.

And I think the result and the last
picture on the law, uh oh it's quite

impressive. It's a complete antenna,
including the chip has been resolved out

of this, uh, plastic card. And so, um, it
was quite easy to analyze the antenna and

the size and how this is implemented in
here. Anyhow, you may recognize that the

chip is still covered by, uh, uh, a
laptop. That means a small piece of, uh,

epoxy on top of this. And so it's a
question how to remove this here. It's

possible to use, for example, a laser
with, uh, um, infrared laser, especially

for about Servais flying of 10000
nanometers. Um, it's quite useful to open

up those kinds of pictures because the
silicon itself is transparent for such an

infrared radiation. So the chip itself
would be not directly affected by the

infrared radiation, but all the energy
will be absorbed by the package itself. So

it's just a trauma to, um, destruction of
the package as visible in the lower

picture. And especially also this is quite
useful to open up so-called secure

pictures, as Peter has explained. So even
those kinds of packages, uh, are just

applied with a laser and, um, it's opened
up so that all the, um, silicon can be

directly accessed. Anyhow, this, uh, may
also be some risk. It appears on the one

hand side, the risk that the chips to get
damage due to the fact that is, uh,

package components are heated up and
souless temperature could also be applied

to the silicon chip itself or make some,
uh, Tominaga medical attention and

therefore, chip may break down. On the
other hand, of course, infrared laser

radiation may also, um, make some, uh,
health, uh, difficulties. And therefore,

it's very important, um, to be careful
with those laser radiations. So question

is, OK, how to open up epoxy in other
ways, not, uh, having such a laser, and

therefore for us, again, a physical
preparation take place. So for applying

Shamika, it's it's very good to prepare
the chips with some, um, mechanical

preparation. And you see here again, the
chip and advise and then with a grinding

disk and some parallel movement as visible
in the, uh, third picture here. And this

whole small curve has been set up. And so
we have two advantages in here. The first

advantage is that already some material is
finished. And so therefore we have, uh,

faster access to the silicone and save. On
the other hand, also, we have some, uh,

area where some chemicals can be dropped
on and, uh, will take place here. So let's

go with the chip to the, uh, Shamika
treatment. And here again, in the first

two pictures, you'll see the preparation
by the mechanical grinding and censorchip

is, uh, put into a sandbaggers, which is
heated up. So at about 50 to 90 degrees

Celsius, send some nitric acid, uh, will
be dropped on there. And just after

overseer's epoxy will be removed and, uh,
you can get direct access to the silicone.

So after you have the desired result, that
means after all the epoxy has gone, you

can remove the rest of the. Set by using
some acetone, as was a boot in the lower

picture. Um, hole and also it's a good
idea to clean up, um, the chip into the

ultrasonic cleaner in order to remove the
remaining particles. If you don't want to

wait for a long time, then you can again
use some acetone in order to have some

carpet try drying. And finally, you have a
very good, uh, preparation where you have

access to the silicone, but also have, uh,
the connection. Uh, most of the cases do

OK for using the chip and operating the
chip in this environment. Anyhow, as this

is, it may also damage some parts of the
chips. And therefore, it's also the

question if you do not need to operate the
chip, but just for inspection, that's

another method to open up those kinds of
epoxy. And it's just using California or

in German, California. Um, so putting
parts of California together with a chip

into, um, glass, then you can heat up this
to the boiling point. It's about, uh,

three hundred twenty two or three hundred
sixty degrees Celsius. So it's possible to

use simply a heat gun and make this very
fast anyhow by using so, uh, such a heat

gun and, uh, heating up California. It
also makes some ugly smells. So be

prepared that this is not in your living
room because otherwise you won't access a

living room for the next days. Anyhow,
after a short while, about five to 20

minutes depend on the, uh, package itself,
how big this package is. Um, the epoxy is

