Slashdot Mirror
DARPA Technology Could Uncover Counterfeit Microchips
coondoggie writes The Defense Advanced Research Projects Agency said this week one of its contractors, working on one of the agency's anti-counterfeit projects has developed and deployed what it calls an Advanced Scanning Optical Microscope that can scan integrated circuits by using an extremely narrow infrared laser beam, to probe microelectronic circuits at nanometer levels, revealing information about chip construction as well as the function of circuits at the transistor level.
Why are big websites never posting images? In this particular case it would have been nice to see at least what a scan of an IC looks like.
Get free satoshi (Bitcoin) and Dogecoins
Indeed, now the U.S. government will have tools it needs to create malicious counterfeit chips that are nearly undetectable.
I have had numerous problems with counterfeit transistors and Zener diodes.
How can you profitably screen thousands of rectifier diodes for their zener point, then grind off the original markings, and mold on new partnumbers??
At $0.003 each?
At least the transistors failed spectacularly. :)
Truth isn't Truth - Guliani
The modern day processor has about 2 billion transistors. That may take a while.
Most of the accused "counterfeit" chips I've read about aren't "counterfeit" at all. They are used, secondary market, chips harvested from used boards. The "infamous Guiyu" of China e-waste fame is a hub where workers cut out individual microprocessors and chips from boards and repurpose them. The general term in the industry is "gray market"... gray because it's not purely black market, and because of the difficulty in distinguishing what the illegality is when a Chinese factory has substituted a working used part for an OEM part.
Gently reply
Not a problem. The DoD has already worked out the protocol for this.
1. "Outsource" your technology objectives
2. Discover your technology has been hijacked
3. Destroy the technology you paid for
4. Pay again for the technology, this time having it in the hands of people slightly less-likely to hijack it
I believe it's called the "ISIS" methodology.
Why would the ability to flawlessly clone hardware crypto chips ever be useful to a government that respects privacy?
I am no engineer or scientist, but are these precise enough to be used to extract hw encryption keys? Because if so, I think I can guess the real purpose for developing these.
It is great to have a tool for visual inspection, but IC has many layers. If I was to introduce some nasty feature in an IC, I could bury it in lower layers so that it cannot be seen.
Granted that my experience is way out of date, but why not just try every possible op code, especially undocumented codes and see if they do what is expected? This wouldn't detect counterfeits but could turn up any built-in monkey business.
Fifty years of Yippie! 1968-2018
From the article:
"The ASOM technology housed at Naval Surface Warfare Center in Crane will help engineers provide forensic analysis of microelectronics, including integrated circuits confiscated by law enforcement officials, DARPA stated."
Vague? Move along civilian......
...just take a look at the chip top.
It really isn't rocket science. Take a look at the top of the IC or Transistor, often you'll see a "glazed" top which indicate that the chip has been painted over, and the new fake numbers gets printed on top of the paint.
Another way, look closely at the transistor or semiconductor - just use glasses or a magnifying glass to take a close look, a hobby microscope will do just fine too...if you discover that the surface has been "sanded", you should be on alert.
Cheap knockoffs are IMHO a far greater problem than counterfeit chips, on eBay you'll often encounter 2nd grade components that have failed the factory quality control, these may be fine for hobby usage (in fact, I use them myself - but not for anything serious). These include LED's and transistors, I often purchase these bulk so I can afford to toss them away like candy wrapping and do as many experiments as I wish without thinking about the economics behind it.
The most surefire way to test for counterfeit components is - surprise - to test them. I have a Curve tracer for the Diodes and Transistors, and I can test them in 10-20 current/voltage steps, drain, amplification, switching speed etc...and the curves will show me the actual specs of the semiconductor on the screen, practical stuff. These are rarely cheap though, you can pick one up at eBay...but you're probably better off making one yourself with a Stepping/multiplier-PSU + a cheap oscilloscope as these are VERY expensive, even 30 year old units like mine.
I've shopped for components at eBay for a long time, we're talking over 10 years, and yes...I can confirm that it IS an increasing problem, but not at a disastrous level yet, It's very rare for me to come across counterfeit products...it's FAR more common to come across second-grade components.
