Shop OBEX P1 Docs P2 Docs Learn Events
Secure Prop Module - Page 2 — Parallax Forums

Secure Prop Module

2

Comments

  • mctriviamctrivia Posts: 3,772
    edited 2009-03-01 08:30
    No but it is funny when digikey sent me the 9mm lithium battery this module takes for the rtc. had warning labels everywhere. i only ordered 1.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod $50CAN has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-01 08:30
    http://www.propmodule.com/ finally up

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod $50CAN has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module.
  • heaterheater Posts: 3,370
    edited 2009-03-01 12:47
    I don't know much about Dynasolve 165 and certainly don't have any. Just something I found via Google when pondering how mctrivia is going to reprogram his modules after blowing the fuse prematurely[noparse]:)[/noparse].

    That company has many similar potions, the safer ones do not eat all epoxies but work on the ones they do like in one hour at 200 degrees F.

    No problem that all the plastic is gone, the silicon and wirs are still there to probe.

    Dissolving lithium batteries is an experiment I am not going to try.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    For me, the past is not over yet.
  • AleAle Posts: 2,363
    edited 2009-03-01 13:02
    Just to be a little pedantic roll.gif :

    A solvent dissolves. What happens with that product is something else, It will oxidize organic material and it seems also aluminum (HCl can also). Later it may dissolve the products of these reactions. Two different processes.

    If it reacts with the material, then it is not a solvent cool.gif
  • heaterheater Posts: 3,370
    edited 2009-03-01 15:17
    I am not solvent[noparse]:([/noparse]

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    For me, the past is not over yet.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-01 17:04
    How to reprogram after blowing fuse early. Well could write code in that lets you upload code through another pin. Would still be secure if that code immediately overwrite the eeprom not letting people see what was there before. The other option is test thoroughly before blowing the fuse.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • BradCBradC Posts: 2,601
    edited 2009-03-02 04:17
    Actually, I've just noticed you don't even need X-rays. You have the Gerber file right there that tells me *precisely* where to pop my dremel to get access to the eeprom.

    It's a nice little all in one module, but it's not secure under even the loosest definition of the word.

    Oh, also the link "PropMod" in your sig is wrong and points to an entertainment site.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Cardinal Fang! Fetch the comfy chair.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-02 04:43
    the gerber file i have published is for an adapter board to the prop pinout not to my module

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-02 04:49
    fixed my signature silly mistake

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • BradCBradC Posts: 2,601
    edited 2009-03-02 07:39
    mctrivia said...
    the gerber file i have published is for an adapter board to the prop pinout not to my module

    Ok, but you did publish unpotted photos of the module [noparse]:)[/noparse]

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Cardinal Fang! Fetch the comfy chair.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-02 07:40
    yes then removed pretty quickly. also changed parts around a bit.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-02 07:50
    Why so much abuse? I realize it is possible to physically attack the device and get at the code if you are skilled enough and have the right tools. With the right tools I could take apart any IC and figure out how it works and make a copy.

    If you want to buy a couple and have me secure some code on it and see if you can get it be my guest. Just please do not write detailed instructions.

    If you have an idea on how I could make it safer I would love to here it. I want to make this as secure as reasonably possible but perfect can not be achieved.

    Most people would not try to reverse engineer your code in the first place. Less would take the bother of trying to get through the epoxy to try and get the data.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • BradCBradC Posts: 2,601
    edited 2009-03-02 07:51
    mctrivia said...
    yes then removed pretty quickly. also changed parts around a bit.

    This is the last time I'll comment on this, honest.

    Security by obscurity is no security. None.

    Parallax thought the code to the SPIN interpreter was "relatively" secure. It certainly had a far higher barrier to entry than a bit of epoxy.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Cardinal Fang! Fetch the comfy chair.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-02 07:55
    how do you propose making it so people can not get at your code then? I here lots of suggestions on how it could be fwarted but few on how to make better.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • heaterheater Posts: 3,370
    edited 2009-03-02 08:34
    I do remember there have been numerous questions posted here about code security on the Prop and many suggestions have been made in the last year or so. The conclusion mostly is that it is just no feasible in any serious way.

    Now there can be a philosophical debate about "what is secure" and "security by obscurity" etc etc. which I don't really want to get much into as obviously you know the limits of your system.

    Security by obscurity can be quite OK. If I don't tell you where I've buried my treasure you probably won't find it. But that does not mean someone won't stumble across it.

    Physical security can be quite fine. I can save my dinner from the dog by putting it in the freezer. But that does not mean my son won't eat it.

    One little niggle is that in you sig. you do say "...or secure" which many would regard as a false assertion.

    Still nice a module anyway.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    For me, the past is not over yet.
  • hippyhippy Posts: 1,981
    edited 2009-03-03 20:08
    mctrivia said...
    this works on the principle of not allowing physical access to the data ... it will blow a fuse making it now inpossible to reprogram the module. Your data is secure.
    That you cannot reprogram the device does not make the data / code secure. To make it secure you have to prevent the data from being accessed ....
    mctrivia said...
    With this module there is no way to access the SDL from the EEPROM because the board is encased in epoxy.
    My money is on there being a 4K7 pull-up on SDA so while the Propeller is booting to Ram from Eeprom it will be regularly clocking out SCL pulses and SDA will be tugging away at the pull-up and increasing current draw as it does so. Tracking current draw into the module would therefore map to the bit-stream coming out of the Eeprom.