completely dissolved and therefore the
chip could be, uh, taken out of this and

can be cleaned again in acetone. So you
see in the last picture on the top, oh,

it's a very good, uh, way to expect to
complete a chip and to get, uh, good

access to the silicone. But anyhow, in
this case, of course, the chip cannot be

operated any further. It's also the
connections, the bonding wires and solid

frame, uh, has been dissolved in the
California. And therefore, um, it's not

operational anymore. So you see there are
also some shemekia ways for using even as

an amateur and so for using those kinds of
Shamika, there's also the question of what

kind of chemicals can be used in here.
Peter: Marcus already showed you some

examples were in the process. You need
some chemicals, and so typically a problem

with chemicals is that they are quite hard
to obtain, especially for private persons.

And they are typically, if they are pure,
quite expensive, especially if you buy

them in small quantities. And therefore,
we have set up a small list which contains

chemicals which are available readily from
household products, or we would say from

the supermarket. And these chemicals here
are listed. And alphanumeric order also

was a German name because they are quite
different from the English name. And what

mainly is available in supermarkets or
household products are quite pure

chemicals. And these are solvents. And
remember, we need solvents for opening

packages, especially if we want to
dissolve one kind of plastic, but not the

other. For example, opening an RFID label
are you don't want to destroy the antenna

itself, which is put on a plastic, but you
want to open the package where the antenna

is put inside the laminate. And so
therefore, we have put together several

chemicals from acetone, for example, over
benzene, ethanol, but also ethylene glycol

and PACULA ethylene, which are solvents
for different kinds of plastics, which you

can see in the US case, raw. That's a very
special solvent, which is the second last

one for tetra, hydro for rain. And because
this dissolves also Pevensie polyvinyl

chloride, which is normally robust and
could not be dissolved. But with this

special solvent, you can also dissolve
privacy. Then, of course, you need the

mineralized water or distilled water. It's
sometimes called the jar because we don't

want to leave residues on the on the
chips, especially if cleaning them, for

example, in the ultrasonic bath. And
there's also some chemicals like the

sodium bicarbonate and sodium hydroxide,
which is needed to neutralize acids. But

it also can be used, for example, to
dissolve aluminum. And aluminum is also

used, for example, for Antenna's on Earth
text. So you can dissolve it away and just

the chip is left open. Um, that's one
chemical which is not available in the

supermarket. I think that's also a good
idea. That's not there. And that's a

fuming nitric acid. And assuming nitric
acid is often used in professional

versions of packaged opening, that's we
will see later on for destroying epoxy

material. So directly oxidizers the
material and it's less an acid, then more

and Occident, at least if it's water free.
So if the water was just mixed with acid,

then it gets more acid characteristics and
then it will destroy metals and also the

chip itself, therefore. And if one uses
it, it should be water free. Um, of course

if it destroys epoxy materials and it can
also destroy skin, closer's your

furniture, everything, all your devices
are rusting away and so on. So that's

really a nasty and therefore appropriate
safety equipment must be used so it can be

bought. It's about 100 to 200 euro are
quite expensive and also quite difficult

to obtain because it's also used for some
other more dangerous purposes. But there's

also also a way of maybe doing it by
yourself. So. Thanks, so, of course, we

were looking for recipes on the Internet
which are there, but that's much cooler.

That's the book here, which I got from my
15th birthday. I think it's a science book

for kids from quote unquote, Wesolowski
and also contains a recipe for making

fuming nitric acid. Also also with some
600000 fuming nitric acid works on wood,

for example, when it gets burning and so
on. So that's that's the recipe. And then

you, of course, need the equipment. So the
reaction is that concentrated sulfuric

acid, which can be bought, for example,
and pharmacist reacts, was potassium

nitrate, also typical of Pharmacy Chemica.
And then the fuming nitric acid, which is

generated, is distilled from this mixture.
You can see this in the picture as well.

That's the normal distillation apparatus.
The one which is used here is much

simpler. And on the right, that's a micro
distillation, distillation, glassware,

which can be used, for example, if you
only need some milliliters of this acid.

