To determine a secret key, an attacker can monitor the current, voltage changes, or even changes in emissions while the card is in use. Another noninvasive attack, the glitch attack, tricks the smart card into skipping a portion of an algorithm, or even missing an instruction branch, simply by putting a little hiccup into the normally steady clock input. Smart card manufacturers have fought back by introducing layers of shielding over the circuitry, adding cryptographic algorithms into bus decoding for memory access, making power analysis more difficult, and embedding the circuits at different depths. As you can imagine, there is a constant war between the designers and the attackers. With enough effort, an attacker can glean the information protected by the smart card.
Most attackers focus on smart cards holding shared secrets, such as symmetric keys.
Breaking a single smart card provides a single key that has widespread use. But the most common use of smart cards for network security involves password-like secrets, public key certificates, and asymmetric keys, which are only useful on an individual basis. In this case, the amount of effort to recover a single key would be greater than the key's value. The University of Michigan uses Kerberos V for authenticating students into computer systems. Kerberos V permits students to log in once and then use many network facilities, and it has a greater level of security than the single-login facility used in Windows NT 4.