    It may be possible to hold the Prop in reset so it floats SDA and SCL and just bang in SCL to read the Eeprom at a leisurely rate.

    If it is that simple it makes the issue of adding X-Ray proof shielding etc rather moot.
    mctrivia said...
    I here lots of suggestions on how it could be fwarted but few on how to make better.
    Because it's only fair that if I can put effort into determining how to attack the chip I should be able to put some effort into defeating the very same attack, for the above ( assuming it is an attcak vector ), it would necessitate a means to keep current draw constant while reading Eeprom, or at least constant enough to require sensitive equipment to be able to discriminate between SDA on or off. That could be as simple as an inverter and R to +V which pulls the same amount of current as SDA does when it is low. I'd also lose the external SCL line because that makes it easy to know where to look for the differences in current drawn, and it also stops people from being able to drive SCL from an external source.

    That said, with judicious burning out of the chip and various clamping diodes on I/O pins, I'm wondering if it wouldn't be possible to ( rather brutally ) reconfigure the Propeller silicon and get access to SDA and SCL that way.

    Mind you, I'm just wondering why I'd go to such effort and why I wouldn't take a metalwork file to the epoxy and whittle away until I have something useful exposed ?
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-03 21:15
    that is an interesting hack. I have scl access because I wanted to have as many usable pins available as possible. I could cut trace to scl if anyone wants. I will have to test it and see if noticeable current difference

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • mctriviamctrivia Posts: 3,772
    edited 2009-03-04 05:02
    well i placed a small resister(every small one i could find that was not surface mount) in line with the power supply and hooked my oscilloscope up across it. I could not distinguish any meaningful difference in voltage across it(i=e/r) at full speed boot. That does not mean it couldn't be detected just not with my little USB scope. To fix the potential problem of SCL used to slowly trigger the boot sequence I will make it output only with the option of completely disconnected.

    ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
    Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
  • dMajodMajo Posts: 855
    edited 2009-03-04 20:16
    Hippy said...
    My money is on there being a 4K7 pull-up on SDA so while the Propeller is booting to Ram from Eeprom it will be regularly clocking out SCL pulses and SDA will be tugging away at the pull-up and increasing current draw as it does so. Tracking current draw into the module would therefore map to the bit-stream coming out of the Eeprom.
    From Prop datasheet:·· IPULL-UP(0)=(Vdd-Vol)/RPULLUP=617uA·[noparse][[/noparse]Mctrivia]· ····· IPULL-UP(HiZ)=Iil=1uA···· ····· Idd@12MHz(ch9.6-fig12)=2..2,4mA········ · [noparse]/noparse]Parallax pull-up=10K => [b]I[sub]PULL-UP(10k)[/sub][/b]=[b]1..290uA[/b
    First thing I see is the difference in pull-up resistors: Hippy hypothesize a 4k7 for Mctrivia while Parallax on datasheet schematics have a 10k. So basing my thoughts on Parallax designs from which I have also the numbers in the datasheet characteristics (Chapters 8/9) I can imagine that the 400uA switching current during eeprom boot is:
      1. averaged min/max measurements during boot process and probably 2mA is not logic 1 and 2.4mA is not logic 0 on SDA line
      2. caused at least up to 110uA due to prop internal gates switching and 290uA maybe due to the SDA pull-up. If we consider Idd the one going into the Vdd pin (-Iss=Idd+IPULLUP when SDA at logic 0) then all 400uA is attributable to internal logic switching
      After all this I have some considerations more to introduce
        1. In chapter 9.2 (typ one cog current: like during boot) are stated 2/7.5/16 mA currents during idle/pasm/spin execution @12MHz
        2. Since during boot an idle state is a non sense (12MHz => 3MIPS =>· SCLfreq<1.5MHz => ok, maybe some waits if SCL was designed for 100kHz devices, as, due to missing SCL pull-up, clock streching is not possible) the average current will be considered somewhere between the above. But we can clearly see how different is the consumption during idle/internal cog space execution/hub ram access (at the end during boot we are copying from eeprom to hub ram) phases.
        3. In the Mctrivia module the Icc(MODULE)=Idd(PROP)+IPULLUP+ICC(EEPROM). Eeprom ICC will also vary due to its internal gates switching so we can say that both IC currents have internal dynamics

        Now the question is how can you, in all this current jam, discriminate the 400uA pull-up current?