So typically for opening one package, I
would suggest, for example, five to 10

million liters of acid. So it does not
make sense to have more than than that.

I'm talking about professional chemicals
that are some more of these. So you you're

already recognized as the hazard of
pictograms which are here on the right

side. So these are chemicals which are not
harmless. And so therefore also they are

typically only available in a professional
or from professional sources, just some

chemicals or some chemicals which are good
solvents for epoxy material. So this means

in this case, the epoxy is not oxidized,
but it's dissolved. Or I should rather say

that it's it's swollen. So the molecules
of the solvent go into the epoxy and then

it swells and you can brush it away. It's
not material. The solvent process in this

case, um, besides these epoxy dissolving
chemicals, there are also some specialties

for some of the first one. Colene, this is
used in industry for cheap cleaning, but

also for wafer cleaning. And then finally,
the three ones on the bottom. These are

the assets which are used for destructive
opening nitric acid. You are not already

now. And then we have two other ones,
sulfuric acid, which must be used in a hot

variant, and also the so-called Olian,
which is a more aggressive version of the

sulfuric acid, which can be used also at
room temperature. So looking at

professional methods which are available,
for example, for semiconductor

manufacturers, if they want to do a
failure analysis, for example, then also

we have brought you some examples. And
this one here uses also fuming nitric

acid. It's a chemical capsule later. It's
a typical tool for industry if packages

are to be opened, for example, for failure
analyzers or other means. And so in this

case here, the acid is not dropped onto
the surface of the package, but it's first

heated and then it's pumped through a
small nozzle, which is made of Teflon of

glass. And then a jet of hot acid is
pushed on the surface of the package

itself. So this means all the reaction
products are readily flushed away and are

purged and the chip only comes in
connection with pure nitric acid. So this

means it can also not be damaged by
reaction products, which is very good. So

typically such devices give very good
results, but that's a disadvantage. Of

course, on the one hand side, it's
professional equipment that's quite

expensive, on the other hand, and you need
much higher volumes of the FUMIE nitric

acid. Typically, if you do it manually,
you would need five milliliters or 10 and

here you need much more, maybe 50
milliliters or even more. This one is a

sincere milling machine, which we would
also be using, for example, and

professional environment, and I think they
are a lock picking people here. I would

like to have something like this, too.
That's really nice machine, which can make

he programed milling. It has done not just
preprogrammed inside, but it can also

launch new packages. And the interesting
thing is that you can also use diamond

drills and thereby open ceramic packages.
Also, for example, from the back side, if

you want to get access to the chip side
for a special purpose. Nevertheless, this

equipment is very expensive, also an
operation. So this diamond dress cost very

have a high cost and last but not least,
very heavy. So it cannot be used in all

laboratories. This one here is a laser,
the capsule later laser the capsule that

is mainly laser scanner. And I think you
saw some of these on the assembly already

for cutting what are Styrofoam and so on.
And that's nearly the same. But it works

more on a on the microscopic level or
millimeter level. And so then hit by a

complete plastic package, for example, can
be scanned with a focused laser and laser

just evaporates the material. That's an
inch on a few more so that the reaction

products are purged. And so therefore,
that's really a nice way of opening

packages. Again, like for the machine that
are preprogrammed packages, but it can

also learn to use new packages.
Nevertheless, there are also disadvantages

of such methods. Again here, like Mockus
already set for the laser, you have a

thermal stress to the chip, which
sometimes can lead to breaking the chip,

which you don't want. And also, again, the
costs are quite high milling. And also

this laser encapsulation are typically not
used to completely open a package. It is

more used for generating a recess, which
is then further treated by chemical

etching. So this means you would only make
a recess and the plastic package, which is

nicely fitting the capsule as a chemical
to capture that. And then afterwards, this

fuming nitric acid, you would do the final
opening of the package either manually or

with an automatic version. So if the trip
is properly prepared and here, for

example, on the right, you can see a trip
which has opened with a professional, um,

