INSIGHTS, NEWS & DISCOVERIES
FROM IOACTIVE RESEARCHERS

Saturday, September 13, 2008

New author- Begrüßenswert Herr Karsten Nohl!

We are proud to announce that those who enjoy reading the blog (which we appologize for the lack of content lately) can soon enjoy reading posts from Karsten Nohl as well.

For those of you who are not familiar with Karsten, he played an important role in the discovery and analysis of the Crypto-1 mathmatical algorithm found in Philips (NXP) Mifare RFID devices.

He recently obtained his PhD from University of Virginia in the United States.  He's a known within the Chaos Computer Club (CCC) in Germany as well.

We too look forward to reading Karsten's posts.  Feel free to give Karsten a round of applause by posting a quick comment!

Karsten- Congratulations on your PhD!!

Thursday, April 3, 2008

Atmel AT91SAM7S Overview

Atmel produces a number of ARM based devices in their portfolio of products. We had one laying around the lab so here we go as usual...



The device was a 48 pin QFP type package. We also purchased a sample of the other members of the family although the initial analysis was done on the AT91SAM7S32 part shown above. All pictures will relate to this specific part even though there is not a signifigant difference between the other members of this line except memory sizes.



After decapsulating the die from inside the QFP, we find a beautifully layed out 210nm 5 metal design! Thats right, 5 metal layers! Strangely enough, we would have thought this was a 220nm 5 metal but apparently Atmel doesn't have a .22um process so this is matching their .21um.

The core runs at 1.8v and allows 1.65v operation (thus it is their ATC20 process being used). The datasheet on the device can be found here. The 32KB Flash part also contains 8KB of SRAM (that's a lot of ram!).

Notice on this particular layout, there is CMP filler metal (e.g. dead metal, metal slugs that are not connected to anything floating in SIO2) covering almost the entire die.



The picture above actually has had the top 2 metal layers removed. Metal 5 (M5) being the highest with the CMP filler and some power planes. Metal 4 (M4) had additional power planes and routing wires.

With Metals 1-3 still present, we can get a nice overview of the floorplan now. We can see the Flash, Fuses, and SRAM clearly. The Flash has a solid coating of metal over the entire cell area which has become common from Atmel to prevent UV light attacks we suppose?



We can now label the areas on the original top metal overview photo. There is a small boot-rom loader present on the device as well and is explained in the manual.



The picture above shows some of the bits of this ROM.



In the above picture lay the configuration fuses. Single cell's of EEPROM type memory where any given cell can be set or cleared independently of another. Atmel layed them out very orderly as we see typically. It should be noted that these fuses are buried under 3 metal layers!

These cells were actually on Metal 1 and 2 but there are connections via Metal 3 as well.

There were additional power planes across the lower area of the photo from Metal 4 and 5 that cover those fuses however this isn't buying them any security if the actual lock bits were buried there. A laser can go right through it all keeping the power-bus in tact with a hole in it.



Finally, the Atmel part number of this die. The CMP filler is visible in this picture too.

In summary, this is a very well secured device. Fuses buried in a 5 metal layer design make the Microchip DSPIC's look like a piece of cake in comparision (They are 350nm 4 metal).

We didn't test this, but we are sure UV will set this fuses to a bad state if you can get the light to the floating gate since most all Atmel's behave this way.

Nice job Atmel!

Wednesday, February 13, 2008

Atmel CryptoMemory AT88SC153/1608 :: Security Alert

A "backdoor" has been discovered by Flylogic Engineering in the Atmel AT88SC153 and AT88SC1608 CryptoMemory.

Before we get into this more, we want to let you know immediately that this backdoor only involves the AT88SC153/1608 and no other CryptoMemory devices.

The backdoor involves restoring an EEPROM fuse with Ultra-Violet light (UV).  Once the fuse bit has been returned to a '1', all memory contents is permitted to be read or written in the clear (unencrypted).

