protection in MCU - Page 1
Forum section: electronics / general

author: Cyber_xxl
author_rank: Newbie
timestamp: December 04, 2013, 12:17:01 pm
content: Hi,I want set additional protection on Atmega128, because the fuse protection can be removed very easy. Some company, likeRussianSemiResearch.com, can do it. Anybody used this service? What technology use by this company? Can I make it myself?

author: Skimask
author_rank: Super Contributor
timestamp: December 04, 2013, 01:14:15 pm
content: If you have to ask the question....

author: lapm
author_rank: Frequent Contributor
timestamp: December 04, 2013, 01:20:15 pm
content: I quess is doable in home, if you have enough time, right chemicals and good eguipment.Its not exactly lets dremel top off this package deal...But if you need to ask price, you probably dont need it. Its usually easyer just design it yourself then reverse engineer software from chip thats seriously abused. I have ever heard only couple cases where this sort of extreme measures was done.

author: amyk
author_rank: Super Contributor
timestamp: December 05, 2013, 05:52:54 am
content: Here's how its done:http://www.bunniestudios.com/blog/?page_id=40More interesting stuff here:http://www.flylogic.net/blog/

author: Rerouter
author_rank: Super Contributor
timestamp: December 05, 2013, 08:03:20 am
content: the cheapest way to add additional protection to your chip is cut off the programming pins, file off the number and seal in a metal epoxy,I'm slowly reverse engineering a security dongle that has done just that, and its become easier for me to log security keys from a man in the middle attack than slowly whittle away a few microns of epoxy at a time with acetone.

author: JTR
author_rank: Regular Contributor
timestamp: December 05, 2013, 08:32:42 am
content: Quote from: Rerouter on December 05, 2013, 08:03:20 amWell that would be good ESD protection. Somehow I think you still might need a condom though...

author: Rerouter
author_rank: Super Contributor
timestamp: December 05, 2013, 09:15:56 am
content: i'll give JB weld as an example (in this particular case) its metal based, but not overly conductive, something like 100K between 2 dip pins, and i have a functional device in my hands that says it can work

author: dannyf
author_rank: Super Contributor
timestamp: December 05, 2013, 11:51:53 am
content: For better encryption, you need to figure out how people attack it.On that, google Sergei Skorobogatov.

author: Psi
author_rank: Super Contributor
timestamp: December 05, 2013, 12:25:49 pm
content: You really cant stop people from getting the code if they're determined and have the money, you can only make it harder/expensive, usually by potting it.You can also add features in code to detect if the code is running on a clone and make the product fail randomly.It's best to do that rather than refusing to run because you want the person copying your product to "think" they have succeeded until after they ship the clone. (unless the product has a safety aspect)I may have stolen these ideas for other people, i think Mike talked about one of them in a vid.1) Kill a few bytes of the EEPROM by looping a random write as part of your board testing procedure.Then test for the dead byte in code at startup. If the byte works you know the code is running on a nongenuine product.2) Have a tuned/special circuit that looks innocuous but can be precisely tested for in code by clocking an output at a set frequency and monitoring the response.(resistors are good, you can use 0.1% where there is no apparent reason for it (except the tuned circuit). Anyone reverse engineering the board would never expect it and will spec a generic 5 or 1% resistor which you can then detect.3) Use some of the undocumented atmega programming commands to change the product ID so it doesn't match any ATmega out there. Then check for that in code at startup.4) Add a battery to the board (soldered on) and store the real MCU code in RAM (kept alive by the battery).In the MCU flash store some different code that does work but has lots of bugs.Anyone trying to extract/read you chip will likely interrupt the power, not realize they just lost the firmware, and pay a company to extract the fake firmware from the mcu.Obviously this method gives your product a finite lifetime before the battery dies, even if you use a rechargeable.5) If your circuit includes some known external clock source and you're using the mcu's RC osc you can max out the RC cal byte then test for the unusual clock rate by comparing it to the known ext clock.FT232RL for example can output a clockThe hard part with all these techniques is making sure they will never activate in your official products.

author: westfw
author_rank: Super Contributor
timestamp: December 05, 2013, 12:44:36 pm
content: Note that avrs will not run code from ram...

author: Psi
author_rank: Super Contributor
timestamp: December 05, 2013, 12:45:36 pm
content: TrueYou could always write an interpreter

