5 ms·

Once I worked at a place which was very interested in protecting the IP inherent in their firmware. They gave me a research assignment to get an idea of how dif

Once I worked at a place which was very interested in protecting the IP inherent in their firmware. They gave me a research assignment to get an idea of how difficult it would be for an attacker to extract it as a binary given unlimited physical access to a sample device. Since I read and write Chinese, I did some searching on Chinese-language sites and found a company advertising their ability to do just that... for about $10,000 per job. They listed the chips they knew how to crack, but the one my employer was using was not on the list... I feel that trying to prevent reverse-engineering by adversaries with unlimited physical access is a fool's errand. So this break of Xilinx FPGAs is interesting... But kind of a shoulder shrug.

WrtCdEvrydy 6y ago
I wonder if classic chip-off methods would work (they no longer work on mobile devices due to encryption advances)
grogenaut 6y ago
Having evaluated implemting game drm many times this nuance may or may not matter to the business. Most drm is a house of cards that a determined attacker can take out. It's still very widely used for good and bad reasons. And a lot of those reasons are not closely tied to the strength of a given implementation.
- Teknoman117 6y ago
  The DRM only has to function during the time where most sales occur for it to be worth it.
  - pmiller2 6y ago
    Except that piracy doesn’t hurt sales and may actually help: https://www.engadget.com/2017-09-22-eu-suppressed-study-piracy-no-sales-impact.html https://www.engadget.com/2017-09-22-eu-suppressed-study-pira...
    - baby 6y ago
      I can see it being a spectrum. For a big movie that people want to watch? Piracy probably hurt. For a small indie that is in dire need of more exposure, then they're probably on youtube, but I can see how piracy could help. If you're in the middle? Not clear.
    - grogenaut 6y ago
      Your facts have zero bearing on the decision to use from.
userbinator 6y ago
There are quite a few Chinese (and Russian, not surprisingly...) companies who will do "MCU breaks". $10k (USD) is near the high end of the price range; price depends on complexity and newness --- less than $1k for some of the common and older parts. Mikatech is one of the better-known and older ones. They are great for maintaining legacy equipment where the original company has either discontinued support or disappeared completely.
- thr0w__4w4y 6y ago
  I've often wondered -- and perhaps you don't know the answer, or there is no one typical answer -- but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? (Or maybe we should just remember the saying "no honor amongst thieves") I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true? Thanks. Sorry to punish your useful answer with more questions.
  - userbinator 6y ago
    but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? I don't know --- I imagine a lot of the time they wouldn't even know what equipment the chip came out of, and/or it's something extremely obscure, so it would be very hard to sell the contents. I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true? If it's a new MCU they've not done before, they might ask for that --- to find where the protection fuses are. It doesn't have to be the actual one you want, just an example of a protected one along with the code it contains in order to "check their answers". That will cost quite a lot more than known-extractions, however.

WrtCdEvrydy 6y ago

I wonder if classic chip-off methods would work (they no longer work on mobile devices due to encryption advances)

grogenaut 6y ago

Having evaluated implemting game drm many times this nuance may or may not matter to the business. Most drm is a house of cards that a determined attacker can take out. It's still very widely used for good and bad reasons. And a lot of those reasons are not closely tied to the strength of a given implementation.

Teknoman117 6y ago
The DRM only has to function during the time where most sales occur for it to be worth it.
- pmiller2 6y ago
  Except that piracy doesn’t hurt sales and may actually help: https://www.engadget.com/2017-09-22-eu-suppressed-study-piracy-no-sales-impact.html https://www.engadget.com/2017-09-22-eu-suppressed-study-pira...
  - baby 6y ago
    I can see it being a spectrum. For a big movie that people want to watch? Piracy probably hurt. For a small indie that is in dire need of more exposure, then they're probably on youtube, but I can see how piracy could help. If you're in the middle? Not clear.
  - grogenaut 6y ago
    Your facts have zero bearing on the decision to use from.

userbinator 6y ago

There are quite a few Chinese (and Russian, not surprisingly...) companies who will do "MCU breaks". $10k (USD) is near the high end of the price range; price depends on complexity and newness --- less than $1k for some of the common and older parts. Mikatech is one of the better-known and older ones. They are great for maintaining legacy equipment where the original company has either discontinued support or disappeared completely.

thr0w__4w4y 6y ago
I've often wondered -- and perhaps you don't know the answer, or there is no one typical answer -- but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? (Or maybe we should just remember the saying "no honor amongst thieves") I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true? Thanks. Sorry to punish your useful answer with more questions.
- userbinator 6y ago
  but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? I don't know --- I imagine a lot of the time they wouldn't even know what equipment the chip came out of, and/or it's something extremely obscure, so it would be very hard to sell the contents. I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true? If it's a new MCU they've not done before, they might ask for that --- to find where the protection fuses are. It doesn't have to be the actual one you want, just an example of a protected one along with the code it contains in order to "check their answers". That will cost quite a lot more than known-extractions, however.