-
Marcus: Thank you for the kind
introduction. Welcome to our talk about
-
engaging microchips. So the background in
here is twofold. On the one hand side, we
-
would like to encourage you also to make
some own experiments and to see what is
-
inside a semiconductor device that means
what is inside a microchip. And so the
-
goal is that you also have some knowledge
how to open up a microchip and how to get
-
direct access to the silicon. On the other
hand, also, very often there's a rumor
-
that chip is highly secured because the
silicon is inside of plastic coverage. And
-
if a plastic package is really high
security, we can also explain today,
-
because very often even this amateur
equipment, it's possible to open up chips
-
and to get direct access to the silicon.
We are not only focusing on microchips,
-
but we are also focusing on more complex
systems, how to open up the system to get
-
access to the silicon in our background.
We have started more than 25 years ago
-
with analyzing the first telephone cards.
And so starting off with some experiments
-
at the Commodore 64, as well as working
with the first telephone card, it was our
-
major interest to find out what is the
functionality of this telephone card and
-
also what is inside. And of course, for
identifying what's inside. It was also our
-
target to open up stores, plastic cards
and to get access to the silicon chip
-
inside the telephone card. Nowadays, we
are also very often open up chips in order
-
to make some analysis or in order to apply
some high tech methods, for example, for
-
putting some over particular variation on
the top of the surface, also to apply some
-
laser. It's, of course, necessary to have
direct access to the silicon itself. And
-
therefore, also today we are utilizing a
lot of professional equipment in order to
-
observe chips. So today we would like to
give a short overview about the different
-
techniques and methods, how to open up
different kinds of chips, and also to
-
encourage you, because it is very
interesting also to open microchip
-
packages in order to get further analysis.
First of all, sometimes it's not quite
-
clear whether this is really a package
which contains a chip or whether there's
-
only a kind of label, as you can see, in
the lower picture. So in the lower
-
picture, it might be only a barcode labor,
but perhaps also an RFID chip might be in
-
there. And therefore, a first analysis.
It's the question, a inside the package.
-
And then, of course, also there's the
question, what is it about the chip
-
functionality itself? That means how many
functions are implemented in such a chip?
-
This is only a memory. Ship ourselves for
some logic inside there. And what kind of
-
logic is implemented here? And by the way,
on the most of the chips are also so-
-
called time markings. That means some
small numbers and these identified as the
-
silicon itself and these same markings as
possible to make some research and some,
-
um, findings from literature, as well as
also from tools in order to get more
-
information about the chip itself. And
finally, watching on the silicon itself
-
indicates also, if this is a more modern
chip, that means smaller technology or
-
whether this is an old fashioned chip. And
so you cannot expect so much functionality
-
or security funds the chip itself. So from
this perspective, these are some
-
motivation which also may encourage you to
open up some microchip packages and to
-
find out what's really inside there. We
have fought also three examples, um, to
-
show what is a potential finding out of
this. For example, it's well known that
-
some goods are tracked down with RFID
chips. And so recently we also got a t
-
shirt with a dedicated label inside here.
And it was not clear whether this label is
-
just about label or whether there are some
more, um, techniques inside the specialty
-
and RFID chip. So as you can see in the
second picture, it's quite easy to
-
identify if this is more than a barcode
label, because simply with a torch limb,
-
it's possible to eliminate those from the
back side. And so the flash indicates a.
-
There's something more than a bar code
inside there and indeed is some structure
-
inside. We have put this into a glass of
acetone and after a short while is the
-
label has to eliminate it. And so we can
got we got the final picture with the
-
antenna inside here. And in the middle of
the antenna is a small, dark spot. And
-
this is a chip. So it was clearly from the
antenna size, such as communicating in UHF
-
frequency range and also the small dot.
It's an hour edition. So now it's prepared
-
for further analysis with a microscope. So
you see, it might be very simple to get
-
some more information out here. Another
example brings us back where we back to
-
the history. And as I mentioned before, we
have started this investigation on
-
telephone cards. And, of course, not only
the telephone calls, but also the
-
telephone card system has been of high
interest for us. And so we were in lucky
-
situations that we found some, uh, printed
circuit boards from Cox Telephone where we
-
only got access to those because those car
telephones has been burned down
-
completely. So it was a huge fire. And so
inside is this area and so is the, um, uh,
-
telephone also get burned? Anyhow, we
managed to get those printed circuit
-
board. And in the second picture, you can
also see that the X-ray picture of the
-
printed circuit board, uh, clearly shows
that all the borrowings are still OK. So
-
it was possible for us to draw a dramatic,
uh, schematic and, uh, to see how the
-
different pins of this, uh, printed
circuit boards are connected. Well,
-
anyhow, it was not clear what are the
different shapes, because due to the heat,
-
simply the marking on the chip itself has
been vanished. So from this perspective,
-
we have used some, uh, capitulation method
in order to get the singer chips, the
-
silicone chips out of those devices. And
as you can see in the lower picture, then,
-
uh, with some, uh, microscopy work, we
were able to find out what is each single
-
chip. And so, uh, identifying the
different names of those chips and also
-
combining this was a schematic. It was
possible for us to, uh, resolve the main
-
function in those days from the cartoon
itself. And this gives us a clear clue in
-
what direction the telephone has worked in
those days. Yeah. And finally, also, there
-
was something in the beginning of 2000
there was a price competition. And is this
-
price competition, um, mean such as the
small sticker, which has to be applied to
-
the, uh, TV set. And then in this
perspective, uh, it was also that a lot of
-
rumors, whether this kind of spacechip
inside Syria and you see on the lower side
-
says, uh, some, um, comment from the
Internet at those days that there should
-
be an electronic chip inside Syria. And
this electronics should not only record
-
what you are watching on TV, but also, um,
make some sound recording in order to find
-
out how many people are in the room
watching this show and so on and so on.
