8 ms·
X-ray technique can reverse-engineer an entire chip without damaging it
- askz 7y agoNice, china is glad to hear that
- jiveturkey 7y agochina has no problem destructively reverse engineering chips. they aren't validating them, they are copying them. and the destructive method may be time consuming, but surely for China it's cheaper? this technique would be more like CMM validation of a part after manufacturing. very, very useful but with a different goal in mind.
- penagwin 7y agoPlus aren't many chips made in China? My impression after watching BigClive tear apart stuff was that a lot of Chinese clones use their own chips, and many chips are custom and seem to only exist between Chinese manufacturers (like custom USB charging chips, led chips for flashlights, etc.)
- grenoire 7y agoIn order to manufacture these chips you need the schematics. It's the same thing as having the source code and the deployment/compilation instructions: You don't need anything else.
- jjoonathan 7y agoPhysical Unclonable Functions were supposed to address this. I wouldn't expect them to hold a state actor at bay for more than a little while, but at least with a PUF in place overproduction isn't as simple as "just make more."
- _ph_ 7y agoStrictly speaking, for manufacturing you need the layout for the chip, but extracting a schematic from a given layout is an automated process and used for verification. You create a layout from a given schematic and later check, whether the layout implements that schematic.
- _ph_ 7y agoAnd one should not overlook that a lot of cutting edge chip design is done in China. Just think of all the chips by Huawei. On top of that, the direct layout information is more relevant for reengineering than copying.
- samstave 7y agoHow do you pronounce that word? I worked at intel in the 90s, and they put malformed cpus in key chains. But what will be interesting to see will be is when they build a library of Devices where they can quickly ID Trojans
- deleted 7y ago[deleted]
- peteri 7y agoI still have my 386/486 chip key ring I got from a Journalist friend.
- jimbob45 7y agoTy-ko-graphic
- samstave 7y agoCan you also explain the “ty-co” part of it
- jamiek88 7y agoTie as is bow tie and co as in co-worker.
- samstave 7y agoThank you
- 8bitsrule 7y agoAs a suffix 'tych' (pronounced 'tic') refers to multiple related/connected things ... tables, leaves, panels, works ... (diptych, triptych, polyptych). EG 'triptych' "derives from the Greek adjective τρίπτυχον 'triptukhon' ('three-fold')". 'Ptychography' was coined by crystallographers in 1972. Wikipedia has more on the origin. https://en.wikipedia.org/wiki/Ptychography https://en.wikipedia.org/wiki/Ptychography
- mooneater 7y agoTime for a silicon easter egg hunt!
- kardos 7y ago> Some of that information can be regained by making some assumptions about what you’re looking at, explains Aeppli. For example, we know that real interconnects can’t have certain shapes. This sounds like the beginnings of the silicon obfuscation strategy: hiding things in silicon that lie below these assumptions
- comboy 7y agoI would guess that at the lowest level too much is dictated by physics. It may be possible to obfuscate some higher abstraction layers though.
- kaibee 7y agoI wouldn't be too sure of that. > Five individual logic cells were functionally disconnected from the rest— with no pathways that would allow them to influence the output— yet when the researcher disabled any one of them the chip lost its ability to discriminate the tones. Furthermore, the final program did not work reliably when it was loaded onto other FPGAs of the same type. https://www.damninteresting.com/on-the-origin-of-circuits/ https://www.damninteresting.com/on-the-origin-of-circuits/
- sephamorr 7y agoNote the last sentence of your quote. Device-to-device variability and production yield are opposites. I can't imagine how techniques that exploit variability between devices (with no mention of temperature, lifetime drift, etc) could be reliable.
- labawi 7y agoMaybe not the best example, but this was on FPGA. When making custom chips, you can make all sorts of tuning, including consistent hardly noticeable drifts from spec. The article says they only image the metal layers, so I guess you can do anything as long as you don't visibly change the metal layers.
- 7y ago
- traverseda 7y agoThat should make it a lot easier to identify hardware back-doors.
- dheera 7y agoAgreed. Also I hope it brings the end of the Apple security-by-obscurity methods that allowed that one iPhone to be cracked by a third party hacker. If you know what's in the hardware a 4-6 digit PIN is fine for deterring casual onlookers but is never enough entropy to secure data. People should learn to use real passwords if they want their data secure.
