Preventing reverse engineering - Page 1
Forum section: electronics / general

author: Afrotechmods
author_rank: Unknown
timestamp: April 04, 2012, 10:08:52 pm
content: Hello everyone!What are your favourite ways to obfuscate a design, making it harder to reverse engineer? Obviously it is impossible to prevent it from happening entirely.Methods I know of:Code protecting microcontroller firmware (duh)Sandpapering the top off ICsEpoxying

author: Stephen Hill
author_rank: Regular Contributor
timestamp: April 04, 2012, 10:15:28 pm
content: Why would you want to? If someone really wanted to reverse engineer your product, nothing will stop them.

author: ejeffrey
author_rank: Super Contributor
timestamp: April 04, 2012, 10:32:03 pm
content: Epoxy and sanding are not particularly effective. I don't know how good code locking is, I guess it probably depends on the micro. In any case, you may stop small shops or hobbyists from reverse engineering your stuff, but you won't stop someone with serious resources, commercial interest and weak IP laws (i.e., chinese factory).Most of the people who want to lock their designs have an over-inflated sense of how awesome and unique their product is. About the best you can hope for is that you keep people from figuring out how to unlock your license codes. Even then that only works if your product isn't cool enough to be worth the effort. See Rigol's attempts to prevent people from bandwidth unlocking their scope. Whatever you do, commercial end users won't bother cracking your codes, some hobbyists will, and if it is worth the effort someone will reverse engineer it.

author: T4P
author_rank: Super Contributor
timestamp: April 04, 2012, 10:35:22 pm
content: Even if you set the fuse bits to prevent reading of the controller , parallel programming goes to the rescue .Even sandpapering will not stop me , i had found a very sandpaper'd chip and decided to put it under strong UV light and decoded the IC , or further very fine sandpapering will expose the lettering .Epoxying can be a very good idea but keep in mind there are epoxy debond stuffs .The best way to prevent reverse engineering is to have many layer boards , not neccesary , but it's hard to see the damn tracks .^The last resort for Rigol is to do hardware locking , but that still can be cracked .

author: PeterG
author_rank: Frequent Contributor
timestamp: April 04, 2012, 10:57:31 pm
content: Reverse Engineering Prevention is like DVD Copy Protection, it only stops the honest people and slows down the rest.Nothing will stop a determined mind.Regards

author: Randall W. Lott
author_rank: Regular Contributor
timestamp: April 04, 2012, 10:58:02 pm
content: Make a bad product. That's probably the best way to prevent it.

author: 8086
author_rank: Super Contributor
timestamp: April 04, 2012, 10:59:59 pm
content: A few interesting ideas in this video:

author: PeterG
author_rank: Frequent Contributor
timestamp: April 04, 2012, 11:00:49 pm
content: Quote from: Randall W. Lott on April 04, 2012, 10:58:02 pmThat theory holds true when you look at products made in china. Ever heard of anyone copying a product made in china?Regards

author: Afrotechmods
author_rank: Unknown
timestamp: April 04, 2012, 11:02:13 pm
content: You sound very experienced in this Dave S! Could you please elaborate what you meant by "parallel programming comes to the rescue"? Let's say it's a PIC or an AVR that is normally programmed serially.8086: That was a cool video! I liked the physical switches and how critical keys were held in RAM.

author: Randall W. Lott
author_rank: Regular Contributor
timestamp: April 04, 2012, 11:04:00 pm
content: Quote from: 8086 on April 04, 2012, 10:59:59 pmI watched Mike's video a few days ago. That's insane. There are about 4-5 tamper-resistant features. Have fun trying to hack that thing!

author: DrGeoff
author_rank: Frequent Contributor
timestamp: April 04, 2012, 11:19:19 pm
content: Broadly speaking, reverse-engineering protection does not really work. You can always look at the functionality of a product and re-engineer something to do the same, copying whatever is easiest to do and tracing out circuits.Code copy protection does work, particularly on microcontrollers that have modified harvard architecture, which prevent some of the methods used to crack some security products (see Ross Anderson at Cambridge for details). From memory PIC (16, 18) have this architecture. Not sure of others. Microchip also buried a lot of the memory cells to prevent SEM techniques being used to read the cells after grinding the top off. A lot of this has to do with secure key storage in cryptography products and there are some interesting papers and essays about it.Other techniques such as potting or epoxying aren't really very useful as a sophisticated attacker can remove them.