-
But anyhow, um, we clearly thought, well,
this is just a rumor. And so, of course,
-
we use our, uh, techniques in order to
open up this device and also to find out,
-
uh, what's inside there. And in the end of
the day, it was clearly that this was only
-
a dot mask and below officers, there were
some foom which is photosensitive. And
-
when you watch, uh, special TV shows and
this film has been illuminated and
-
therefore it was clearly identifiable
whether this show has been seen or not. So
-
it was clear for us that we could identify
there's no spacechip inside and this was
-
only a rumor. So also, therefore, the
preparation techniques are quite useful
-
and helps to understand what's going in
inside Syria.
-
Peter: All right. Some some somewhat to
the chips and the packages. So there are
-
many thousands of different packages for
troops today. And sometimes the
-
functionality of the chip that just inside
will directly determine the way, such as
-
packaged. And this is the case for these
troops here especially. And if you look on
-
the left, that's an interesting thing. A
fingerprint sensor, which is another from.
-
Even use today with his fingerprints, and
this is a specialty that the chip itself
-
can be directly touched with the finger.
Normally you would avoid such a situation,
-
but here you have the direct silicone
accessible and there's only a frame which
-
is covering the surrounding of the chip to
make it mountable and the device itself.
-
Then we have a webcam webcam shown here,
which is just covered by a thin plate of
-
glass. Of course, the picture or the
optical radiation has to reach the chip
-
and therefore the same is true for your
microscope. You can directly observe such
-
chips without further preparation. Um,
yeah, I think the older one of you know,
-
this is prom type of memory, old fashioned
thing, but sometimes it's still seen
-
today. You can electrically write such an
issue from memory, but if you want to
-
erase it, you have to put it under
ultraviolet light to make the erasing
-
function. And so this means also this
package has a window in this case that's
-
made of silica because this uses to be UV
transparent. And again, you can have a
-
look inside without any preparation, which
sometimes quite interesting. And then on
-
the right, we have an amplifier chip shown
here and which is an instrumentation
-
amplifier, and therefore it should be
sealed from the environment, but also from
-
electromagnetic radiation. And this is
done here in this case by a ceramic
-
package. And this package has a metal that
over it. And again, here, it's very easy
-
to open this package. We will see later on
and was just using a blade. So all of
-
these four packages are quite interesting
for an amateur. You don't need any
-
equipment at all to have a look inside.
But as we said, from open to amateur hour,
-
some more difficult shops to open. And
here on the left side, that's a typical
-
chip which you will encounter and millions
today and all consumer goods. It's a
-
plastic package here. We have an order,
one which is a plastic package. But you
-
also know the surface mounted devices and
so on. So this plastic packages are quite
-
robust against environment, but also they
are robust against chemicals. And this
-
means you need quite harsh conditions to
open them and the chemical weigh. Are you
-
when it laser, which we will see later on,
epoxy resin. And the same is true for the
-
laptop package, which is a very low cost
kind of package, just as it is put on the
-
circuit board, then it's connected point
wires to the circuit board itself and then
-
afterwards just a drop of epoxy resin as
part of it. And you see, it's not a
-
rectangular form which should have. It's
more just a drop which put on top of
-
clocktower package is also seen here. And
the third picture, which is the smartcard
-
package, the typical one, if you would
turn this picture around, then you would
-
see on the other side that there are the
typical Golden Smartcard contacts. And
-
from the back side, it's a picture like
this. You have the chip and the chip is
-
connected, was bond wires to the
connection points and then afterwards to
-
hold it in place and also to make it
resistant from the environmental
-
conditions. It's also protected with a
blocked off package. So it just epoxy
-
resin is poured over it. And then finally
on the right is something which some
-
people call a security package. You see
that matterson hyphenation. Not only is it
-
dark so that you can see directly through
the through to the chip, but there's also
-
there can be some special Latisse, for
example, in this case, there's an
-
additional layer which is put on the chip,
which is also made of silicon itself. But
-
yeah, as we showed here, it's not I would
say it's not really security. And many
-
cases of this package, just because of the
security, does not start in the chip
-
itself. And I would say then it's a little
bit too late. All right. So what can you
-
see if you look inside such chips and we
have chosen some examples where you don't
-
need any preparation at all. Here you can
see some memories for beginning. It's
-
quite interesting to have a look at all
the chips which are sometimes available to
-
store. And that's because simple fact. And
the older days, the technologies were not
-
so small as today. So this means you can
see the structures. What's your barai or
-
maybe you need your grandfather's
magnifying glass, maybe, but you don't
-
need a high definition microscope. And so
here on the far left, that's a chip from
-
nineteen seventy six, very old one very
small memory. And you can directly see
-
with your eye all the structures inside
just through the window without opening it
-
at all. And then if we proceed in time
also to a vintage chip from nineteen
-
eighty eight, one megabit it from there.
