Recently, I was investigating the security of the SX28 device from Ubicom.  I admired the floor plan of the layout where-as there was a ram and a flash area to the left with pure-logic all over on the right (no sign of microcode anywhere unlike a PIC).

 

While the security/config fuses were no so obvious without delayering, I found that the by simply focusing light over the fuse area, you can dump any locked SX device!  In order to do this, the attacker must know how to open your chip up which is tedious.  Once opened, the attacker needs to only focus a halogen lamp into the corner of the die.  Leaving the light on, he tells the device to read out.  3 of 5 reads will result in the true code of the SX device!@!#@!

 

Coder BEWARE!  This is no lie!

 

This is an unexceptable result.  Most chips act funny under high intesity light from your obhective and you can turn the light down and all is well.  In this case, the chip unlocks itself and returns the correct user-code from inside if you just put a dimmed light source in the corner of the die!

 

You don't know me from Adam but I eat silicon for my meals.  I normally post on Avrfreaks and to be honest, I love the AVR but I study all kinds of micros not just Atmels.

 

Good day!

 

It is possible that a transistor connected to the fuse subcircuit but not protected by the metal 3 layer is causing this problem, if the logic which drives the security setting signal is being thrown into an artificial state, the fuse could be bypassed. If this were the case then it would fall into the "unanticipated design flaw" catagory.

Post Edited (Paul Baker) : 5/5/2005 11:39:01 PM GMT

 

"I thought I was wrong once...But I was mistaken ;)"

 

 

Just an FYI to fellow engineers out there.