author: Afrotechmods
author_rank: Unknown
timestamp: April 04, 2012, 11:36:54 pm
content: Quote from: Aurora on April 04, 2012, 11:25:10 pmLol! That is awesome. Yeah I can't see myself ever pulling a "Q" any time soon but that's pretty cool to read about.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: April 04, 2012, 11:39:00 pm
content: Quote from: Aurora on April 04, 2012, 11:25:10 pmYes, and if there is a financial incentive (think organised crime syndicates) then they will appropriate devices and talent as required to defeat the tamper protection. I have seen this done on a lot of supposedly tamper resistant equipment, using many clever and ingenious means.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: April 04, 2012, 11:51:13 pm
content: Obscuring numbers is a waste of time, and makes your product look like it was made by a complete amateur.Epoxy can be removed without too much problem.Many common micros can be de-protected for a few hundred dollars.You need to think carefully about exactly what you want to protect, from whom, and whether it is worth the effort and how much cost you can justify.There are some effective methods, but the solution will always be very application- and market- dependent.

author: IanB
author_rank: Super Contributor
timestamp: April 05, 2012, 02:34:15 am
content: I think copy protecting software has some justification since functionally recreating the software may take a lot of effort whereas copying the software gives you the functionality for "free" (not advocating this, just observing).Protecting hardware is different, because the "software" is in the design, not the artifact. Even if someone can copy the design they still have to manufacture it to profit from it, and it may be hard to copy effectively if the workings of the design are not properly understood.So the best way to prevent reverse engineering may be to have a very clever and intelligent design with some non-obvious aspects to how it works and some finely tuned elements that make the difference between success and failure. Someone could try to copy it but they would have trouble getting the copy to work. The hardest thing to reproduce is human intelligence.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: April 05, 2012, 03:11:46 am
content: Amateur hackers even go through the lengths of grinding chip layers down and pretty much reconstruct the entire IC schematic with a bunch of home brew tools. Some even used Matlab to do this kind of stuff. Of course, this method has its limits beyond a certain feature size.Personally, I can only speak from software development point of view, and all I can say is elaborate copy protection is just a waste of time. I wouldn't go beyond basic validation and checks for license info, that's about it. Going beyond that does nothing but rob you of time from developing legitimate/useful software features and introduce another source of potential bugs.Make a good product, try to sell as cheap as possible and in great volume.

author: free_electron
author_rank: Super Contributor
timestamp: April 05, 2012, 03:26:09 am
content: Sandpapering part numbers is a waste of time. Simply because the die inside the chip has a marking. Etch the top off ,put under microscope and bingo. you knwo what it is. anyone with access to boiling H2SO4 and a magnifier can do it.. piece of cake.There are lookup tables with pinouts. very often simply following power and ground pins , following a reset line and where the crystal is connected tells you what cpu you are dealing with ...Simple TTL and cmos chips are ease : put them in any 50$ eprom programmer and launch the chiptest function. Same goes for flash devices. all these chips have ID codes on board .Dumping code from a chip ? only slightly more difficult. Once you find out what the partnumber is you buy a blank chip. Using the programmer you set the lock bit ( only the lock bit. you do not touch any other bit. ) Using an ebeam prober you step over the die and find the charge on the gate of the fuse mosfet. (there will only be one transistor with charge : the one you just set) .Now,take your 'golden device' decapsulate it with h2so4 , put it on the probestation and go to the coordinates you found. one shot wth the laser cuts the drain of that fuse mosfet. goodbye protection. you can now dump the contents with a simple device programmer...Reverse engineering companies know the coordinates of the fuse bits in almost all devices out there. And they all have ebeams these days , even in china. You can buy used ebeams or backside probers for a few thousand dollars on ebay , dovebid or other brokers in semiconductor equipment. Any semiconductor manufacturer and lots of universities have this kind of equipment.know someone who has access to one and a few hours of work later you have rom contents.There are secure devices where they employ special coatings , 5 layer metal ove rthe rom that is hard to grind away without damaging anything else (even that is not stopping anymore. simply do backside probing ) . Hiding multiple fuse bits in the array: using a register that holds the location of the fuse bit ( so every programmed chip has the actual fuse in a different spot. But, those hevily protected chips are not avaialble to the layman to begin with. The chances that a garabox-builder has access to such devices is zilch to begin with. They won't sell them to you.There are devices that have their firmware encrypted. it gets decrypted on the fly and is never present. Teh Dallas DS5000-secure 'was' such a chip... guess what... it was hacked. the procedure is described in a university paper. can be found on the internet. took 3 days of work by two specialists. game over.it may stop the hobby reverse engineer , but if some faar east box really want to clone it.. forget it. nothing you can do. And they are VERY brazen. look up Huawei vs Cisco... they cloned hardware/software , the whole shebang. Only mistake they made .. the software contained an 'easter egg'. An encrypted string could be decrypted and sent over the serial port and would display (c) Cisco systems. When in court the cisco lawyers took the huawei box , hooked up a simple terminal and typed the magix key sequence. the router dutifully executed the decrypt and printed the copyright messag .. pie->face for huawei ... they got caught because the only looked in the rom image for plaintext copyright strings....