Normally in order to do so, you need to either authenticate to the device or use a read-once-given "secure code" as explained in the AT88SC153 datasheet and the AT88SC1608 datasheet.

For those of you who are unfamiliar Atmel's CryptoMemory, they are serial non-volatile memory (EEPROM) that support a clear or secure channel of communications between a host (typically an MCU) and the memory.  What is unique about the CryptoMemory are their capabilities in establishing the secure channel (authenticating to the host, etc). 


Figure 1:  AT88SC153 magnified 200x.


 


Figure 2:  AT88SC1608 magnified 200x.


These device includes:





  • High-security Memory Including Anti-wiretapping




  • 64-bit Authentication Protocol




  • Secure Checksum




  • Configurable Authentication Attempts Counter




  • Multiple Sets of Passwords




  • Specific Passwords for Read and Write




  • Password Attempts Counters




  • Selectable Access Rights by Zone





Figure 3:  Commented AT88SC153.


 


Figure 4:  Commented AT88SC1608.


Section 5 of the datasheet labled, "Fuses" clearly states, "Once blown, these EEPROM fuses can not be reset."


This statement is absolutely false.  UV light will erase the fuses back to a '1' state.  Care must be used to not expose the main memory to the UV or else it too will erase itself.


We are not going to explain the details of how to use the UV light to reset the fuse.  We have tried to contact Atmel but have not heard anything back from them.


Reading deeper into the datasheet under Table 5-1, Atmel writes, "When the fuses are all "1"s, read and write are allowed in the entire memory." 


As strange as it reads, they really do mean even if you have setup security rules in the configuration memory, it doesn't matter.  The fuses override everything and all memory areas are readable in the clear without the need for authentication or encrypted channel!  The attacker can even see what the "Secure Code" is (it is not given out in the public documentation, nor with samples).  Atmel was even kind enough to leave test pads everywhere so various levels of attackers can learn (entry to expert).


Our proof of concept was tested on samples we acquired through Atmel's website.  Atmel offers samples to anyone however they do not give out the "Secure code" as mentioned above. 





  • The secure code of the AT88SC153 samples was "$D_ $F_ $7_". 




  • The secure code of the AT88SC1608 was "$7_ $5_ $5_".




We are not going to show you the low nibble of the 3 bytes to make sure we don't give the code out to anyone.  This is enough proof to whoever else knows this code.  That person(s) can clearly see we know their transport code which appears to be common to all samples (e.g. All die on a wafer contain the same secure code until a customer orders parts at which time that customer receives their own secure code.).  A person reading this cannot guess the secure code in because there are 12 bits to exhaustively search out and you only have 8 tries ;).


Of all the other CryptoMemory products, only the AT88SC153/1608 has this backdoor.  We have successfully analyzed the entire CryptoMemory product line and can say that the backdoor doesn't exist in any other CryptoMemory part.  None of the CryptoMemory parts are actually as "secure" as they make it seem.  The words, "Smoke n' Mirrors" comes to mind (It is almost always like that).  In this particular category of CryptoMemory, there are two parts, the AT88SC153 and the larger AT88SC1608.


Thus the questions- 




  • Why has Atmel only backdoored this part (NSA for you conspiracists)?

  • Who was the original intended customer supposed to be?

  • Was the original intention of these devices to be used in a product that used some kind of cryptography?

  • If the above was true, was this device originally intended to be a cryptographic key-vault?


All these questions come to mind because the backdoor makes it so easy to extract the contents of the device they want you to trust.  Some of you may be familiar with the GSM A5/1 algorithm having certain bits of the key set to a fixed value.

Judging by the wording of the documentation, Atmel gives the appearance that CryptoMemory are the perfect choice for holding your most valuable secrets.

Give us your thoughts...

Thursday, January 24, 2008

ATMEGA88 Teardown

An 8k FLASH, 512 bytes EEPROM, 512 bytes SRAM CPU operating 1:1 with the external world unlike those Microchip PIC's we love to write up about :).

