Anyone care to have a guess? - Page 1
Forum section: electronics / general

author: jitter
author_rank: Frequent Contributor
timestamp: September 23, 2015, 04:26:51 pm
content: Attached a close up of a section of a pcb that I was considering sending in for Mailbag Monday. Then I decided that taking it apart myself would be better...(couldn't resist doing it, actually)...Anyone care to guess what it's from?

author: jitter
author_rank: Frequent Contributor
timestamp: September 23, 2015, 07:51:47 pm
content: No?A hint:Against J2 was pressed a conductive rubber similar to what you'd find in a remote control or calculator keypad.

author: jitter
author_rank: Frequent Contributor
timestamp: September 24, 2015, 03:56:14 pm
content: Perhaps the whole board is a better clue? J2 is a clue too, btw.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: September 24, 2015, 04:21:13 pm
content: Some sort of pager?

author: daveshah
author_rank: Unknown
timestamp: September 24, 2015, 04:50:33 pm
content: Online banking security device (like the Barclays PINsentry in the UK)?

author: jitter
author_rank: Frequent Contributor
timestamp: September 24, 2015, 05:36:55 pm
content: Quote from: daveshah on September 24, 2015, 04:50:33 pmYep!Obsolete now because the bank has switched to the colour pattern scanner device (CrontoSign).J2 looks to be a tamper switch. Taking it apart probably bricked it, as you would expect with this kind of device. When I had just taken it apart, it would display "defect" if I pressed the contact that's normally operated by inserting the bank card.Not much in it. But I do wonder why there would be what looks to be a RTC in there. Would the time (and maybe even date) be part of the key generation process? And what about the clock going off over time? It's not like these RTCs are very precise...

author: SeanB
author_rank: Super Contributor
timestamp: September 24, 2015, 05:57:02 pm
content: RTC is used as a source for the crypto engine, giving part of the key usded to communicate to the card. The bank side simply has a sliding window of what they consider to be acceptable clock slip WRT the reader, and simply runs the decode with each minute within the window till it matches, and then uses the difference as the starting point for the next transaction for that card. Will tolerate a large error, depending on how the bank decides, though typically they use a 30 minute window either side of the current UTC time.

author: jitter
author_rank: Frequent Contributor
timestamp: September 25, 2015, 04:53:46 pm
content: Thanks for the info!

author: Jeroen3
author_rank: Super Contributor
timestamp: September 25, 2015, 05:57:41 pm
content: So J2 is the tamper detect?

author: PA0PBZ
author_rank: Super Contributor
timestamp: September 25, 2015, 06:29:27 pm
content: Quote from: Jeroen3 on September 25, 2015, 05:57:41 pmHard to believe, it has SCLK, SDATA, VCC...

author: TheSteve
author_rank: Unknown
timestamp: September 25, 2015, 11:50:11 pm
content: J2 looks more like a connection point for an external smartcard or smartcard socket.

author: jitter
author_rank: Frequent Contributor
timestamp: September 26, 2015, 05:50:53 am
content: Quote from: PA0PBZ on September 25, 2015, 06:29:27 pmQuote from: TheSteve on September 25, 2015, 11:50:11 pmHard to believe, indeed, but a little piece of rubber located in the back of the housing was pressed against it. I presume it's the same kind of rubber as also used in the keypads. If you look carefully at the first attachment, you'll see the indents where J2's pads used to be.When I depressed the power switch (next to the contacts for the bank card chip) with J2 open, it would show "defect". When I did the same with those pads shorted together (but no card inserted) it would show nothing on the display.Now it won't do anything anymore, no matter if J2's pads are shorted together or not, hence my assumption that I've bricked it.

author: SeanB
author_rank: Super Contributor
timestamp: September 26, 2015, 06:08:15 am
content: If you look carefully at the button you can see there are a few switches on it, so that it actually only closes some of them when correctly assembled, but with too much force all short out. I would guess that in the ASIC there is a hardware erase routine that on detecting power up and with shorted bus lines erases the EEprom inside and bricks it. Probably there is a way using an external high voltage programmer to do the initial write, but that is likely done before they blob it, leaving the pad under the blob.

author: jitter
author_rank: Frequent Contributor
timestamp: September 26, 2015, 02:02:32 pm
content: At first I didn't see anything. Then I kept the USB microscope at an angle so that the light from it would hit the rubber at a very shallow angle. Now in two places shades became visible, indicating indents in the rubber. Is this what you mean?How did you know that, are you in the banking security business?

author: SeanB
author_rank: Super Contributor
timestamp: September 27, 2015, 12:27:51 pm
content: I took apart some EFTPOS terminals, and saw a similar set of contacts. Those were a lot easier though, as they were obvious as black stripes in the translucent keypad membrane on the units though.With yours I would look at the top of the mount for those, there likely is a metal plate there with cutouts as that is just a zebra strip conductive membrane, joining the pads through from edge to edge and top to bottom, like the strip on a LCD display, here used to make multiple contacts at once on the strip.