a device, then you can have full access
first with a microscope. Of course, you

can see if there's a chip in the package.
You can have a look if there are some dye

markings which can lead you to a more
material literature, data sheets and so

on. Um, have a look inside what the
function may be and what this is used for

and the device which you are currently
investigating. But, uh, sometimes after

you have done that and the real fun
starts, which means preparation of an

attack or finding attack vectors and then
finally also at doing such attacks. So

attacks could be further reverse
engineering, for example, making a

complete preparation of the chip, grinding
away the different layers of it for, uh,

doing a complete reverse engineering. And
then if the package is opened, you can do

some attacks, which you normally won't do
or can't do with packages, um, with chips

and side, which are, for example, laser
attacks that you focus on the focus laser

on the chip to make some false or to
induce some wrong calculations inside.

There are many other devices which have
ultraviolet fuzes which can be erased, for

example, against code protection. One can
do permanent manipulations, for example,

by focus on beam or laser cutter, if
that's what all the chips, um, one can do.

Alpha radiation attacks because alpha
radiation also would not penetrate a

package, but, uh, they will penetrate the
silicon and then make faults, for example,

electromagnetic attacks by applying a
probe on the top of the chip or on the

backside. And, um, the one which I have
left out a photon emission. Such an

analysis. That's quite interesting. Um,
that's a way of looking at the chip, how

it generates infrared photons, while
calculating, for example, if a transistor

switches and photons are emitted. And
that's that's a method which we are

professionally using since 2001. But
recently I read in the press that also

some other people looking for this method,
uh, for example, the German one does not

wants to get such a device to, um, which
sounds quite, um. Yeah. Quite reasonable

to me because there are some smart catch
chips today available which are not

prepared against such kind of a text. And
also this may be a way of using this

photon emission, such an analysis for, um,
exploiting a backdoor which could be

induced by physically unclogging other
functions. If you are interested. We made

talk last year and we have also a small
chapter about it. But this would lead to

far in this environment here. So, um, if
you are interested in the topic itself

and, uh, want to have an overview, then we
would recommend this book that's, um,

available in German. But also there's an
English version of it which we have put

under the literature here. It's from a
Siemens failure analysis guy and the

contents of the package opening, but also
a chip preparation techniques. And there's

a nice presentation about using fuming
nitric acid for the capitulations from on

semiconductor in 2008. Um, if you use, um,
colorfully or Rosana sometimes called, um,

then there are two interesting projects.
One is from the cost of Belene. Um, it's

along with California, unfortunately is
only in Germany, in German. And then

there's also a project from the LEP which
is called As a Californian User, which is

an automated way of opening packages, was
kind of funny. And then finally, there's

also an interesting thing about laser chip
access, how to open chips with laser and

3D techniques. So these are only a few
points. Um, this book we have also an

assembly. So if you want to have a look
inside, then be invited to visit us today.

Finally, if you have a look inside chips
and sometimes, uh, interesting things open

up not only technology, not only attack
vectors, but sometimes you also see some

artwork. Sometimes today there's not much
place left because that's also cost, and

so therefore this year art is getting less
and less. But these are some examples

which we found sailboard and here in the
upper right corner, that citya arms of

Hamburg, which belongs to Chip from
Philips. All right. So that's not

complete. Our small presentation about
Chip opening. And now we have some some

minutes for questions, of course.

Herald: Wow, amazing. I see my shopping
list grow. So are there any questions, I

would say from from the Web? Are you OK?
Signal Angel: Indeed. OK, that's one

question from the Internet, and it's
concerning the left overs of the

chemicals. Um, do you have any hints about
how to get rid of them after you practice

in your private environment?
Peter: All right. So first of all, I would

recommend not to buy any chemicals that
you don't need, because that's all

environmental pollution which is generated
just in the moment they are produced. And

so, therefore, buy only the chemicals you
need, um, buy only the amounts of

chemicals that you need, I would
recommend. And then afterwards, there are

also ways of neutralizing these agents,
for example, fuming nitric acid can be

neutralized with baking soda, which also
we have on our list here. And so

therefore, I would have a look inside
Internet sources, for example, to see what

are the special ways of neutralizing each
agent. So for a private person, it's, I

would say nearly the same. Like for
industry or certainly industry, this

chemical are neutralized and then given
away to the appropriate institutions.