It's a 350 nanometer (nm), 3 metal layer device fabricated in a CMOS process.  It's beautiful to say the least;  We've torn it down and thought we'd blog about it!

[Note:  Clicking on pictures will give you a large ~13 MB file]



The process Atmel uses on their .35 micrometer (um) technology is awesome.  The picture above is 200x magnified of the die (aka the substrate).

 

Using a little HydroFluoric Acid (HF) and we partially removed the top metal layer (M3).  Everything is now clearly visible for our analysis.



After delaying earlier above, we can now recognize features that were otherwise hidden such as the Static RAM (SRAM) and the 32 working registers.

As we mentioned earlier, we used the word, "awesome" because check this out- It's so beautifully layed out that we can etch off just enough of the top metal layer to leave it's residue so it's still visible depending on the focal point of the microscope!  This is very important.  See the pictures below to better understand.



The pictures above and below are the same pictures with the exception that the lower picture has M3 removed but the trough in the SIO2 remains (e.g. the layer has not been completely etched off). 

Can you see why we said Atmel's process is awesome?  We removed obscuring metal but can still see where it went (woot!).

 

The two photos above contain two of the 30+ configuration fuses present however it makes a person wonder why did Atmel cover the floating gate of the upper fuse with a plate of metal (remember the microchip article with the plates over the floating gates?)

 We highlighted a track per fuse in the above photos.  What do you think these red tracks might represent?

Tuesday, January 22, 2008

Security Mechanism of PIC16C558,620,621,622

Last month we talked about the structure of an AND-gate layed out in Silicon CMOS.  Now, we present to you how this AND gate has been used in Microchip PICs such as PIC16C558, PIC16C620, PIC16C621, PIC16C622, and a variety of others.

If you wish to determine if this article relates to a particular PIC you may be in possession of, you can take an windowed OTP part (/JW) and set the lock-bits.  If after 10 minutes in UV, it still says it's locked, this article applies to your PIC. 

IF THE PART REMAINS LOCKED, IT CANNOT BE UNLOCKED SO TEST AT YOUR OWN RISK.



The picture above is the die of the PIC16C558 magnified 100x.  The PIC16C620-622 look pretty much the same.  If there are letters after the final number, the die will be most likely, "shrunk" (e.g. PIC16C622 vs PIC16C622A). 



Our area of concern is highlighted above along with a zoom of the area.  



When magnified 500x, things become clear.  Notice the top metal (M2) is covering our DUAL 2-Input AND gate in the red box above.



We previously showed you one half of the above area.  Now you can see that there is a pair of 2-input AND gates.  This was done to offer two security lock-bits for memory regions (read the datasheet on special features of the CPU).



Stripping off that top metal (M2) now clearly shows us the bussing from two different areas to keep the part secure.  Microchip went the extra step of covering the floating gate of the main easilly discoverable fuses with metal to prevent UV from erasing a locked state.  The outputs of those two fuses also feed into logic on the left side of the picture to tell you that the part is locked during a device readback of the configuration fuses.

This type of fuse is protected by multiple set fuses of which only some are UV-erasable.  The AND gates are ensuring all fuses are erased to a '1' to "unlock" the device.

What does this mean to an attacker?  It means, go after the final AND gate if you want to forcefully unlock the CPU.  The outputs of the final AND gate stage run underneather VDD!! (The big mistake Microchip made).  Two shots witha laser-cutter and we can short the output stages "Y" from the AND-gate to a logic '1' allowing readback of the memories (the part will still say it is locked). 



Stripping off the lower metal layer (M1) reveils the Poly-silicon layer.

What have we learned from all this?

  • A lot of time and effort went into the design of this series of security mechanisms.

  • These are the most secure Microchip PICs of ALL currently available.  The latest ~350-400nm 3-4 metal layer PICs are less secure than these.

  • Anything made by human can be torn down by human!


:->