Re: Fuseable Links - no guarantees??

At 3:44 AM 6/15/96, Warren wrote:
>I have never paid much attention to the protection of firmware or the
>technical issues revolving around such schemes...was wondering:
>
>I recently saw an add for a UK based group that says they can take a PIC
>OTP micro and read the prom (for a fee, of course) - How the heck is this
>done?? I have my suspicion that they (somehow) magically peel off the
>ceramic coating (without destroying the chewy center), get a circuit mask
>and 'micro probe' the I/O of the IC...they then download the secret recipe
>to the afore mentioned 'chewy center'.
>
>Is this close to accurate?? How is it 'done' ???

I don't know of any modern chips that have "ceramic coatings." (Some chips,
esp. CPUs, are still ceramic-packaged, but in these cases the metal or
ceramic lids are easily removed.)

Most chips are plastic-packaged, and plasma ashers and/or chemical baths
will expose the chip surface easily enough.

Once exposed, various methods exist to read internal voltage levels. For
example, electron beams in a scanning electron microscope (SEM) can fairly
easily read at least surface potentials. Whether a SEM in voltage-contrast
mode can read voltages on lower levels depends on a lot of things, and I
can't even make a guess here as to whether OTP (one-time programmable)
memories from particular vendors can have internal nodes probed.

With enough money, many things are possible.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

| >I recently saw an add for a UK based group that says they can take a PIC
| >OTP micro and read the prom (for a fee, of course) - How the heck is this
| >done??

According to the FAQ for satellite piracy, whatever that is called, it is
quite simple for some models of PICs. 

Many of the OTP PICs have a wipe mode for reusal. Apply a certain voltage,
the programming voltage, and the memory is wiped and a fuse is restored so
the memory is programmable again.

Approx a year ago some people on this scene discovered that one could restore
the fuse without erasing the memory content. They applied the programming
voltage minus 0.5V (or something similar). The idea is that there is a voltage
drop across the fuse, and this modified voltage level just barely "manages
it" across the fuse. The voltage level is however not enough to spark the
memory erasure mechanism off.

So I guess one can look at the circuitry and apply non-standard voltage and
current values, or even non-standard timing values -- and do bad things
to these circuits. So this begs the question: Is there anyone who has looked
at "computer security" issues at this level? Is this just bad implementations
of these circuits or are there a fundamentally hard problem in this?

(I'd guess you'll find the FAQ if you search for the words "satellite piracy
PIC OTP" on Alta Vista.)

-Christian