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 05, 2013, 01:01:34 pm
content: We had issues with our PIC-based dongle being cloned. A SemiResearch-affiliated guy told us that PICs are easy targets for tapping some security-related signal with microprober needle, then reading the flash usual way. We had developed a simple countermeasure - destroy PGC/PGD pin's on-chip IO buffers. We had used a ZIF socket with all pins grounded, except PGC/PGD connected to a high current 12V source via switch - insert the PIC, flip the killswitch on, count 1,2,3, flip the switch off - done. We were testing both functionality and programming mode inaccessibility after that and reliability was very high (some 2-3 failures from a thousand). And no more cloning at all. But that doesn't work well for all models, I had tried the PIC16F877A the same way later and magic smoke escaped it.Locking to some sw-detectable feature gives much lower degree of protection - with 8-64K firmware sizes for an adequate skilled reverser it will take just half a day spent in disassembler to figure out such tricks

author: amyk
author_rank: Super Contributor
timestamp: December 05, 2013, 02:29:34 pm
content: Quote from: abyrvalg on December 05, 2013, 01:01:34 pmAnd of course the obvious counter-countermeasure is to just tap those lines on the die too - if they were determined enough to decap the chip and probe signals on the die a faulty I/O buffer isn't going to stop them. More likely the cloners just moved on...

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 05, 2013, 05:38:11 pm
content: Quote from: amyk on December 05, 2013, 02:29:34 pmNo, those guys who ordered clones were definitely willing to continue (a bloody dogfight for that specific market segment had continued for at least 3 months more), but something wasn't so easy as before. This approach also denies other methods like power glitch fuse bypass and selective UV erasing mentioned in some link above. SemiResearch had some more advanced approach also - something with direct electrostatic sensing of trapped charge locations in flash die area, but that's too complex/expensive for the most consumer-grade targets I guess.There are ready-made solutions with battery-backed SRAM like Psi had mentioned in (4) - famous DS5240/DS5250 secure MCUs for example, but they are quite expensive and hard to buy. We've seen one DS5240-based security box that had SRAM preloaded by developer, but many customers complained about boxes self-destructed (no, no explosions, just SRAM keys reset) during shipping - bad battery contact + strong vibrations in transport I guess.Also I've heard that some recent Atmel products were designed with security bit tampering in mind - the bit cell itself was moved into a layer under main flash array to prevent both selective erase and needle tapping. And there was some kind of proof - one very lucrative cloner's target security box based on AT91SAM7S256 was never cloned.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 05, 2013, 06:17:30 pm
content: Based on past experience whit same issue ,bad guy use nitric acid for melt the package epoxythe use micro probe for tap into internal flash memory directly ,so it not use programing interfacenoting may stop it since it read flash directly ... forgot to sand chip part number it writed on the die ,at time i got that kind of issue it have cost 5K$ to my competitor for got code ..so if you have that kind of issue on a expensive product it have only one solution that may workuse unique serial number chip (maxim made some) and validate user via internet whiting a database ,so if serial number not fit user location or was knot fake ,not let system operate normally , so if clone it not able to boot-up , it need to decompile and patch code for bypass internet activation ,put that on a FPGA make it more hard since decompile a FPGA was not easy and FPGA fab legal dep keep eyes on that kind of toolanother similar way was use internet remote firmware uploading via encrypted bootloader wit each user have unique key based on unique silicon serial numberhope it help everything else was futile and easy to bypass ..

author: matkar
author_rank: Regular Contributor
timestamp: December 05, 2013, 08:55:08 pm
content: Microchip produces some EEPROMs with unique MAC address permanently written on it. You could use this as a mean of hardware identification by your firmware.On the other hand you have to ask yourself if it's worth wasting your time and money chasing a better protection. There is a bigger chance someone will copy your idea and not the product. If your code isn't huge, doesn't have some special proprietary algorithms, does not incorporate some expensive to buy protocol stack or the product isn't produced in ten thousand pieces per year, there is a very slim chance anyone even trying to read the content.

author: mazurov
author_rank: Frequent Contributor
timestamp: December 05, 2013, 09:14:52 pm
content: Quote from: Cyber_xxl on December 04, 2013, 12:17:01 pmSwitch to a newer MCU. Old ones were very easy to hack; the ones introduced in the last 5 years are many times more secure and having them read by aforementioned services is expensive.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 06, 2013, 02:05:30 am
content: Hi new CPU just use a smaller die something like 45nm instead of 180nmbut hacker tool advance to so it false security felling to use newer chipif you lookhttp://www.chipworks.com/alredy read and publish image from die of main chip of xbox oneeven if it use 28nm ,so really your newest cortex chip was pice of cake ..and material for expose die and probe was available in lab of many universityand general micro was not designed for be secure by DIE probing attack so everyting insde micro may read whit no problem Flash/Rom/EEpromfor got that level you need to go into secure MCU market that require heavy NDA for buy itthat a exemple article written for defat smart card that was designed for be tamper resistant DIE and even here you will see that it quite easy to read it flash/romhttp://www.mikahk.com/topics/hack-microcontroller.aspso as i said FPGA whit encrypted load (xilinx DNA) was way to go or/and internet activationremain was futile ...

