Finnish cybersecurity agency Fraktal has unveiled a second string to its Raspberry Pi Pico-powered laser fault injection (LFI) rig: the power to blast away a chip’s packaging to show the silicon beneath.
Fraktal’s weblog collection on laser fault injection began a month in the past with the revealing of a Raspberry Pi Pico-powered rig, which permits safety researchers to experiment with triggering security-bypassing faults in chips with a strong laser for beneath $550 — one thing which Fraktal’s Janne Taponen stated geared toward breaking down the limitations to entry for these within the know-how “beforehand achievable solely in specialist labs.”
The most recent entry within the collection addresses the most important concern with laser-fault injection: it will probably solely happen in the event you can see the silicon chip itself. With the vast majority of chips being packaged in a approach that buries the silicon die beneath layers of epoxy, plastic, metallic, and/or ceramic, meaning de-encapsulating, or “decapping” — one thing that Taponen reveals can be achieved with lasers, somewhat than the standard methods of mechanical abrasion or harsh chemical substances.
“One of the vital groundbreaking options of our low-cost Laser Fault Injection (LFI) rig is its twin performance,” Taponen explains. “The identical rig that you simply use for LFI assaults can be used for laser decapping, making it an extremely versatile software. This functionality drastically simplifies the decapping course of, as you may decap after which instantly transfer on to glitching the chip — no want to change between totally different gear or sophisticated setups. Through the use of our rig, you save time, house, and the effort of working with a number of units.”
A 2W infrared laser within the LFI rig is sufficient to etch away at a chip’s bundle, unveiling the silicon beneath in beneath a minute — with, Taponen claims, “a repeatable success charge of near 100%.” It does, in fact, include caveats — together with the chance that you will a sacrificial chip first, to measure the thickness of the bundle and the scale of the die pad beneath, and a warning that good fume extraction, ideally filtered, is a should.
“Primarily based on our testing,” Taponen concludes, “laser decapping provides the very best chance of leaving the chip useful after the method. The precision, velocity, and non-contact nature of laser decapping make it the popular alternative for contemporary IC packages, particularly when working with high-value or complicated chips.”
The total write-up is obtainable on Fraktal’s weblog; design recordsdata and supply code for the rig, together with detailed directions on utilizing it for laser de-encapsulation, can be found on GitHub beneath the permissive MIT license.