See already it's more like a gray mass,
-
that's a memory cells and you definitely
would need a microscope to have a further
-
look inside how such a memory is built and
to analyze it. And then on the right.
-
That's also an interesting example of a
memory. But this memory has some access,
-
right. Tied to it, because that's the
telephone chip card. And here you have a
-
very small memory of only 88 bits. But the
rest is controlled logic so that only the
-
people who are or should be allowed to
load it and to erase it have this access
-
rights given to them. And if we look at
the little microcontroller units and they
-
are quite more interesting than just a
memory. And here again, we have four
-
different chips brought to you. Two of
those also have windows. You don't need
-
any preparation at all. And the one on the
left is, again, a chip from nineteen
-
seventy six, very old. One can see
directly all the different structures like
-
Rom Ram that you prompt part and also the
logic part which contains the CPU and also
-
some analog devices which are needed for
the functionality of the chip. I think
-
that pick 16, the second picture, you
know, and the flash version, which is very
-
common today, you just can program it and
erase it again and a normal device. But in
-
1988, these types of the control that were
made was EPROM. So this means you could
-
program it. And then if you want to erase
it again for reprograming, you have to put
-
it under ultraviolet lamp for five
minutes. So therefore, there are some
-
older versions of the controller. But what
you can see is that the technology is
-
smaller and that the chip is just a very
high density and comparison to the chip,
-
which is 12 years older. Interestingly,
the smart all the smart card controls look
-
quite the same, like these older devices.
And they also have from RAM you prom are
-
normally prom. So electrical eraser, a
programable rom. And so therefore the
-
smart card units, even those of in the 90s
look like the same, like the older and
-
serious. And finally, just for comparison,
we also brought a sixty eight case. If you
-
this has only cash but no nonvolatile
memory and was used in some old home
-
computers for example, but also in
instrumentation technology. So what do you
-
need if you want to start with preparing
microchips. Just to have a look, if it's
-
interesting for you to have a glimpse
inside. So what you definitely need is a
-
simple microscope. And we showed there a
student version that's about 300 euros.
-
But they are also quite interesting USB
microscopes today and which come ready for
-
use for about 150 euros. So that's quite
good tools. You need definitely some
-
mechanical tools like scalpels, tweezers,
which we have here sometimes some sort of
-
dentist tools, which also would serve
quite well, an ultrasonic cleaner. It's a
-
very good thing to have because this is
really nice for package preparation,
-
cleaning, but also removing particles and
also of the chip is prepared and ready.
-
Then you can remove all remaining residues
and particles from it. And finally, there
-
are three solvents which you need for
beginners, which is alcohol, ethanol and
-
acetone and also benzene. These are three
solvents from non polla to polla type. And
-
with these three solvents, you can open a
lot of different packages. Then for
-
upgrading such equipment, it's quite
interesting to have a 3-D view. So was a
-
stereo microscope. You can make
preparation with both your eyes. You have
-
a 3-D vision and you can directly see what
you are doing, which is sometimes quite
-
difficult. If you have on your monocular
side, then if you want to share your
-
results, a microscope camera could serve
your well, which is available for about
-
300 euros. But there are also some DIY
versions, for example, with no cameras
-
which are adapted to the microscope
itself. Some further chemicals can be
-
needed, which I will also show you later
on the table, which are not without
-
danger, I would say, and therefore also
typically a lab coat and some protective
-
wear would be used. So now we are in a
moment we will come to a different details
-
of how to open a package and and the steps
itself. And this will be sorted from
-
physical opening statements, the methods
or mechanical methods over to chemical
-
methods for you directly open. So device
with chemical means. But there's also a
-
mixture of both. And therefore, I would
like to hand over to Marcus.
-
Marcus: Yes, thank you. Let's go to the
workbench and open some packages. So
-
beginning, as Peter mentioned, with the
physical ones. And the first one is quite
-
easy. You just need advice. And as you
puts a chip inside vis a with the lower
-
part of the I see as depicted in the first
picture and then you just put some more
-
forces to the I see. Pictures save and
during the time device will be smaller and
-
smaller, the package will break up and the
upper part lift up. So as visible in the
-
third picture, you can use a simple
screwdriver to remove the upper limit. And
-
then finally, in the last picture, it's
visible that the bare silicon chip is
-
visible for your further analysis, also
connected to the lead frame. So the frame
-
which connects to the outer pins and to
the outer communication. So this is a
-
quite simple method. And indeed, this is
the first method we have also used in the
-
example of the copper telephone I have
explained earlier. So it was quite easy to
-
break up those chips in order to get the
silicon parts out of the ICS and then
-
analyzing them with a microscope, even if
the package will be a little bit more
-
hardened. For example, a ceramic housing
like use in eponyms, then it's also a good
-
idea to have fixes and device and just to
replace a screwdriver on the top part of
-
the see, and there's a small bump on the
back of the screwdriver. The upper limit
-
will be removed. And as you can see in the
chart picture directly, the access to the
-
chip is possible. So indeed, I think these
pictures clearly identify that this must
-
be not high, sophisticated techniques or
some sensors, sometimes really a normal
-
workbenches sufficient to get access to
very easy. It's in the case if there's a
-
special package, as Peter has explained,
with such a metal lid on top of this,
-
because this method to it is sold out on
the academic housing. And typically you
-
can think about where grindings as a way
or try to sold out or something like. But
-
there's a very easy method to open up
those kinds of packages. You just use a
-
blade as visible in the second picture
and, um, use a hammer for a small store.