author: Psi
author_rank: Super Contributor
timestamp: April 05, 2012, 03:51:43 am
content: Maybe have the whole thing encased in epoxy with some of the security wires made out of conductive liquid present in channels inside the epoxy.Trying to cut, drill or dissolve the epoxy would break the connection as the liquid drained away.

author: Greg323i
author_rank: Contributor
timestamp: April 05, 2012, 04:51:31 am
content: This question reminded me of thisMarshall restorationI saw years ago.

author: EEVblog
author_rank: Unknown
timestamp: April 05, 2012, 05:22:16 am
content: I knew of someone who used to make final connections on the PCB with very fine wire before potting. So when you removed the potting, the wire would break off and the circuit was not easily traced.Also, you can put in extra (code protected) micros for simple things that could otherwise be done without them.And also put in dummy circuitry that does nothing but confuse people.Dave.

author: EEVblog
author_rank: Unknown
timestamp: April 05, 2012, 05:30:04 am
content: Quote from: AntiProtonBoy on April 05, 2012, 03:11:46 amThe trick here is to also make yourself theonlyperson people want to buy this product from because:1) You are the original designer, and therefore cool, and someone worthy of supporting.2) You offer the best support (and maybe community support too)3) You have the "official" product4) You stay one step ahead of the cloners by bringing out new products. The cloners almost never make the first move, that's not their business.And that's pretty much why Open Source Hardware is a viable way to make a business, and practically guarantees you 1)But if you do everything possible to make a closed and protected design, you most likely won't get the benefit of 1)Dave.

author: vk6zgo
author_rank: Super Contributor
timestamp: April 05, 2012, 06:39:01 am
content: Most of the time the "sandpaper" approach is used by people of limited imagination ,who "design" something using the National Semiconductor Application Notes,then try to hide the fact that there is no original design in the thing!All it serves is to aggravate Techs who are under the hammer to fix it,& can't afford the time or money to send it back to the manufacturer.Try telling the Boss that you can't fix it because you can't identify the components--------it doesn't go down well!I worked at one place where the Software was excellent & innovative,but all the Hardware was Public Domain stuff.It was nearly impossible to convince Management that they didn't possess Intellectual Property rights to the Hardware,& that it didn't matter anyway,as the stuff they needed to protect was the Software!Any capable EE could slap together the interface circuitry needed.

author: siliconmix
author_rank: Frequent Contributor
timestamp: April 05, 2012, 08:00:30 am
content: i think if its made by man it can be recreated by man in the end .on preventing reverse engineering .when you have modders , fettlers , hackers, pokers and prodders just waiting to rip the lid off to see the hardware hmmm .that product might get some improvements.if it's a really good product and you gone to great lengths to protect your work when it finally gets busted or modded this might increase sales.i'm sure sales of the rigol 1052e have .

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: April 05, 2012, 08:36:21 am
content: QuoteThat is a very worthwhile thing to do - takes little effort, and is a pretty ironclad proof of copying. Although legal action can be expensive, the evidence is so solid that it probably wouldn't get to court.A customer of mine won a substantial out of court settlement many years ago this way - it was an upgrade ROM for a high-end satellite receiver - he filled all the unused space with random data to make disassembly harder - a competitor copied it and just changed the plaintext copyright string.Another approach to screw the competition without the need for legal action is to include a very subtle feature which makes a non-genuine product appear to work for long enough for the cloner to think they've cracked it, but then fail in the field. Obviously this needs to be done in a way that doesn't make it look like the genuine product has a problem.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: April 05, 2012, 08:52:51 am
content: BTW another interesting technique I heard about many years ago, in the days when eeprom edurance was less than it is now - Someone used eeproms (don't recall if internal or external) where one location had been deliberately thrashed until it failed.The software attempts to write and read back to this location, and if it succeeds, it's a clone and stops working after a while (long enough for the cloner to think they'd cracked it).Subtlety can be a much more effective method than crude stuff like potting and sanding.Another classic heard of a few years ago - cable TV boxes (Ireland I think) which got hacked to show all channels. The TV company created a new channel that did not show up on genuine boxes, and ran a competition on it.

author: kaindub
author_rank: Regular Contributor
timestamp: April 05, 2012, 10:40:15 am
content: Dave is spot onI worked for a large multinational a few years ago and they had an interesting strategyTheir products were being copied by the ChineseSo the company took out design registrations on all their products. (These are called patents in the USA BTW). Its easier to prove in a court that someone has copied your products' look rather than any technology inside.A design registration in Australia costs about $60 and one only needs the completion of a form. No lawyers?Try itRobert

author: amyk
author_rank: Super Contributor
timestamp: April 05, 2012, 12:06:18 pm
content: Quote from: IanB on April 05, 2012, 02:34:15 amAlso the use of parts which are expensive/difficult to obtain. Then even if you publish the schematics, those who need to service the equipment can do so easily, but there will be little incentive to clone it exactly since there would not be an easy way to profit from that. Big companies like HP and Tektronix have schematics for their expensive test equipment, but others haven't copied the design exactly because they use parts that are expensive and/or custom.Any protection strategy can be defeated with enough effort. Many small companies in China specialize in doing so. It's just the question of whether duplicating an existing design or coming up with their own would be more profitable, and the cloners can often make something which has similar functionality to the original but at a much lower production cost, by duplicating functionality and not implementation.You can see this happening here:https://www.eevblog.com/forum/product-reviews-photos-and-discussion/huakko-936c-soldering-station-(hakko-936-clone)/They could've cloned the Hakko control circuit (and people have reverse-engineered and posted the schematic before), but chose to design their own and ended up with fewer parts, probably costing less too.

