4 ms·

Anyone know how the memory chips are removed from the target board? They can't be desoldering them if it's a cryogenic process

aa-jv 3y ago
Get things cold enough and you can pop off most BGA-based packages from the boards ..
bri3d 3y ago
It’s in the article, they’re desoldered and reballed like normal and then socketed: “What makes the attack possible, he said, is something called a conductive elastomer IC test socket.” The cryogenic pick and place robot then moves the now-socketed chip from the board to the test fixture at runtime.
- adhesive_wombat 3y ago
  The elastomeric sockets are really cool. They're like 2D versions of those zebra connectors for LCDs: you just press them down and the land pattern is replicated on the other side. Furthermore, they work into the GHz range, which you need, say, for messing with modern DDR RAM standards. https://www.ironwoodelectronics.com/products/ghz-elastomer-sockets/ https://www.ironwoodelectronics.com/products/ghz-elastomer-s...
- imtringued 3y ago
  This is ridiculous. You need to steal the hardware, analyse the specific model, build a machine for it and manipulate it and then bring it back to the original user and then steal it again after he has entered his credentials and then you have to use a dedicated machine to perform the actual attack and you only have one attempt.
  - ilyt 3y ago
    If it is a laptop, yeah, not super practical, but there are plenty of devices secured by encrypted firmware that gets decoded on boot and stored in memory
    - wongarsu 3y ago
      Yeah, way more practical for servers in a datacenter than for a random laptop you confiscated. Though tooling for each of the most recent iPhones might also be worth it
  - bri3d 3y ago
    Wrong use case. It's a reverse engineering tool to extract firmware, secrets, and code to develop and exploit, not an exploit in and of itself. This would be a horrendous way to recover user credentials but it's a great way to recover encrypted firmware, session/authorization/authentication keys derived in "Secure World" on embedded systems, and static runtime secrets decrypted using a derived key (key vaults, etc.).

aa-jv 3y ago

Get things cold enough and you can pop off most BGA-based packages from the boards ..

bri3d 3y ago

It’s in the article, they’re desoldered and reballed like normal and then socketed: “What makes the attack possible, he said, is something called a conductive elastomer IC test socket.” The cryogenic pick and place robot then moves the now-socketed chip from the board to the test fixture at runtime.

adhesive_wombat 3y ago
The elastomeric sockets are really cool. They're like 2D versions of those zebra connectors for LCDs: you just press them down and the land pattern is replicated on the other side. Furthermore, they work into the GHz range, which you need, say, for messing with modern DDR RAM standards. https://www.ironwoodelectronics.com/products/ghz-elastomer-sockets/ https://www.ironwoodelectronics.com/products/ghz-elastomer-s...
imtringued 3y ago
This is ridiculous. You need to steal the hardware, analyse the specific model, build a machine for it and manipulate it and then bring it back to the original user and then steal it again after he has entered his credentials and then you have to use a dedicated machine to perform the actual attack and you only have one attempt.
- ilyt 3y ago
  If it is a laptop, yeah, not super practical, but there are plenty of devices secured by encrypted firmware that gets decoded on boot and stored in memory
  - wongarsu 3y ago
    Yeah, way more practical for servers in a datacenter than for a random laptop you confiscated. Though tooling for each of the most recent iPhones might also be worth it
- bri3d 3y ago
  Wrong use case. It's a reverse engineering tool to extract firmware, secrets, and code to develop and exploit, not an exploit in and of itself. This would be a horrendous way to recover user credentials but it's a great way to recover encrypted firmware, session/authorization/authentication keys derived in "Secure World" on embedded systems, and static runtime secrets decrypted using a derived key (key vaults, etc.).