-
And then this blade drives and is this
metal dirt and you can simply lift off
-
this metal without any further, um,
effort. So it's just, uh, two seconds, uh,
-
work to open up those kinds of packages.
And even those blades are quite easy to
-
access because you can see in the lower
pictures that they are sold also in
-
discounters for, uh, cleaners of Deskovic.
So these blades are easy to use just with
-
the hammer. You can drive them below the
lid. And so this opens. So you see
-
physical mechanisms can be very easy. Now,
as also mentioned before, our first topic
-
has been to, uh, check what's inside a
telephone card. And, of course. Such a
-
physical preparation, it's more
complicated on a small plastic card, and
-
therefore it more goes into the direction
of physical chemical reaction on source
-
cards. And you can see here in this hall
of pictures, we have just played such a
-
smart card in it's. And after five
minutes, as was a in the second picture,
-
the plastic of the card absorbed some
acetone and therefore swails. After 15
-
minutes, you can just wait for those
minutes. Then the structure is fully
-
destroyed. And so it's quite easy to
remove the remaining plastic parts as
-
visible on the fourth picture in the
apple. So, again, just by waiting about 15
-
minutes in, etc. on the smart card is um.
Yeah, destroyed. And so, um, as visible in
-
the lower picture, all it's possible to
remove the antenna and censorchip itself.
-
And I think the result and the last
picture on the law, uh oh it's quite
-
impressive. It's a complete antenna,
including the chip has been resolved out
-
of this, uh, plastic card. And so, um, it
was quite easy to analyze the antenna and
-
the size and how this is implemented in
here. Anyhow, you may recognize that the
-
chip is still covered by, uh, uh, a
laptop. That means a small piece of, uh,
-
epoxy on top of this. And so it's a
question how to remove this here. It's
-
possible to use, for example, a laser
with, uh, um, infrared laser, especially
-
for about Servais flying of 10000
nanometers. Um, it's quite useful to open
-
up those kinds of pictures because the
silicon itself is transparent for such an
-
infrared radiation. So the chip itself
would be not directly affected by the
-
infrared radiation, but all the energy
will be absorbed by the package itself. So
-
it's just a trauma to, um, destruction of
the package as visible in the lower
-
picture. And especially also this is quite
useful to open up so-called secure
-
pictures, as Peter has explained. So even
those kinds of packages, uh, are just
-
applied with a laser and, um, it's opened
up so that all the, um, silicon can be
-
directly accessed. Anyhow, this, uh, may
also be some risk. It appears on the one
-
hand side, the risk that the chips to get
damage due to the fact that is, uh,
-
package components are heated up and
souless temperature could also be applied
-
to the silicon chip itself or make some,
uh, Tominaga medical attention and
-
therefore, chip may break down. On the
other hand, of course, infrared laser
-
radiation may also, um, make some, uh,
health, uh, difficulties. And therefore,
-
it's very important, um, to be careful
with those laser radiations. So question
-
is, OK, how to open up epoxy in other
ways, not, uh, having such a laser, and
-
therefore for us, again, a physical
preparation take place. So for applying
-
Shamika, it's it's very good to prepare
the chips with some, um, mechanical
-
preparation. And you see here again, the
chip and advise and then with a grinding
-
disk and some parallel movement as visible
in the, uh, third picture here. And this
-
whole small curve has been set up. And so
we have two advantages in here. The first
-
advantage is that already some material is
finished. And so therefore we have, uh,
-
faster access to the silicone and save. On
the other hand, also, we have some, uh,
-
area where some chemicals can be dropped
on and, uh, will take place here. So let's
-
go with the chip to the, uh, Shamika
treatment. And here again, in the first
-
two pictures, you'll see the preparation
by the mechanical grinding and censorchip
-
is, uh, put into a sandbaggers, which is
heated up. So at about 50 to 90 degrees
-
Celsius, send some nitric acid, uh, will
be dropped on there. And just after
-
overseer's epoxy will be removed and, uh,
you can get direct access to the silicone.
-
So after you have the desired result, that
means after all the epoxy has gone, you
-
can remove the rest of the. Set by using
some acetone, as was a boot in the lower
-
picture. Um, hole and also it's a good
idea to clean up, um, the chip into the
-
ultrasonic cleaner in order to remove the
remaining particles. If you don't want to
-
wait for a long time, then you can again
use some acetone in order to have some
-
carpet try drying. And finally, you have a
very good, uh, preparation where you have
-
access to the silicone, but also have, uh,
the connection. Uh, most of the cases do
-
OK for using the chip and operating the
chip in this environment. Anyhow, as this
-
is, it may also damage some parts of the
chips. And therefore, it's also the
-
question if you do not need to operate the
chip, but just for inspection, that's
-
another method to open up those kinds of
epoxy. And it's just using California or
-
in German, California. Um, so putting
parts of California together with a chip
-
into, um, glass, then you can heat up this
to the boiling point. It's about, uh,
-
three hundred twenty two or three hundred
sixty degrees Celsius. So it's possible to
-
use simply a heat gun and make this very
fast anyhow by using so, uh, such a heat
-
gun and, uh, heating up California. It
also makes some ugly smells. So be
-
prepared that this is not in your living
room because otherwise you won't access a
-
living room for the next days. Anyhow,
after a short while, about five to 20
-
minutes depend on the, uh, package itself,
how big this package is. Um, the epoxy is
-
completely dissolved and therefore the
chip could be, uh, taken out of this and
-
can be cleaned again in acetone. So you
see in the last picture on the top, oh,
-
it's a very good, uh, way to expect to
complete a chip and to get, uh, good
-
access to the silicone. But anyhow, in
this case, of course, the chip cannot be
-
operated any further. It's also the
connections, the bonding wires and solid
-
frame, uh, has been dissolved in the
California. And therefore, um, it's not
-
operational anymore. So you see there are
also some shemekia ways for using even as
-
an amateur and so for using those kinds of
Shamika, there's also the question of what
-
kind of chemicals can be used in here.
