TR Editors' blog

High-Security Chip Cracked

Researcher opens up a chip used in various devices.

Erica Naone 02/03/2010

  • 5 Comments

Christopher Tarnovsky, who operates the California-based consulting firm Flylogic Engineering, must strike dread into the heart of anyone working on secure computer chips.

At the Black Hat DC, a computer-security conference in Washington, DC, Tarnovsky gave an impressive demonstration of how even the most secure system will fall under a sustained, determined attack.

Tarnovsky says that he spends almost every waking moment hacking chips. He even owns a focused ion beam work station--a secret weapon for chip hackers. Such a machine costs a quarter of a million dollars, used.

The target in Tarnovsky's demonstration was the family of chips used for trusted platform computing, and for controlling access to the Xbox 360, GSM SIM cards, and satellite television transmissions. After six months of intense work, Tarnovsky says he developed a technique that allows him to break one of these chips in a matter of hours.

That's not to say that the chip's security is poor. Tarnovsky speaks of its design with great respect. When he describes what he had to do to get into it, it's easy to see why: the device is loaded with encryption, dummy data, light sensors that destroy the chip if they detect a signal, and a complex coating of mesh that will also kill the chip if it's mishandled.

"It's a really nice design," Tarnovsky says, "but it's not as secure as they claim it is." This turns out to be the message he wants to get across. Since this chip is rated with extremely high security, Tarnovsky has identified improvements that he believes should be made to protect it further.

However, he acknowledges that few people have the skill and equipment needed to break the chip. In this case, announcing that he's broken the device won't mean a flood of copycat hackers. Instead, it just shows that nothing is invulnerable.

Print

Close Comments

To comment, please sign in or register

Forgot my password

shreshtha

1 Comment

  • 741 Days Ago
  • 02/03/2010

focused ion beam work station

As far as I know, changing behavior of the chip or enabling/disabling particular internal feature of chip using this work station requires "accurate" coordinate details of the bit/mask etc. in the chip, which is known only to back-end people of chip manufacturing unit. Seems not easy to know. Any other usage of it, I am unaware but willing to know. Howsoever he uses this workstation, its just amazing.

Reply

Bonobo

22 Comments

  • 741 Days Ago
  • 02/03/2010

Who Can Crack It?

Well, lets assume your corporate secret designs are thus protected by this chip and Chinese Military or their corporations want to get ahold of your intellectual property.

Do you think that trade secret processes and machinery are worth spending a few million or tens of millions when it can easily take more than that to develop new technology when you can merely break security measures for less?

Pretty simple answers for me as I see it.

Reply

amprice66

1 Comment

  • 740 Days Ago
  • 02/04/2010

Re: Who Can Crack It?

Turning on and using the TPM chip is one of the single most cost-effective steps for ensuring robust security in the PC. The TPM was designed to enable trusted online computing and prevent software-based attacks—the predominant security threat impacting the IT equipment. At the same time, the TPM also provides a tamper-resistant means to physical security of the PC itself, and has always been billed as such. The Trusted Computing Group has never claimed that a physical attack—given enough time, specialized equipment, know-how and money—was impossible. No form of security can ever be held to that standard. However, as a tamper-resistant, general purpose encryption device for mass manufacturing, TPMs do protect against most hardware attacks even when a physical PC is lost or stolen, particularly when a layered security approach is deployed as with industry best practices. MORE @ http://www.trustedcomputinggroup.org/community/2010/02/black_hat_conference_report_about_tpms

Reply

micheltaine

6 Comments

  • 738 Days Ago
  • 02/06/2010

Re: Who Can Crack It?

Your text is, for some reason, sliced off on the right side, at least with my browser Chrome.
How is this?

Reply

Guest (theTónster)

  • 731 Days Ago
  • 02/13/2010

Re: Who Can Crack It?

I noticed that oddity too.
Just highlight the text with CTRL-A
then copy it to your text editor;
the whole thing will be in plain view.

Reply

About

Insights, opinions, and our editors' analysis of the latest in emerging technologies.

Subscribe to the TR Editors' blog RSS Feed

Advertisement
Advertisement

Facebook

Advertisement