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 06, 2013, 03:29:34 am
content: HIanother way for implement secure design ,but never test it myself for this one ..use a smart card chip that connect to your micro controller (www.basiccard.com)encrypt packet bethen your MCU and the card ,elliptic if possiblethen on your application code ,hardcode some function into hardcoded address into memory space (no label or else for identify it)then instead of use "call XYZ_functio" use "JMP" to the absolute address of that function (will return into it bit later you will understand why)so on you code when need that function ,you send encrypted packet to the card whit that function name on it (or better a number) then card use look-up table and return the goodhard coded address of that function iso decrypt packet on the mcuand make a JMP to this absolute address ...since source code and linker not knot were that function was were in memory (no label but hardcoded address)even if code was disassembled it will take lot of time figure how to patch code for it work without the smart card, you may even put some function into the smart cardand smart card may cut for keep only bare die and solder it up-side down on the pcb ...this save place and this add only ~10$ to the designjust need to carefully chose witch function will be hide .need to be critical functionbut not called to often since card calling will induce some lag ..sorry for my bad english was dyslexic and english was not my native language to ..

author: Cyber_xxl
author_rank: Newbie
timestamp: December 06, 2013, 08:39:04 am
content: With smart cards is a good idea. Instead you can use the crypto MCU. But they also hack. But the price for such a hack is very high.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 06, 2013, 01:44:55 pm
content: Hiput hand on crypto MCU good luck ;-) ,require solid company background and NDAbut basiccard was easy to get and low cost

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 06, 2013, 11:28:29 pm
content: I feel like we all went a bit too far in the discussion. Let's ask topic starter what kind of product he wants to protect and advise something adequate. Cut pins/scratched marking will be enough for yet another oven timer, but even a smartcard can be weak for a pocket sized orbital bomber

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 06, 2013, 11:53:52 pm
content: Hi even bomber was not very hack proofhttp://tywkiwdbi.blogspot.ca/2008/11/us-nuclear-secret-unlock-code-was.htmli hope at least it put 3 trial before lock itseriously fist post talk about AVR Mega128 and link to russian site that unlock it for 1000$so at that price everything that may generate some money may a target ...cost less to read the chip that try to rewrote code ..

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 07, 2013, 12:55:39 pm
content: Hahaha, I guess some "khaki brain"s logic was "00000000 is 10^8 complexity"I've checked that first link - looks like some russian branch of a company that I've mentioned (SemiResearch.com - those are from Lithuania, but I've heard some their people had moved to Moscow recently).Btw, they offer some "installation of 3-level security", which are:"Level 1" - IC epoxying"Level 2 - hidden breaking of pin inside case" - picture looks like some hole was drilled into the IC at right location to break the connection, then filled with epoxy - a bit more advanced "cut the pins" approach."Level 3 - hidden removing inside chip control logic of pin" - that must be I/O buffer destruction.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 07, 2013, 01:12:01 pm
content: it fun that all that 3-level not lock itself outsince normally it probe the flash memory bus directly by microprobing it(ok when lasy sometime it only force to knot state the fuse bit)not to forgot that that protection service you need to send your chip to the bad guythat way was also not manufacturing friendly if you do some volumesmart card chip ,FPGA or internet activation remain better and more secure..