Peter: Marcus already showed you some
-
examples were in the process. You need
some chemicals, and so typically a problem
-
with chemicals is that they are quite hard
to obtain, especially for private persons.
-
And they are typically, if they are pure,
quite expensive, especially if you buy
-
them in small quantities. And therefore,
we have set up a small list which contains
-
chemicals which are available readily from
household products, or we would say from
-
the supermarket. And these chemicals here
are listed. And alphanumeric order also
-
was a German name because they are quite
different from the English name. And what
-
mainly is available in supermarkets or
household products are quite pure
-
chemicals. And these are solvents. And
remember, we need solvents for opening
-
packages, especially if we want to
dissolve one kind of plastic, but not the
-
other. For example, opening an RFID label
are you don't want to destroy the antenna
-
itself, which is put on a plastic, but you
want to open the package where the antenna
-
is put inside the laminate. And so
therefore, we have put together several
-
chemicals from acetone, for example, over
benzene, ethanol, but also ethylene glycol
-
and PACULA ethylene, which are solvents
for different kinds of plastics, which you
-
can see in the US case, raw. That's a very
special solvent, which is the second last
-
one for tetra, hydro for rain. And because
this dissolves also Pevensie polyvinyl
-
chloride, which is normally robust and
could not be dissolved. But with this
-
special solvent, you can also dissolve
privacy. Then, of course, you need the
-
mineralized water or distilled water. It's
sometimes called the jar because we don't
-
want to leave residues on the on the
chips, especially if cleaning them, for
-
example, in the ultrasonic bath. And
there's also some chemicals like the
-
sodium bicarbonate and sodium hydroxide,
which is needed to neutralize acids. But
-
it also can be used, for example, to
dissolve aluminum. And aluminum is also
-
used, for example, for Antenna's on Earth
text. So you can dissolve it away and just
-
the chip is left open. Um, that's one
chemical which is not available in the
-
supermarket. I think that's also a good
idea. That's not there. And that's a
-
fuming nitric acid. And assuming nitric
acid is often used in professional
-
versions of packaged opening, that's we
will see later on for destroying epoxy
-
material. So directly oxidizers the
material and it's less an acid, then more
-
and Occident, at least if it's water free.
So if the water was just mixed with acid,
-
then it gets more acid characteristics and
then it will destroy metals and also the
-
chip itself, therefore. And if one uses
it, it should be water free. Um, of course
-
if it destroys epoxy materials and it can
also destroy skin, closer's your
-
furniture, everything, all your devices
are rusting away and so on. So that's
-
really a nasty and therefore appropriate
safety equipment must be used so it can be
-
bought. It's about 100 to 200 euro are
quite expensive and also quite difficult
-
to obtain because it's also used for some
other more dangerous purposes. But there's
-
also also a way of maybe doing it by
yourself. So. Thanks, so, of course, we
-
were looking for recipes on the Internet
which are there, but that's much cooler.
-
That's the book here, which I got from my
15th birthday. I think it's a science book
-
for kids from quote unquote, Wesolowski
and also contains a recipe for making
-
fuming nitric acid. Also also with some
600000 fuming nitric acid works on wood,
-
for example, when it gets burning and so
on. So that's that's the recipe. And then
-
you, of course, need the equipment. So the
reaction is that concentrated sulfuric
-
acid, which can be bought, for example,
and pharmacist reacts, was potassium
-
nitrate, also typical of Pharmacy Chemica.
And then the fuming nitric acid, which is
-
generated, is distilled from this mixture.
You can see this in the picture as well.
-
That's the normal distillation apparatus.
The one which is used here is much
-
simpler. And on the right, that's a micro
distillation, distillation, glassware,
-
which can be used, for example, if you
only need some milliliters of this acid.
-
So typically for opening one package, I
would suggest, for example, five to 10
-
million liters of acid. So it does not
make sense to have more than than that.