author: JuKu
author_rank: Frequent Contributor
timestamp: April 05, 2012, 12:22:40 pm
content: Quote from: EEVblog on April 05, 2012, 05:22:16 amNone of these work. The first one might on the first try, but when the trick is figured out, an X-ray tells the story. As noted, protection on micros can be broken and of course, dummy circuitry can be copied, too. IF someone really wants to put in the effort, any device can be copied.

author: JuKu
author_rank: Frequent Contributor
timestamp: April 05, 2012, 12:25:13 pm
content: Quote from: EEVblog on April 05, 2012, 05:30:04 amBut this works. Why would you want to buy a fake old model, when the real one is the new one with cool features.

author: Bored@Work
author_rank: Super Contributor
timestamp: April 05, 2012, 01:38:25 pm
content: Quote from: JuKu on April 05, 2012, 12:25:13 pmIt can be circumvented, see below.QuoteBecause the fake is cheaper, you don't know it is a fake, it looks like the latest, greatest one, and you don't have the knowledge to figure out what is going on.I recently had to convince someone not to buy that Flytouch Superpad III she found for almost nothing on the Internet, and also not to buy the latest Flytouch Superpad VI, once I convinced her the III is no good. Because(a) it was not an original Flytouch 3 pad. They still get cloned like hell, and the clones are absolute rubbish, but buyers don't know that. Ironically, the original isn't very good either, so the cloners started with something bad and made something very bad.(b) it is obsolete and was replaced by the Flytouch 5. Unfortunately, cloning of that one also started, this time the cloners even stepped the version number, calling the clones Flytouch Superpad 6 VI, so(c) if she would have gone for the latest version VI she would again have got a rubbish clone.

author: G7PSK
author_rank: Super Contributor
timestamp: April 05, 2012, 01:55:06 pm
content: During WW2 the British radio and radar sets had detonators fitted into them, if there was a chance they would fall into enemy hands the operator pulled a cord that set a timer.

author: Frangible
author_rank: Regular Contributor
timestamp: April 05, 2012, 03:47:06 pm
content: Quote from: G7PSK on April 05, 2012, 01:55:06 pmThat will work just great when Junior decides to open the box to see what's in there!I used to do a lot of reverse engineering for a company that was tasked with ensuring certain products weren't equipped with back doors of some sort. Even back then there were firms that would accept a desoldered MCU and for a fee, return a CD containing a full description of the part and a dump of the code in the masked ROM.

author: SeanB
author_rank: Super Contributor
timestamp: April 05, 2012, 06:52:29 pm
content: There used to be secure briefcases available with a smoke/gas/incinerate pyrotechnic charge inside. Pretty impressive to let off, a burning case with a billowing cloud of orange dye smoke pouring out, which was going to make you tear up and cough. Really nice canisters........If you put one behind your car radio the thief who took it would be in for a surprise........

author: ftransform
author_rank: Frequent Contributor
timestamp: April 05, 2012, 07:34:24 pm
content: Just watch the movies Speed and Speed 2 : Cruise ControlYou could have oxygen sensitive (pyrophoric) or pressure sensitive ignition methods too.Obviously any kind of self destruct technology would only work a few times before an easy countermeasure is found, i.e argon environment, drilling a pressure gauge into your thing to see if its evacuated or pressurized.Btw this kind of shit is probably very illegal and they would get you for explosive device or arson device or something if your suitcase bursts into flame. MAYBE if you have a THICK high temp steel alloy box filled with a slow burning (course mesh)thermite (with the thermodynamics worked out, i.e enough heatsink so it doesn't cause a breach) and well covered with a hard to remove insulation so the police officer/bandit/etc does not get a burn/molten iron shower when he inspects the odd suitcase/backpack/w/e.I would look at railroad welding thermite charge behavior to get a feel of how thermite behaves under confinement. In this process a pressed thermite "cube" is put between a gap that happens between 2 rails (imagine putting 2 BGA female ends together so you get a cavity. The thermite is electrically ignited and fuses the 2 rails together. The thermite reaction is technically a gas less reaction, so there exists a potential to have some kind of portable small safe self destruct device. Also it has to be designed so that if it goes off unexpectedly it does not cause a fire.. You probably have to make it so the outside of your container does not get above whatever temperature you deem fire safe.