Sometimes you can just flush it away after
neutralizing it, but sometimes as a

result, you may be toxic and then you have
to give it to a special institution.

Herald: Question answered. Guess, um, any
more questions from from the web. OK, um,

I would say we do some load balancing. You
start first please.

Mic: Oh. Is there a way to actually verify
where our chips are identical. So if you

have two chips or whatever, they are the
same or generated using the same mask set?

Or any mechanical way to actually verify
that?

Peter: If these chips are identical. OK.
So if there would be a way, for example,

to make an X-ray, this would be, of
course, fine, because then you don't need

any preparation at all. So some years ago,
I would have recommended to ask your

dentist, for example, because he has an
X-ray. But normally X-rays are today not

used for other purposes purposes. They are
intended to. So therefore, X-ray would be,

of course, the best one to have a look
inside the chip. Um, if these are

smartcards, then sometimes infrared can
serve well, because also with infrared,

you can look through the smartcard itself
sometimes and then see the surrounding.

And also chips have typically
characteristic bond wires. So this means

that the alignment of bond wires. So where
are the pads, for example, differ also

from chip to chip. And finally, of course,
the marking, because typically a marking

is only valid for for one specific chip
and another chip, which would be in next

generation, for example, would also have a
different chip marking then.

Marcus: But anyhow, of course, so you can
distinguish whether this is the same

hardware or not very often today. Also,
the chips are equipped with some flash.

And later, if you open up one chip, you
can identify whether there's a nonvolatile

memory on the chip. And of course, you
cannot distinguish by the microscope

whether the same flash content is in there
or not. So it might be that in different

operating system or different programmers
running on such a microcontroller

containing some flash, even if this is the
same hardware. But at least, you know, OK,

this is the same hardware. And you're also
learning, as you have done on a first

chip, you can also use on the same ship.
Herald: Question answered? All right,

let's go.
Mic: So have you ever opened up a package

just to find you've been hit by a
counterfeit part?

Peter: Personally, not so. I know that are
many counterfeits, especially from from

Asia Pacific Range. And sometimes it's
quite interesting. I've seen such devices.

I did not open them by myself, but
sometimes that's a totally different chip.

And. So it does not even match the type of
functionality which what you would expect,

for example, instead of microcontrollers
as a 74 something logic chip inside, which

would not work at all.
Marcus: But again, here also, if you open

up the chip package, you can see the dye
marking and have no clue about the chip

itself and also about the functionality,
because the logical chip, uh, 74 series,

it's much less complexity and so quite
clearly visible in the microscope compared

to a microcontroller or something. So it's
quite easy to identify whether the

printing on the package is correct or
whether this is just a fake chip.

Mic: Well, that's not clear. But you know
what? After all.

Herald: Question answered? I guess. Yes,
please go. Go on.

Mic: So you said you can generally look at
chips using just optical microscopes, what

kind of magnification we can need for
different types of chips?

Peter: OK, so typically for a stereo
microscope, for preparation, you would

need only some five, four or twenty four
to magnification, but usually for looking

optically at chips, you would need a 100
fold to I would say five hundred fold

magnification. That's of course there's a
limit because of the technology gets

smaller than the wavelengths of light and
then you've got a problem. And so

therefore we also have recommended here
for amateurs or for beginners in this

topic to use all the chips, because you
have, for example, one point two

micrometer technology, which is far away
from from the wavelengths of the light.

But a few today would have, for example,
90 nanometer or 65 nanometers of the CPUs,

even 22 nanometers. So that's 20, 20 times
smaller than the wavelengths of light. And

then you don't see anything at all and
just colors.