-
I'm talking about professional chemicals
that are some more of these. So you you're
-
already recognized as the hazard of
pictograms which are here on the right
-
side. So these are chemicals which are not
harmless. And so therefore also they are
-
typically only available in a professional
or from professional sources, just some
-
chemicals or some chemicals which are good
solvents for epoxy material. So this means
-
in this case, the epoxy is not oxidized,
but it's dissolved. Or I should rather say
-
that it's it's swollen. So the molecules
of the solvent go into the epoxy and then
-
it swells and you can brush it away. It's
not material. The solvent process in this
-
case, um, besides these epoxy dissolving
chemicals, there are also some specialties
-
for some of the first one. Colene, this is
used in industry for cheap cleaning, but
-
also for wafer cleaning. And then finally,
the three ones on the bottom. These are
-
the assets which are used for destructive
opening nitric acid. You are not already
-
now. And then we have two other ones,
sulfuric acid, which must be used in a hot
-
variant, and also the so-called Olian,
which is a more aggressive version of the
-
sulfuric acid, which can be used also at
room temperature. So looking at
-
professional methods which are available,
for example, for semiconductor
-
manufacturers, if they want to do a
failure analysis, for example, then also
-
we have brought you some examples. And
this one here uses also fuming nitric
-
acid. It's a chemical capsule later. It's
a typical tool for industry if packages
-
are to be opened, for example, for failure
analyzers or other means. And so in this
-
case here, the acid is not dropped onto
the surface of the package, but it's first
-
heated and then it's pumped through a
small nozzle, which is made of Teflon of
-
glass. And then a jet of hot acid is
pushed on the surface of the package
-
itself. So this means all the reaction
products are readily flushed away and are
-
purged and the chip only comes in
connection with pure nitric acid. So this
-
means it can also not be damaged by
reaction products, which is very good. So
-
typically such devices give very good
results, but that's a disadvantage. Of
-
course, on the one hand side, it's
professional equipment that's quite
-
expensive, on the other hand, and you need
much higher volumes of the FUMIE nitric
-
acid. Typically, if you do it manually,
you would need five milliliters or 10 and
-
here you need much more, maybe 50
milliliters or even more. This one is a
-
sincere milling machine, which we would
also be using, for example, and
-
professional environment, and I think they
are a lock picking people here. I would
-
like to have something like this, too.
That's really nice machine, which can make
-
he programed milling. It has done not just
preprogrammed inside, but it can also
-
launch new packages. And the interesting
thing is that you can also use diamond
-
drills and thereby open ceramic packages.
Also, for example, from the back side, if
-
you want to get access to the chip side
for a special purpose. Nevertheless, this
-
equipment is very expensive, also an
operation. So this diamond dress cost very
-
have a high cost and last but not least,
very heavy. So it cannot be used in all
-
laboratories. This one here is a laser,
the capsule later laser the capsule that
-
is mainly laser scanner. And I think you
saw some of these on the assembly already
-
for cutting what are Styrofoam and so on.
And that's nearly the same. But it works
-
more on a on the microscopic level or
millimeter level. And so then hit by a
-
complete plastic package, for example, can
be scanned with a focused laser and laser
-
just evaporates the material. That's an
inch on a few more so that the reaction
-
products are purged. And so therefore,
that's really a nice way of opening
-
packages. Again, like for the machine that
are preprogrammed packages, but it can
-
also learn to use new packages.
Nevertheless, there are also disadvantages
-
of such methods. Again here, like Mockus
already set for the laser, you have a
-
thermal stress to the chip, which
sometimes can lead to breaking the chip,
-
which you don't want. And also, again, the
costs are quite high milling. And also
-
this laser encapsulation are typically not
used to completely open a package. It is
-
more used for generating a recess, which
is then further treated by chemical
-
etching. So this means you would only make
a recess and the plastic package, which is
-
nicely fitting the capsule as a chemical
to capture that. And then afterwards, this
-
fuming nitric acid, you would do the final
opening of the package either manually or
-
with an automatic version. So if the trip
is properly prepared and here, for
-
example, on the right, you can see a trip
which has opened with a professional, um,
-
a device, then you can have full access
first with a microscope. Of course, you
-
can see if there's a chip in the package.
You can have a look if there are some dye
-
markings which can lead you to a more
material literature, data sheets and so
-
on. Um, have a look inside what the
function may be and what this is used for
-
and the device which you are currently
investigating. But, uh, sometimes after
-
you have done that and the real fun
starts, which means preparation of an
-
attack or finding attack vectors and then
finally also at doing such attacks. So
-
attacks could be further reverse
engineering, for example, making a
-
complete preparation of the chip, grinding
away the different layers of it for, uh,
-
doing a complete reverse engineering. And
then if the package is opened, you can do
-
some attacks, which you normally won't do
or can't do with packages, um, with chips
-
and side, which are, for example, laser
attacks that you focus on the focus laser
-
on the chip to make some false or to
induce some wrong calculations inside.
-
There are many other devices which have
ultraviolet fuzes which can be erased, for
-
example, against code protection. One can
do permanent manipulations, for example,
-
by focus on beam or laser cutter, if
that's what all the chips, um, one can do.
-
Alpha radiation attacks because alpha
radiation also would not penetrate a
-
package, but, uh, they will penetrate the
silicon and then make faults, for example,
-
electromagnetic attacks by applying a
probe on the top of the chip or on the
-
backside. And, um, the one which I have
left out a photon emission. Such an
-
analysis. That's quite interesting. Um,
that's a way of looking at the chip, how
-
it generates infrared photons, while
calculating, for example, if a transistor
-
switches and photons are emitted. And
that's that's a method which we are
-
professionally using since 2001. But
recently I read in the press that also
-
some other people looking for this method,
uh, for example, the German one does not
-
wants to get such a device to, um, which
sounds quite, um. Yeah. Quite reasonable
-
to me because there are some smart catch
chips today available which are not
-
prepared against such kind of a text. And
also this may be a way of using this
-
photon emission, such an analysis for, um,
exploiting a backdoor which could be
-
induced by physically unclogging other
functions. If you are interested. We made
-
talk last year and we have also a small
chapter about it. But this would lead to
-
far in this environment here. So, um, if
you are interested in the topic itself
-
and, uh, want to have an overview, then we
would recommend this book that's, um,
-
available in German. But also there's an
English version of it which we have put
-
under the literature here. It's from a
Siemens failure analysis guy and the
-
contents of the package opening, but also
a chip preparation techniques. And there's
-
a nice presentation about using fuming
nitric acid for the capitulations from on
-
semiconductor in 2008. Um, if you use, um,
colorfully or Rosana sometimes called, um,
-
then there are two interesting projects.