author: free_electron
author_rank: Super Contributor
timestamp: April 05, 2012, 08:13:22 pm
content: simply slap a sticker on it that say 'If you reverse engineer this , i will be very vary sad and cry ..'. who know's it may work.

author: saturation
author_rank: Super Contributor
timestamp: April 05, 2012, 08:41:17 pm
content: Yes. Its actually a field one can specialize in. As another posted, the only sure way to protect electronics is a self destruct. Even if a component is very high tech and can't be duplicated, the copier can rig up an equivalent circuit to do the same.http://en.wikipedia.org/wiki/Reverse_engineering#Legalityhttp://www.uec-electronics.com/engineering/reverse.htmlhttp://www.ieca-inc.com/Is it legal but always with defined specific circumstances.Quote from: PeterG on April 04, 2012, 10:57:31 pm

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: April 06, 2012, 12:15:51 am
content: Quote from: G7PSK on April 05, 2012, 01:55:06 pmApparently a significant problem in making airbourne radar was the amount of explosives needed to destroy the then top-secret magnetron sufficiently to hide the cavity structure.

author: vk6zgo
author_rank: Super Contributor
timestamp: April 06, 2012, 02:31:31 am
content: Putting explosives in equipment may be permissible in wartime,although I think there was a fair element of wishful thinking involved.Did the Brits really think that the Germans wouldn't put two & two together,if they found a hulking great magnet in the wreckage?Of course,the Germans did the same thing with their equipment,probably hiding things the Poms already knew about!With R/T equipment,the frequencies used on a particular Radio may give clues to,for instance,where an aircraft is based,so I can see a bit of sense in destroying that kind of stuff,but that is more of a Military Intelligence thing,rather than hiding any technological secrets.Using anything like an explosive in your products would,in Australia,be a shortcut to a possible huge fine and/or jail time.

author: Unknown
author_rank: Unknown
timestamp: April 06, 2012, 06:11:06 am
content: Quote from: vk6zgo on April 06, 2012, 02:31:31 amAnd yet they are legally allowed to sell and register Asian made utility vehicles. Go figure.

author: Bored@Work
author_rank: Super Contributor
timestamp: April 06, 2012, 07:07:54 am
content: Quote from: vk6zgo on April 06, 2012, 02:31:31 amReports about capturing Enigma machines, machine parts and cyphering material from U-33 and U-110 indicate there was no explosive in this most precious and secret German equipment. Reports about the capturing of U-570 indicate the crew smashed the Enigma and dumped the parts and cryptographic material overboard.They trusted the crew with destruction, not any explosives in the equipment. And this was one of their most valuable secret equipment.

author: cybergibbons
author_rank: Frequent Contributor
timestamp: April 06, 2012, 07:59:09 am
content: Preventing reverse engineering is really a question of economics, not a technical one.I can only see one valid reason to prevent reverse engineering, and that is security. This is why you see the most robust protection methods being used on chip and pin terminals and crypto processors used in ATMs.To prevent against revenue loss by preventing copying is hugely misguided. When the iPad came out it was new and had many innovative features, but nearly all of these could be observed by using the device and copied with that information alone - they had to rely on patents to protect them from being ripped off. This is true of so much now - you don't need to see the details of the implementation to be able to copy successfully.So largely it can be argued that spending time preventing someone copying your product would be time better spent innovating. Most of your end users will see no benefit from copy protection, and it can even be damaging by preventing them using their product fully. Some of my most unpleasant experiences have been with companies who spend the bulk of their time and effort making their products hard to use in the name of copy protection.

author: G7PSK
author_rank: Super Contributor
timestamp: April 06, 2012, 08:51:27 am
content: I have often thought that an explosive in the hard drive would be a useful addition with some way of setting it of remotely or automatically. The number of times that I have read about government departments and large businesses loosing or having stolen hard drives containing personnel or otherwise sensitive data. If the hard drive was destroyed on crossing a loop around the premises it would ensure data did not fall into wrong hands. If the hard drive platens were made of glass as many are it would not require a very big bang to shatter them.

author: Dago
author_rank: Frequent Contributor
timestamp: April 06, 2012, 09:20:09 am
content: Quote from: G7PSK on April 06, 2012, 08:51:27 amOr they could just force personnel to do full system encryption. Problem solved without any explosives...