author: abyrvalg
author_rank: Frequent Contributor
timestamp: December 07, 2013, 05:38:43 pm
content: Quote from: Alphatronique on December 07, 2013, 01:12:01 pmThat's what my post was about - their protection methods are no rocket science, we had discussed them all here. So no need neither to send the chips nor to pay for that, all those things can be implemented even by a home hobbyst.As I understand, probing full flash bus will require some 20+ micropositioner needles (data, address, control) instead of just 1+ for security bit - more expensive equipment setup, more complex work. So rather cheap and easy tinkering with programming pins can make some difference too.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 07, 2013, 06:20:48 pm
content: Hiblowing the input pin or drill into it will not remove the rest of circuit on the die itselfstill may probe before pin buffer or some were else in the logic block ,also that may damage chip and lower down the MTBF of your design ,just use knot ESD damaged partnot to mention that it have also trick that not need to have more that 2 -3 probeas exemple read it one bit at the time so need to read the flash array 32 time and move to next bit of data each time for a 32 bit busbut it have also many other way to do it .. and dump code from a chip like glitch ,study current draw on every clock cycle etc etc .... (the even not require to expose die )so if you need protection from average joe just sand part number of every chip and pour it into epoxy , but if you need to protect from bit bigger or motivated people you need big artillery ..4-5 time a year was hore a hardware security consultant by company that got clone issuethat more current that most people thing .. now money was in soft IP not longer in PCB/SCH designp.s. best trick was never show your stuff in a trade show if your not 100% production readythat a fatal error ,some guy will buy one unit then copy it and mass produce it before youduring time you try to setup your prod and complete certification ...i see it just to much often ...the one that win was the one that able to fill the market before it competitor ..

author: westfw
author_rank: Super Contributor
timestamp: December 08, 2013, 05:17:03 am
content: QuoteI'm not convinced that IP theft is necessary or sufficient for this. Perhaps if the original vendor spent more time learning how to manufacture his product, serve his market, and support his customers, and less time being paranoid, "protecting his IP", and sanding the markings off the chips in his PCB, his customers wouldn't have been "stolen.""Can't deliver" is a MUCH deadlier sin than "your version is slightly more expensive than this no-name vendor with the same product."I knew a guy who was selling an rs232 thermometer (for machine room monitoring), and sanding the numbers off his chips. I mean, really?

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 08, 2013, 04:23:19 pm
content: Hi , not sure someone what to clone a thermometer ? and no real IP here tothis is a example of that o talk about ,http://www.gedigitalenergy.com/MD/catalog/BMT300.htmit take 6 year in R&D whit a team of ~10 full time staff (ING ,Physics ,math,electic etc)so you end up whit a product that sold for price of car ,90% of that was firmware IPhardware was similar to a 4 x 125MHZ + 8 x 12MHz Scope ..if company "X" what to buy 10 system and it cost 1000$ for read from the code from the DIEwhat did you think it do ... for price of one system it may recover the code and reverse engineering the hardware , so if gouvernement "Y" what 1000 system ?same apply to any specialised and expensive tool ,optic fiber ,medical ,diagnostic toolnow if you look into consumer market like cell phone ,tablet ,set-up box ,game console etc etcon every one you will find at least one SOC or ASIC ,ok first reason was reduce BOM costbut that also effective protection system like iphone that use it own in-house CPUand finally raspberry pi it sold over 2-million unit no copy ,again main cpu was customi bet that if arduino was not open source will end up whit clone instead of copyso put it open source was also a kind of protection , you may copy it but not use nameend user knot what it have on hand ...not forget that when some one clone a product most of the time it also a fakeso legitimate company got support\warranty call to ,until it realise that it serviceunit that it never build itself .. and end customer was not aware that it have but a cloneso think that in any product encrypted boot-loader ,and disable jtag in software was a minimumeven for rs232 thermometerbut for more aggressive mesure need to set proportionally whit unit sale price or volume of sale ..

author: Jeroen3
author_rank: Super Contributor
timestamp: December 10, 2013, 08:36:31 pm
content: There are mcu's that can run code encrypted with AES, and the key is write only by design, not accesible by bus matrix. Sometimes even dummy circuits are added around that part of otp to fool the die readers.But AES parts come with a price and export limitations.

author: Alphatronique
author_rank: Regular Contributor
timestamp: December 20, 2013, 08:17:54 pm
content: Hihi just grab that thesis paper from hackaday postread encryption key only by sound of PCB ....http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdfsame was already done in past whit supply current of cpu/micronaturally it may also serve to dump code when combined with glitching of supply...original posthttp://hackaday.com/2013/12/20/ambient-computer-noise-leaks-your-encryption-keys/

author: SArepairman
author_rank: Frequent Contributor
timestamp: January 07, 2014, 04:08:49 pm
content: just give me some plane tickets and a bottle of vodka and I will "protect" your MCU

author: SeanB
author_rank: Super Contributor
timestamp: January 07, 2014, 04:45:56 pm
content: Nice musical interlude there.....Thumbs up for that!