One is from the cost of Belene. Um, it's
-
along with California, unfortunately is
only in Germany, in German. And then
-
there's also a project from the LEP which
is called As a Californian User, which is
-
an automated way of opening packages, was
kind of funny. And then finally, there's
-
also an interesting thing about laser chip
access, how to open chips with laser and
-
3D techniques. So these are only a few
points. Um, this book we have also an
-
assembly. So if you want to have a look
inside, then be invited to visit us today.
-
Finally, if you have a look inside chips
and sometimes, uh, interesting things open
-
up not only technology, not only attack
vectors, but sometimes you also see some
-
artwork. Sometimes today there's not much
place left because that's also cost, and
-
so therefore this year art is getting less
and less. But these are some examples
-
which we found sailboard and here in the
upper right corner, that citya arms of
-
Hamburg, which belongs to Chip from
Philips. All right. So that's not
-
complete. Our small presentation about
Chip opening. And now we have some some
-
minutes for questions, of course.
-
Herald: Wow, amazing. I see my shopping
list grow. So are there any questions, I
-
would say from from the Web? Are you OK?
Signal Angel: Indeed. OK, that's one
-
question from the Internet, and it's
concerning the left overs of the
-
chemicals. Um, do you have any hints about
how to get rid of them after you practice
-
in your private environment?
Peter: All right. So first of all, I would
-
recommend not to buy any chemicals that
you don't need, because that's all
-
environmental pollution which is generated
just in the moment they are produced. And
-
so, therefore, buy only the chemicals you
need, um, buy only the amounts of
-
chemicals that you need, I would
recommend. And then afterwards, there are
-
also ways of neutralizing these agents,
for example, fuming nitric acid can be
-
neutralized with baking soda, which also
we have on our list here. And so
-
therefore, I would have a look inside
Internet sources, for example, to see what
-
are the special ways of neutralizing each
agent. So for a private person, it's, I
-
would say nearly the same. Like for
industry or certainly industry, this
-
chemical are neutralized and then given
away to the appropriate institutions.
-
Sometimes you can just flush it away after
neutralizing it, but sometimes as a
-
result, you may be toxic and then you have
to give it to a special institution.
-
Herald: Question answered. Guess, um, any
more questions from from the web. OK, um,
-
I would say we do some load balancing. You
start first please.
-
Mic: Oh. Is there a way to actually verify
where our chips are identical. So if you
-
have two chips or whatever, they are the
same or generated using the same mask set?
-
Or any mechanical way to actually verify
that?
-
Peter: If these chips are identical. OK.
So if there would be a way, for example,
-
to make an X-ray, this would be, of
course, fine, because then you don't need
-
any preparation at all. So some years ago,
I would have recommended to ask your
-
dentist, for example, because he has an
X-ray. But normally X-rays are today not
-
used for other purposes purposes. They are
intended to. So therefore, X-ray would be,
-
of course, the best one to have a look
inside the chip. Um, if these are
-
smartcards, then sometimes infrared can
serve well, because also with infrared,
-
you can look through the smartcard itself
sometimes and then see the surrounding.
-
And also chips have typically
characteristic bond wires. So this means
-
that the alignment of bond wires. So where
are the pads, for example, differ also
-
from chip to chip. And finally, of course,
the marking, because typically a marking
-
is only valid for for one specific chip
and another chip, which would be in next
-
generation, for example, would also have a
different chip marking then.
-
Marcus: But anyhow, of course, so you can
distinguish whether this is the same
-
hardware or not very often today. Also,
the chips are equipped with some flash.
-
And later, if you open up one chip, you
can identify whether there's a nonvolatile
-
memory on the chip. And of course, you
cannot distinguish by the microscope
-
whether the same flash content is in there
or not. So it might be that in different
-
operating system or different programmers
running on such a microcontroller
-
containing some flash, even if this is the
same hardware. But at least, you know, OK,
-
this is the same hardware. And you're also
learning, as you have done on a first
-
chip, you can also use on the same ship.
Herald: Question answered? All right,
-
let's go.
Mic: So have you ever opened up a package
-
just to find you've been hit by a
counterfeit part?
-
Peter: Personally, not so. I know that are
many counterfeits, especially from from
-
Asia Pacific Range. And sometimes it's
quite interesting. I've seen such devices.
-
I did not open them by myself, but
sometimes that's a totally different chip.
-
And. So it does not even match the type of
functionality which what you would expect,
-
for example, instead of microcontrollers
as a 74 something logic chip inside, which
-
would not work at all.
Marcus: But again, here also, if you open
-
up the chip package, you can see the dye
marking and have no clue about the chip
-
itself and also about the functionality,
because the logical chip, uh, 74 series,
-
it's much less complexity and so quite
clearly visible in the microscope compared
-
to a microcontroller or something. So it's
quite easy to identify whether the
-
printing on the package is correct or
whether this is just a fake chip.