author: SeanB
author_rank: Super Contributor
timestamp: April 06, 2012, 09:56:35 am
content: Biggest problem of explosives is keeping them from going bang at inopportune moments.........Nice thing of modern detonators is that they are so hard to make go bang, for safety. Minimum 1W of power required, low resistance, redundant ignitor inside the casing. Beats the old ones using picric acid, or mercury fulminates, which would go bang if they were having a bad day.To slag a hard drive you just need to have something inside the clean case that will release hot salt into the enclosure when detonated, which will corrode the platters to uselessness in a few minutes. No bang, and you can make it in a sealed blob with a trigger that detonates with opening the casing. Needs an outer case that has tamper detection, and a long life power source to energise it, and a big capacitor to store charge enough to ensure triggering when needed, even if the internal battery is nearly dead.Encrypting is good, but of course the key needs to be kept secret, not placed on a post it note attached to the case, like the few hundred famous cases where this has been done with govment data.

author: Zero999
author_rank: Super Contributor
timestamp: April 06, 2012, 10:09:04 am
content: Quote from: AntiProtonBoy on April 05, 2012, 03:11:46 amI agree, spend more time on developing a decent product and you'll be able to sell it at a more competitive price, in greater volumes, giving you more profit and the consumer better value for money. If you invest the money you would've wasted on protection in build quality, the customer will be able to better differentiate between the genuine item and a fake.

author: Unknown
author_rank: Unknown
timestamp: April 06, 2012, 10:21:23 am
content: Quote from: cybergibbons on April 06, 2012, 07:59:09 amIf it's about security, then tampering is usually the issue, not reverse engineering. Someone putting a keylogger in an ATM would be bad, for example. The algorithms used are usually either publicly documented or easy to figure out. Unless you are NSA and are several years ahead compared to the rest of the world, things like crypto algorithms are usually either standard algorithms or insecure crap. Breaking insecure encryption is perfectly feasible without access to the inner workings. Similar to AntiProtonBoy's comment, the time would probably be better spend developing a more secure algorithm than trying to hide its flaws.Cryptanalysis has come a long way since Enigma.

author: vk6zgo
author_rank: Super Contributor
timestamp: April 06, 2012, 10:44:18 am
content: Quote from: BoredAtWork on April 06, 2012, 07:07:54 amI have read comments by Luftwaffe pilots of aircraft secret stuff having detonators,but maybe they did not use them as much as the Brits.The "Knickenbacke"(hope I got the spelling right!) equipment was found whole in crashed aircraft,but until the Brits took a closer look,it looked like ordinary ILS stuff which the German airlines were using before WW2.I can quite imagine the Navy saying "No!" to any explosive devices aboard U-Boats that they didn't have direct control over!

author: cybergibbons
author_rank: Frequent Contributor
timestamp: April 06, 2012, 12:28:06 pm
content: Quote from: alm on April 06, 2012, 10:21:23 amI think that is semantics really. Bypassing tamper protection is very closely related to reverse engineering - the most common attack would be to take one device, reverse engineer the protection mechanisms and then bypass them on another (e.g. the attack on the chip and pin terminals where a paper clip can be used to sniff a signal was only found by taking apart another pad).Whilst algorithms are often openly documented, the devil is often in the detail, i.e. the specifics of the implementation. Things like poor key management, memory persistence, side channels attacks are all made much easier by knowing details of the implementation. Also a lot of algorithms rely on intermediate values being hidden.Even with more basic things, reverse engineering can be helpful. Often protocols will use CRC, which can be a real pain if you need to work out the polynomial and coefficients from scratch. Look at the code and it's there.

author: G7PSK
author_rank: Super Contributor
timestamp: April 06, 2012, 01:50:36 pm
content: Quote from: SeanB on April 06, 2012, 09:56:35 amMany of us sit surrounded by explosive devices for at least some part of the day. Air bags which all modern cars seem to have many of are inflated by a device which is classed as an explosive device in the UK and when not installed have to be stored and transported in a properly designed and approved magazine.

author: SeanB
author_rank: Super Contributor
timestamp: April 06, 2012, 06:21:11 pm
content: I know, had a "Death on Wheels" run a red light and hit a car going the cross way, spinning it 50m down the street and bending it like a banana. Porsche Carrera 4S, brand new, under 400km on the clock. Driver was unscathed, even though the hit was on the drivers door, which still opened, closed and latched afterwards. All the airbags, tensioners and such along with the passive safety saved his life, only small cuts from broken window glass. One big bang when the taxi finished the accident by impacting into the building under me. Driver ran away, most of the passengers were injured, and some went to hospital.

author: charliex
author_rank: Frequent Contributor
timestamp: April 06, 2012, 06:24:49 pm
content: I reverse engineer hardware and software professionally. Pretty much the only methods that work are based around cost and service, either make it not worth while to do, or have such great service people don't want to clone it. Of course people will still clone something thats popular and you'll deal with customers who'll claim they bought it from you, but thats just people being cheap.I've done multilayer, scractched off names, expoxy, rubber, internal fuses, physical devices, the hidden wires ( just get two or more devices, or dissolve whatever its encased in) electronics are surprisingly hardy, i've left things in things like baths of MEK etc for days. Then i'll sit with toothpicks etc and remove the potting materials.Hardest ones are things like the protected cpus that have rsa2048 encryption etc, but all that happens is its socially engineered from someone at the factory, or the factory software is leaked. You can do all the things like fly logic does, but its just easier and cheaper to rely on peoples love of money.However even sometimes when its not worth it from a financial perspective, i'll do it anyway if its an interesting or unique challenge, so dont get too clever

author: Mechatrommer
author_rank: Super Contributor
timestamp: April 06, 2012, 09:50:06 pm
content: Quote from: charliex on April 06, 2012, 06:24:49 pmso i guess the best way to prevent reverse engineer is to avoid ee and become a fisherman.