Herald: Question answered?
Marcus: And please be invited to our

assembly later on because we have got a
microscope and some sample chips with us

so you can make some own experience in
there and watch the silicon and see what

kind of such you can see so please be
invited.

Herald: I'm totally sorry. I totally
overlooked Microphone four. Please, please

go ahead.
Mic: So if you have just a limited amount

of chips and want to maybe reuse them
again like we want them. Um..

Herald: Could you please repeat the
question with a microphone, because then

it's recorded.
Mic: Yeah, so if you have, like, only a

couple of chips and want to reuse them
again and dissolve epoxy, like what or

what method would you recommend to use?
Peter: All right. So if you want to use

them, um, after preparing, then it's very
important that there are no acid residues

left because we sometimes see, for
example, if you prepare a chip with fuming

nitric acid and there's just a small
amount of acid which is left, then after

one week or two week, the chips
deteriorate. And so this means that they

have to be and the acid has to be
neutralized very good. Rinsed with acetone

and then afterwards dry it carefully. So I
would recommend to to store them also

maybe, um, under dry conditions, but if
you are interesting. And afterwards you

could also contact us because we have some
methods also for conserving chips.

Herald: Question answered right from the
Internet, please.

Signal Angel: Yeah, there's another one.
Um, it's about have you noticed any

manufacturers implementing
countermeasures, new guards to decaping

the chips?
Marcus: So yes, indeed, there are some,

uh, countermeasures at advertised by, uh,
manufacturers who say, yes, we have a kind

of secure package. Uh, one of those secure
packages also shown in the presentation

where, for example, uh, special coverage
on top has been placed. Uh, but anyhow,

also there we have, uh, displayed some,
uh, methods in order to open up those

kinds of packages. So, uh, it's always a
trade off how much, uh, security you can

expect from the chip package. And so, in
my opinion, I think the package there are

so many, uh, methods to remove a package.
It could not be a completely secure

package just by the package itself. So if
you need to have some secrets inside a

chip, then really the chip hardware should
be secured and therefore protected against

spying out of those data. And this will be
more on logical ways, for example, using

encryption instead of using some, uh,
material in the package.

Peter: So there should be no trade off
between buying, uh, insecure or less

secure chip and then adding a package. We
think that the chip itself has to be

secure or secure enough, I should say, and
it cannot be afterwards put the security

cannot be put afterwards around the chip.
So that's not the way of, uh, of clean,

uh, engineering.
Herald: Right. Um, we have time for a last

question. If you could please keep short
and you guys also please go ahead.

Mic: I have a question about, uh, legal
problems. When you publish photos of the

internal parts, and maybe sharing in a
public database to to make education

better or I don't know.
Peter: Um, that's if you make photos of

chips themselves which you have prepared
by yourselves, then I think it should not

be critical. So we have also here are some
pictures which we made sometimes of our

own chips, sometimes of other chips. But
this does not contain any trade secrets,

for example. But of course, that's a
difficult question, especially if it goes,

for example, to pictures which contain
material where you see, for example code,

a ROM picture if you would publish a
picture of a ROM and then it could be that

this ROM contains code and then you would
publish this code. So it's very difficult

to tell which is which is right and which
is wrong. But, um, usually we don't think

that that just took pictures are critical.
Marcus: And it really depends also on the

resolution. If you have a complete chip
and a overal resolutions that you cannot

identify single lines and cannot use this
as a schematic to include such a chip,

then it's something different compared to
a high resolution picture where you can

draw a complete schematics in there, but
we can also talk later on in the assembly

more on this topic. And also I see some
further question, but I think we are

running out of time so we can do this
later on.

Herald: Yeah, great. Thank you very much.
Thank you for your questions.

applause

The guys with the open chips go to the
assembly and ask them if you have any more

questions, please. OK, thank you.

Subtitles created by c3subtitles.de
in the year 2021. Join, and help us!