-
Mic: Well, that's not clear. But you know
what? After all.
-
Herald: Question answered? I guess. Yes,
please go. Go on.
-
Mic: So you said you can generally look at
chips using just optical microscopes, what
-
kind of magnification we can need for
different types of chips?
-
Peter: OK, so typically for a stereo
microscope, for preparation, you would
-
need only some five, four or twenty four
to magnification, but usually for looking
-
optically at chips, you would need a 100
fold to I would say five hundred fold
-
magnification. That's of course there's a
limit because of the technology gets
-
smaller than the wavelengths of light and
then you've got a problem. And so
-
therefore we also have recommended here
for amateurs or for beginners in this
-
topic to use all the chips, because you
have, for example, one point two
-
micrometer technology, which is far away
from from the wavelengths of the light.
-
But a few today would have, for example,
90 nanometer or 65 nanometers of the CPUs,
-
even 22 nanometers. So that's 20, 20 times
smaller than the wavelengths of light. And
-
then you don't see anything at all and
just colors.
-
Herald: Question answered?
Marcus: And please be invited to our
-
assembly later on because we have got a
microscope and some sample chips with us
-
so you can make some own experience in
there and watch the silicon and see what
-
kind of such you can see so please be
invited.
-
Herald: I'm totally sorry. I totally
overlooked Microphone four. Please, please
-
go ahead.
Mic: So if you have just a limited amount
-
of chips and want to maybe reuse them
again like we want them. Um..
-
Herald: Could you please repeat the
question with a microphone, because then
-
it's recorded.
Mic: Yeah, so if you have, like, only a
-
couple of chips and want to reuse them
again and dissolve epoxy, like what or
-
what method would you recommend to use?
Peter: All right. So if you want to use
-
them, um, after preparing, then it's very
important that there are no acid residues
-
left because we sometimes see, for
example, if you prepare a chip with fuming
-
nitric acid and there's just a small
amount of acid which is left, then after
-
one week or two week, the chips
deteriorate. And so this means that they
-
have to be and the acid has to be
neutralized very good. Rinsed with acetone
-
and then afterwards dry it carefully. So I
would recommend to to store them also
-
maybe, um, under dry conditions, but if
you are interesting. And afterwards you
-
could also contact us because we have some
methods also for conserving chips.
-
Herald: Question answered right from the
Internet, please.
-
Signal Angel: Yeah, there's another one.
Um, it's about have you noticed any
-
manufacturers implementing
countermeasures, new guards to decaping
-
the chips?
Marcus: So yes, indeed, there are some,
-
uh, countermeasures at advertised by, uh,
manufacturers who say, yes, we have a kind
-
of secure package. Uh, one of those secure
packages also shown in the presentation
-
where, for example, uh, special coverage
on top has been placed. Uh, but anyhow,
-
also there we have, uh, displayed some,
uh, methods in order to open up those
-
kinds of packages. So, uh, it's always a
trade off how much, uh, security you can
-
expect from the chip package. And so, in
my opinion, I think the package there are
-
so many, uh, methods to remove a package.
It could not be a completely secure
-
package just by the package itself. So if
you need to have some secrets inside a
-
chip, then really the chip hardware should
be secured and therefore protected against
-
spying out of those data. And this will be
more on logical ways, for example, using
-
encryption instead of using some, uh,
material in the package.
-
Peter: So there should be no trade off
between buying, uh, insecure or less
-
secure chip and then adding a package. We
think that the chip itself has to be
-
secure or secure enough, I should say, and
it cannot be afterwards put the security
-
cannot be put afterwards around the chip.
So that's not the way of, uh, of clean,
-
uh, engineering.
Herald: Right. Um, we have time for a last
-
question. If you could please keep short
and you guys also please go ahead.
-
Mic: I have a question about, uh, legal
problems. When you publish photos of the
-
internal parts, and maybe sharing in a
public database to to make education
-
better or I don't know.
Peter: Um, that's if you make photos of
-
chips themselves which you have prepared
by yourselves, then I think it should not
-
be critical. So we have also here are some
pictures which we made sometimes of our
-
own chips, sometimes of other chips. But
this does not contain any trade secrets,
-
for example. But of course, that's a
difficult question, especially if it goes,
-
for example, to pictures which contain
material where you see, for example code,
-
a ROM picture if you would publish a
picture of a ROM and then it could be that
-
this ROM contains code and then you would
publish this code. So it's very difficult
-
to tell which is which is right and which
is wrong. But, um, usually we don't think
-
that that just took pictures are critical.
Marcus: And it really depends also on the
-
resolution. If you have a complete chip
and a overal resolutions that you cannot
-
identify single lines and cannot use this
as a schematic to include such a chip,
-
then it's something different compared to
a high resolution picture where you can
-
draw a complete schematics in there, but
we can also talk later on in the assembly
-
more on this topic. And also I see some
further question, but I think we are
-
running out of time so we can do this
later on.
-
Herald: Yeah, great. Thank you very much.
Thank you for your questions.
-
applause
-
The guys with the open chips go to the
assembly and ask them if you have any more
-
questions, please. OK, thank you.
-
Subtitles created by c3subtitles.de
in the year 2021. Join, and help us!