Break IC, Recover MCU, Microcontroller Reverse Engineering

Archive for April, 2019

The outcome of ignorance in understanding the Microcontroller Breaking directions could be devastating to many modern devices going online or wireless as part of the Internet-of-Things (IoT) initiative. Modern semiconductors which have wireless connectivity could be cracked in many ways through software vulnerabilities and backdoors.

Microcontroller Breaking Directions

Sometime the research could even lead to impossible achievements. This happens when someone senior tells that certain things are not possible, but the research proves them wrong. This could result in a large outcry in the media like it was in the case of NAND mirroring attack on iPhone 5C [9]. There are some impossible challenges faced by Forensic Analysis engineers, for example, MCU data extraction from electrically damaged (Fig. 1) and mechanically damaged (Fig.2).

Figure 1: Electrically damaged pin on the die of microcontroller

Figure 2: Mechanically damaged die of microcontroller

Although the contents of the on-chip non-volatile memory was fully preserved, conventional Failure Analysis methods are not only very expensive but would also require weeks or months of tedious work. However, it is very likely that Hardware Security would be able to come up with feasible and affordable solutions in the nearest future.

As a contribution to the wide list of already known MCU memory breaking this paper introduces two new attacks. One is about efficient microprobing of an old smartcard chip, another is about decapsulation of a microcontroller with battery-backed on-chip SRAM.

When the existence of a backdoor in highly secure Microcontrollers was discovered in the form of secret test/debug interface capable of overriding chip security policy, it raised a lot of questions about Secured Microcontroller Hardware Security of modern ICs.

Secured Microcontroller Hardware Security

Recently demonstrated method for the direct imaging of EEPROM and Flash memory contents using easily accessible Scanning Electron Microscopes (SEM) challenges the security of embedded storage. This is because non-volatile memory was always considered as being highly secure against most invasive MCU crack due to very small electrical charge accumulated beneath very thin barrier that cannot survive de-processing. Now the obvious question is: What could be the next in ground IC breaking and disturbing attack on hardware security?

In many cases new MCU attacks were far from being something absolutely new. For example, structural analysis for impurities using chemical methods were known for decades and actively used in Failure Analysis. The fact that switching of each individual transistor contributes to the overall power consumption of the circuit was not new and was actively used by semiconductors development tools to predict power consumption and overheating. Even the photon emission was known, but was too expensive as common attack technology.

The fact that photons can interact with transistors was known since the development of transistors and was even used for communication. The ability of electron beam to detect buried charge was also known, but only with the development of more sensitive microscopes became practical to use. The main message of this paper is if the vast majority of IC code extraction are based on already known facts, there must be a way to predict such attacks and develop mitigation techniques well ahead of the active use by attackers.