- edoo 7y agoPerhaps... one of the capabilities is to dope gates with different materials so the transistor layout stays the same but the behavior is modified. Unless the system could detect the actual elemental differences you might get a false sense of security just confirming the transistor layout.
- teddyh 7y agoPreviously, in 2017: https://news.ycombinator.com/item?id=13952016 https://news.ycombinator.com/item?id=13952016
- mepian 7y agoCan someone please share the actual paper? Sci-Hub fails to retrieve it either by DOI or by the Nature link.
- Timothycquinn 7y agoI wonder if this technique can be used to scan a PCB as they can be in attack vector for supply chain attacks.
- lifeisstillgood 7y agoMy thoughts exactly - I can easily see a business in taking chips out of a supply chain and performing this analysis against the expected layouts. Its possible that Intel / other chip manufacturers / board manufacturers would pay for just to improve confidence in their supply chain. At some point this is a few millions a year, and a nice tick box in the pitch deck.
- DoctorOetker 7y agoattach photographic plate to lead plate, attach PCB to photographic plate, mail to collaborator across a jurisdiction with X-ray postal inspection, collaborator develops photographic plate, 50% success rate depending on face down or face up, scan image and send result.
- dillondoyle 7y agoDare I bring up the Bloomberg article without causing a shitstorm? I remember reading around that time a (I think) presentation on how to trick / hide against x-ray tomography etc but I can't find the link to the source if anyone has it?
- Timothycquinn 7y agoI recently had an IPMI on on of my Supermicro servers and it was super funny to hear the conspiracy theory from the SuperMicro support that it was not working because maybe the Chinese were worming through a backdoor that was hidden on the machine. I'm quite sure that the issue was just a faulty IPMI as I've seen it happen before with older units but I had a good laugh. I'm a believer in Murphy's law where whatever can happen will happen. Supply chain attacks are quite possible, would be very fruitful and therefore must be happening. But will we ever get the truth from the big vendors? I don't think it will happen any time soon but with this x-ray technology, it will be way easier to detect them.
- jl6 7y agoNext step: chips include critical components that can be damaged by x-rays.
- ur-whale 7y ago> not just reverse engineering but assurance that chips are manufactured according to design This, combined with stuff like RISC-V is very good news and big progress towards making a secure (read backdoor-free) hardware platform. Gotta love the Swiss !
- digikata 7y agoI wonder if the 40+ layer NAND chips would give a problem for this technique.
- jalk 7y agoDoes this have any implications for Secure Enclave like chips?
- sowbug 7y agoI have no expertise on this subject, but here goes. First, I don't think the technique can see electrical charges, which is how any chip stores volatile state. Second, if such chips rely on security by obscurity -- and judging from the NDAs typically required to get any official information about them, I'd say it's part of their defense in depth -- then that security would now be weaker. Finally, this technique would arguably enhance security if independent labs were now able to verify that a chip is devoid of back doors and implementation errors.
- Rannath 7y agoI just want this to be cheap enough so that we can archive and re-create no-longer manufactured chips.
- pkaye 7y agoHow do you recreate them? On FPGA? Fabricating a chip is not cheap.
- tux1968 7y agoEven software emulation would be nice.
- anfilt 7y agofor completely digital an fpga would do the job. Analog chips well that's a different.
- Rannath 7y agoPersonally I was thinking of being able to recreate some discrete chips with breadboards. Then again MOSIS has prices down to a few thousand/square millimeter. Since current gen stuff is so much smaller, that's probably <$100 for the more complex chips from the 70s, & 80s. The best I think we'll get is some Amiga/Commodore build it yourself kits That weren't possible before because of out-of-production chips.
- userbinator 7y agoA lot of chips from the 70s and early 80s have already been reverse-engineered publicly: http://www.visual6502.org/ http://www.visual6502.org/
- Rannath 7y agoThis will make that easier. AND we can do it non-destructively. That means we get more, & rarer chips, instead of only the common stuff.
- squarefoot 7y ago
- tombert 7y agoI wonder what the implications of this could be for the emulation community...maybe someone more knowledgable about this stuff can enlighten me: would something like this be useful in creating more-accurate emulators?
- tabtab 7y agoCan it be used on cryogenically frozen brains? The flick "Sleeper" could become a reality, although you'd probably have an android or R2D2 like body.