Perimeter
2/2/2010
12:55 PM
50%
50%

Researcher Cracks Security Of Widely Used Computer Chip

Electron microscopy could enable criminals to develop counterfeit chips, Tarnovsky says at Black Hat DC

WASHINGTON, D.C. -- Black Hat DC Conference 2010 -- The ultra-secure technology used to protect some of the world's most commonly used microchips might not be so secure, a researcher said here today.

Christopher Tarnovsky, a researcher at Flylogic Engineering who has made a business of hacking "unhackable" chip technology and other hardware, was at it again today with the revelation of vulnerabilities in the Infineon SLE 66 CL PE chip, which is widely used in computers, gaming systems, identity cards, and other electronics.

Tarnovsky offered a step-by-step explanation of his successful efforts to crack the chip's defenses using electron microscopy. During the course of about nine months, Tarnovsky said he was able to bypass the chip's myriad defenses and tap into its stored information without detection or chip failure.

"I'm not saying it was easy, but this technology is not as secure as some vendors would like you to think," Tarnovsky said.

Using a painstaking process of analyzing the chip, Tarnovsky was able to identify the core and create a "bridge map" that enabled the bypass of its complex web of defenses, which is set up to disable the chip if tampering occurs. After creating the map, he used ultra-small needles to tap into the data bus -- without disturbing the protective mesh -- and essentially "read" all of the chip's stored data, including encryption keys and unique manufacturing information.

Using this data, criminals could potentially re-create the chip in order to develop counterfeit systems or subvert widely used systems, Tarnovsky said. Such exploits could allow criminals to break through the defenses of pay TV services, medical ID systems, or even Microsoft's much-vaunted Xbox license chip, he said.

Tarnovsky said he has informed Infineon of the flaws he has discovered, but so far the company has not responded. "Their initial reaction was to tell me that what I'd done was impossible," he said. "Then when I sent them some video and the code that I just showed [to the Black Hat audience], they went quiet. I have not heard back from anybody."

In addition to Infineon, Tarnovsky said he informed officials at the Trusted Platform Module (TPM) standards organization, which sets security guidelines for the widely used PC chip standard. But he has not heard back from them, either.

Tarnovsksy said he believes similar exploits would be possible with other chips as well as Infineon's, though he has not attempted them yet. The exploits would not be easy to reproduce -- Tarnovsky said he went through many chips and many needles, and electron microscope time costs $350 per hour. "But the reason it took so long was not so much what the vendors have done, but me learning how to do it," he said. "Once you know what to do, it's not incredibly hard."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0196
Published: 2015-06-29
CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

CVE-2015-0545
Published: 2015-06-29
EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2015-1900
Published: 2015-06-29
IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors.

CVE-2014-4768
Published: 2015-06-28
IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode.

CVE-2014-6198
Published: 2015-06-28
Cross-site request forgery (CSRF) vulnerability in IBM Security Network Protection 5.3 before 5.3.1 allows remote attackers to hijack the authentication of arbitrary users.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report