3 ms·
Chris Tarnovsky is amazing, a true prodigy. Unfortunately, he gets bad advice on how to present his work. TPMs are what the media latched onto but are almost ir
by NateLawson 17y ago
Chris Tarnovsky is amazing, a true prodigy. Unfortunately, he gets bad advice on how to present his work. TPMs are what the media latched onto but are almost irrelevant to his advances.
What Chris presented is a full break of the Infineon SLE66PE secure microcontroller, used in smart cards for applications such as pay TV. This is one of the best of the current generation of smart cards. All of them have a layer of metal mesh that allows the chip to detect probing attempts. This processor also has optical sensors below that mesh (defense in depth?) It has many other countermeasures to prevent invasive attacks.
Chris's work in this area is astounding. He's now using a FIB whereas before he was just using microscopes and chemicals. This allows him to burn holes or deposit metal in the low tens of nanometers range. Combined with his old skills, this makes for a formiddable platform for defeating chip security measures.
His work on this chip is not easy, nor is it easily replicated. However, once someone with the resources and skills performs this kind of attack, it can enable much cheaper attacks later. For example, using this method to dump the ROM and then finding a software flaw in it would allow for attacks using ordinary PCs, no more physical manipulation needed. Or, you can build a jig ("drill here") that lets it be replicated by less skilled people using microprobing needles and ordinary microscopes. This reduces the cost of subsequent attacks.
TPMs have a poor security model to begin with. The exposed wires on the LPC bus (4 x 16 mhz) can be used to MITM it. The entire design is not meant to resist even board-level attacks, let alone invasive chip work. Claiming his talk is about TPMs is like saying cryptanalysis of SHA-1 is about breaking Django authentication. Sure it does, but there are much more important affected applications.
I actually think this validates the SLE66PE design. The fact that it required this much work gives me much more confidence about using it. Hopefully Infineon uses the information from Chris's talk to improve the next generations.
- ximeng 17y agoThis video on youtube: http://www.youtube.com/watch?v=tnY7UVyaFiQ http://www.youtube.com/watch?v=tnY7UVyaFiQ shows Chris analysing a smart card. Clever stuff.
- ximeng 17y agoTranscript for video (not sure if this is appropriate for here, please advise if not, but I thought it would be useful to read alongside the video) Chris Tarnovsky Hired by satellite TV industry Works independently in a San Diego lab Remove metal smart card Expose to acids Remove white epoxy Plastic breaks down after 10 minutes Acetone in two beakers Fuming nitric acid HNO3 applied to chip Rinsed in one acetone beaker Transferred to second "clean" beaker Scrape off the surface Ultrasound cleans off remaining residue Checks chip is clean using microscope attached to a computer screen Puts chip back in the credit card sized smartcard holder Chip is made up of two layers with a third layer as a security layer on top Need to burn a hole through the top layer to reach metal on the second layer Hole is made using a mask (nail polish?) Mask is left to dry Micropositioner holds a sewing type needle to scratch a hole Want to scratch a middle area where the databus is and a control line on the side Leave the needle where it is and remove from under the microscrope Drop of hydrofluoric acid (in "Rust Stain Remover" bottle) for 30 seconds Hydrofluoric acid is resistant to nail polish and magic marker Rinsed in water Then check how deep the acid etched under a microscope Repeat etching using 15 seconds (rate of etching increases with volume of acid and temperature) Rince in acetone Using UV light expose the lines of the chip (under microscope) Sit on the data bus with the needle. Yellow line (on oscilloscope) is what the needle is touching. Blue line represents Chris resetting the card. Build a log of what the chip does when it powers up 800 hexadecimal samples Can send management message to the chip and see what is done to decrypt it Can do anything at this point: read EEPROM, ROM