author: charliex
author_rank: Frequent Contributor
timestamp: April 06, 2012, 10:52:12 pm
content: Quote from: Mechatrommer on April 06, 2012, 09:50:06 pmYou can't avoid it, just have a business plan that deals with it. A fisherman might be one plan, but i'm sure a lot of fisherman think, hmm i wish i was in EE.

author: NiHaoMike
author_rank: Super Contributor
timestamp: April 07, 2012, 02:41:20 am
content: Create encrypted serial numbers by concatenating a top secret key with an incremented value, then running it through secure hashes and/or encryptions in a secret way. Then make a database where every product must be activated before it can be used. Then the reverse engineer would be faced with seemingly random serial numbers. Then as long as the secret key is safe, the main weakness would be bypassing the activation.

author: Mechatrommer
author_rank: Super Contributor
timestamp: April 07, 2012, 07:05:43 am
content: Quote from: NiHaoMike on April 07, 2012, 02:41:20 amwouldnt it make harder for legal user?... device activation step required?now all this talking about mcu encryption. how about pure analog circuit, i mean even digital/mcu side will rely on it to work, or the analog is the main heart/engine of the circuit. what if this analog is so novel thats worth hacking (reverse engineering). sure they can find a way to bypass mcu side, build another algorithm from different mcu, or remove it entirely from the circuit. i think the challenge is... how to render analog part useless if the mcu/digital part is removed?some said its amatuerish to scratch off part number. now rigol is so cheap and "good" they got this "novel" method of overclocking the adc, thats what they did, scratch off numbers (but unluckily some get through (not well scratched) to the eye of user/hacker). just a thought.

author: cybergibbons
author_rank: Frequent Contributor
timestamp: April 07, 2012, 07:44:50 am
content: Quote from: NiHaoMike on April 07, 2012, 02:41:20 amThere are a lot of flaws, holes and details to get wrong here.1. Your customer has bought a device to use and the first thing you have done is prevent them from using it.2. It requires either a connection to the internet or a temporary way of skipping activation.3. You need to support the activation - it won't always work.4. The device must remember it has been activated. Many similar schemes have failed because this check isn't secure. Why can't I just replace the IsActivated function with a dummy that always says yes?5. Why can't I just spoof the activation server to say yes?6. If I copy the device entirely, bit by bit, I have a clone of a genuine product. How do I tell which is real and which is fake?7. "as long as the secret key is safe". Massive assumption. You either need to be prepared for it being leaked and having copies or have a key revocation mechanism.8. There is still nothing to stop someone copying the product, without the activation part, and it being cheaper, more reliable and more usable than yours.

author: FreeThinker
author_rank: Frequent Contributor
timestamp: April 07, 2012, 12:04:36 pm
content: Dongles are a good deterrent, unfortunately it tends to deter customers as much as hackers. On a slightly different note the Apple iphone4 has recently fitted Pentalobe screws to the botton of its case in place of the previous cross head. The reason (allegedly) was a production issue. If this was true why are all the internal screws still cross head? and why were pentalobe screw drivers 'restricted' for so long? pure protectionism by Apple. Not an apple fanboy myself but they sure know how to piss people off with petty (and ineffective) 'security'.

author: charliex
author_rank: Frequent Contributor
timestamp: April 07, 2012, 05:39:30 pm
content: Unfortunately dongles aren't great either, unless you roll your own and then you're back to the same problems. Most commercial dongles have known cracks or can be emulated. Plus half the time people just put stuff in code like if (!dongle()) exit(); It also gives you more attack vectors, the software, the drivers, the operating system, the interface hardware, cable and the dongle itself. They can be costly too.Even software thats scattered with tests and things like checking the dongle every 1434 mouse clicks or something is still findable.You have to get it right everytime, the cracker only has to get it right once.For software there are some good encryption/virtualisation programs like obsidan, themidia etc that will help but a lot of the time they're used by virus writers because they're good and because AV companies are lazy and also have a hard time unpacking or devirtualising the software they just tag everything that uses that program as malware.

author: firewalker
author_rank: Super Contributor
timestamp: April 07, 2012, 05:59:11 pm
content: You could put a memo inside the device that you are willing to sell the design details for a small fee.Alexander.