What this world is coming to - is for you and me to decide.
Most of the chips built in China are being built by fabs set up by foreign companies, not indigenous Chinese foundries. There is a big difference. I can't understand why so many companies are willing to provide their technical knowledge to China just to do business with them. Even for people looking to make an extra buck off the cheap labor should see the shortsightedness of taking this path.
Sorry, this isn't a reply to your comment, but Beta is fucking me in the ass 6 ways to Sunday & I can't post otherwise.
There are some smart people at DARPA, but most of them are pudgy, boring, balding, uninspired, lazy government piggies, sucking on the teat of the American taxpayer.
There seems to be an ongoing and concentrated PR campaign from DARPA. To point:
http://threatpost.com/darpa-working-on-provably-secure-embedded-software
Anyone remember this quote? "Beware of bugs in the above code; I have only proved it correct, not tried it."
Provably secure?!?!? How the fuck do these lazy government slugs prove /mathematically/ that it's immune from side channel attacks? Or single event upsets?
Anyone remember this quote? "Beware of bugs in the above code; I have only proved it correct, not tried it."
My job is bypass the security of embedded systems. These pencil-pushers are just fleecing the public, waving their hands and throwing around mumbo-jumbo and jibber-jabber (those are very technical terms.)
Fuck you, DARPA. Shut Ms. Prabhakar's PR machine down before I put my 63 year-old size 13 up your figurative ass. And yes, DARPA, get the fuck off my lawn.
Oh, you do not understand, that money does not have a homeland?
So, the CEOs and international conglomerate owners do not think about "shortsightedness of taking this path".
" 'SHIELD demands a tool that costs less than a penny per unit, yet makes counterfeiting too expensive and technically difficult to do...' "
This is really frustrating. Some former colleagues and I were trying to form a startup company to develop a solution for semiconductor authentication using the same technology the article is describing. When we examined the SHIELD RFP, we figured that we could meet the technical specifications, but their "penny per part" demand led us to conclude that we had no viable business model. There are multiple competing solutions. For example, there's a Swiss company that will custom engineer a chemical taggant which would be very expensive to reverse-engineer. We guessed that theirs was the cheapest solution. But now it sounds like DARPA has chosen to implement the same sort of solution that my colleagues and I were developing -something based on integrated circuit technology. How the hell can anyone possibly meet that price point??? Just designing an IC isn't cheap. You need expensive CAD software, computers and skilled engineers. At a penny each you would have to sell tens of millions of units to break even on your development costs. The military has nothing close to that volume.
Now they're talking about building a "100 micron x 100 micron dielet..." to insert on a product? Does anyone know of a wafer fab that will build you a 100um x 100um integrated circuit for a fraction of a penny? I doubt that you could purchase and dice up a BLANK wafer for that cost! Your kerf loss is going to ~50 um if you're lucky!
Penny per part my a$$! They gave this work to someone knowing that the per unit cost will inevitably be several thousand percent higher than what the specification demanded.
Comment removed based on user account deletion
The "shortsightedness" is giving away your technology advantages to a country that is slowly losing their only advantage, namely cheap labor. Low labor costs and little to no corporate regulations in the labor and environmental areas plus some considerable currency manipulation has allowed China's exports to surge. Now other countries in SE Asia are able to compete with China's low labor costs while China's labor force is asking for better wages and benefits which if granted would help stimulate their domestic economy. If China cannot improve it's citizens buying power the size of their market will no longer justify doing anything to enter their market. China may post a high GDP but their per-capita statistics are far behind countries such as Japan and the US. China is not known for their innovation or quality they are just manufacturing what others have designed. Companies willing to give China all their proprietary technology just to operate within China is a one time event. If they decide to move their manufacturing out of China they don't get to ask for their technology back. One good example is when Google folded up their tents and left China instead of capitulating to China's demands.
Once you decap a chip, a toy microscope is enough to tell a counterfeit die from the real thing. Using a laser to stimulate the chip is not a tool to detect counterfeit chips, but for testing, reverse engineer, and thus potentially make counterfeits.
My other signature is a car