author: NiHaoMike
author_rank: Super Contributor
timestamp: April 07, 2012, 06:42:29 pm
content: If it's a device that has networking (of a kind where it's likely for many to be used on one network), what about cryptographically "sign" the MAC address (storing the unique signature as part of the serial number) and implement the check in a manner that does not cause obvious failure if it fails, but something more subtle like revert to a hardcoded default MAC address after a few months. If the check is sufficiently obscured, that problem probably won't be detected until many clones are out for some time and MAC address conflicts start popping up out of nowhere. It would probably work the best if you make it look easy to reverse engineer, so the reverse engineers would think they did it when they clone the device (changing only the MAC address and maybe the serial number) and see it working just like the original.

author: bfritz
author_rank: Regular Contributor
timestamp: April 07, 2012, 08:20:33 pm
content: Quote from: cybergibbons on April 06, 2012, 12:28:06 pmI worked for a company that had a very good business in secure micro's and did a variety of security devices in silicon. CRC's are pretty easy to work through. We had a major customer who's business would be worth millions, decide to use a competitors part that used CRC, rather than SHA-1. We told them we thought this was a bad idea, but they insisted that the CRC was so strong it couldn't be broken. So, we went to work on the competitors part. We didn't even have to reverse engineer or decap the part. Using info freely available from evaluation kits, and the data sheets and application notes, we got a good enough idea of how the part worked. We then wrote a program that would send challenges and get responses from a part, until it figured out the key. Turned out you could actually get several keys to work depending on the secret that was chosen. Our program could figure out all possible keys in about 2 hours. It took me only about 32 hours to research and break the competitors device. Yes, CRC's are weak!The idea there was to think like a hacker.... What would we do, if we needed to figure out the keys? We did things like put metal layers over contents of RAM and ROM, so that anyone trying to use techniques to read out the contents of a device while operating would be stopped. The action of removing the metal layer, would erase the contents beneath, resulting in the keys being destroyed. We used very wide word widths, so that analysis of power profiles become impossible. We designed systems so that the time to give a solution was consistent, and did not vary based on the secret used, so that processing time was not an indicator of the secret. These were just some of the techniques.Security is always about matching how good the security is, with how good the security needs to be. For example, there are really not that many combinations needed for the average lock used on a home. Someone who doesn't know what they are doing is kept honest. But, someone who knows what they are doing, can break into that lock looking like they opened it with the key. (Don't believe me, google "lock bumping".)So, I would suggest you determine what breaking the secret might be worth to someone, and then using that to figure out how much it is worth putting into your product to make that more difficult. For example the credit card companies know that if the keys for access to their systems were to become known, they would be in trouble. So they actually have multiple keys, and the ability to revoke those keys. They also take great pains to protect those keys in the devices that connect to their systems, as the video referenced above starts to show.

author: G7PSK
author_rank: Super Contributor
timestamp: April 07, 2012, 09:25:14 pm
content: I learnt many years ago if you have a secret keep it in your own head, no one can reverse engineer that, at least not yet any ways.If I were a chip manufacturer I would consider encapsulating a spring loaded plunger in the chip, remove the top and the spring is released and breaks the chip, once armed can never be undone and no one is able to get at the inside of a working chip.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: April 08, 2012, 12:08:32 am
content: Another video on smart card reverse engineering:It also features the chip grinding techniques I mentioned earlier.

author: cybergibbons
author_rank: Frequent Contributor
timestamp: April 08, 2012, 09:24:45 am
content: Quote from: bfritz on April 07, 2012, 08:20:33 pmHmm. If you don't know the polynomial, you don't know byte/bit order, padding, or what data is actually CRCed, it's not trivial at all.Take a look at this:http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.htmlIf you don't have control over the data then it can be very difficult. Take the example of a CRC on a a firmware image and you only have two firmware images. Many parameters will give the correct CRC. But to test each one you need to make a valid firmware image, compute the CRC, upload it to the device and test. Even if this is automated, it will probably take 30s+ per test, and even if you knew which specific CRC32 method is used, you still have up to a 16 bit search space. Not practical at all.

author: amyk
author_rank: Super Contributor
timestamp: April 08, 2012, 11:31:34 am
content: Quote from: G7PSKIf I were a decapper I would consider doing an x-ray to figure out how the mechanism is implemented, and find a way of working around it. Even if the die shatters you can still photograph the fragments and reassemble them. There's always a way, and as bfritz and some others pointed out above, it's all just based on how much the secret is worth. Spend a lot of resources protecting something trivial and others will not bother with RE but duplicate the functionality some other way.Quote from: cybergibbons on April 08, 2012, 09:24:45 amI keep putting off a project to reverse engineer a Reed-Solomon ECC implementation, which is probably going to be harder than a CRC. I have lots of known data blocks and associated ECC, but the polynomial and data format is what needs to be figured out. Not much has been written on the subject.