        Hippy said...
        It may be possible to hold the Prop in reset so it floats SDA and SCL and just bang in SCL to read the Eeprom at a leisurely rate.
        Let's suppose that you are able to measure the power supply current (prop is hold in reset so its absorption is stable the eeprom one still varying) and determine the data coming from eeprom's SDA. How do you know:
          1. which is the address they are referred to since you don't know the value of eeprom internal address counter (in datashets I never found info in power-on value: it's supposed to be 0? usually I always start with a (half)write·to have it set)
          2. how you can even obtain data just by clocking the SCL since you are not able to pass the "1010_000_1" chip address through SDA line to wake up the eeprom internal state machine. From I2C specs the only thing you can do just by SCL is this

            3.16 Bus clear
            In the unlikely event where the clock (SCL) is stuck LOW, the preferential procedure is to reset the bus using the HW reset signal if your I2C devices have HW reset inputs. If the I2C devices do not have HW reset inputs, cycle power to the devices to activate the mandatory internal Power-On Reset (POR) circuit.
            If the data line (SDA) is stuck LOW, the master should send 9 clock pulses. The device that held the bus LOW should release it sometime within those 9 clocks. If not, then use the HW reset or cycle power to clear the bus.
          Could you/anyone explain better this points?
        1. hippyhippy Posts: 1,981
          edited 2009-03-04 23:05
          @ dMajo : Yes, bit banging SCL is a nonsense without access to SDA. A flight of fancy too far there.

          I'm no electronics engineer but I'd have thought it would be possible to see 400uA ( or lower ) differences between SDA high or low. Small R in series with power supply to create a potential divider use an op-amp or two to window and amplify. The handy thing with SCL exposed is that you have convenient markers to say when the SDA should be low or should be high so you only need to note current drawn at that time.

          It is all theory at best, more "here's an idea to run with".

          A further thought I had was, rather than file down the epoxy to expose something, go in from underneath and file away the PCB, perhaps easier and quicker.. Even if the base were epoxy coated as well, a fine blade could cut the PCB in two halves from an edge, even less PCB then to file away.
        2. mctriviamctrivia Posts: 3,772
          edited 2009-03-04 23:41
          400uA is hard to see specially when there are 12 caps smoothing out the power.

          cutting board in half would be difficult with all the pins and via going through it.

          ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
          Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
        3. Beanie2kBeanie2k Posts: 83
          edited 2009-03-05 05:57
          I looked up Dynasolve 165, and the magic ingredient is apparently methylene chloride. This stuff is found in most aggressive paint removers, and is what will attack aluminum, although it should not hurt copper, tin, or lead. The spec sheet also says it will not attack the type of epoxy that IC's are made of. I'm not willing to spend $50 just to be a guinea pig, but here is something someone might want to try. Take the module and put it in a glass pan (not aluminum or plastic). Buy a can of paint stripper at the local hardware which contains methylene chloride (not hard to find: It will say on the label DANGER: Contains Methylene Chloride. The stuff is that nasty) and pour it over the module. Cover the whole thing with some kind of lid to prevent evaporation and stinking up the whole room, and leave it sit for several days. Then take it out and see if the potting compound has turned to mush.
        4. mctriviamctrivia Posts: 3,772
          edited 2009-03-05 06:17
          Well in such a small module there is little I can do for pysical attacks like this. I have started working on a much larger module that uses active tamper detection to erase the eeprom in the event someone tries to drill through the case, disolve the epoxy inside the case, or file it down. I will not tell my exact method of detecting this just tell you I should be able to detect even the smallest drill bit worth of epoxy removed.

          Physical size of this would be about the size of 2 standard hard drives on top of each other.

          ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
          Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
        5. mctriviamctrivia Posts: 3,772
          edited 2009-03-05 06:19
          also as a note the module with lithium battery attached could potentially explode if you tried to dissolve it. The battery is normally not covered in epoxy but could be if requested.

          ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
          Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
        6. SRLMSRLM Posts: 5,045
          edited 2009-03-05 07:10
          That's the spirit! Give the potential of massive physical damage in the event of tampering. You know, it's not that difficult to make black powder, and I'm sure you could stick some bubbles of phosphorous and oxygen on your module...
        7. AleAle Posts: 2,363
          edited 2009-03-05 12:12
          Dichlormethane (Methylene chloride) does not do anything to aluminum, how could it do something ? It has no oxidizing capabilities! It will not dissolve Al2O3 either (with what Alu is normally covered, of course) But, as a good scientist... I tested it right now!. Nothing happens. There are loads of alu alloys, I doubt any of them have enough plastic if any to do any harm to it. Some other component may be the culprit there (a bit of H2O and HCl may be ?, H2O and CH2Cl2 are not miscible in any proportion) Maybe so organic acid.
        8. mctriviamctrivia Posts: 3,772
          edited 2009-03-05 14:02
          phosphorous and oxygenis that not the main ingredients to agent orange? I have played around with small yield explosives and magnetic hard drives when I was in highschool. Sure makes a quick erase system though not very legal.

          ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
          Need to make your prop design easier or secure? Get a PropMod has crystal, eeprom, and programing header in a 40 pin dip 0.7" pitch module with uSD reader, and RTC options.
        9. Beanie2kBeanie2k Posts: 83
          edited 2009-03-05 14:57
          Ale said...
          Dichlormethane (Methylene chloride) does not do anything to aluminum, how could it do something ? It has no oxidizing capabilities! It will not dissolve Al2O3 either (with what Alu is normally covered, of course) But, as a good scientist... I tested it right now!. Nothing happens. There are loads of alu alloys, I doubt any of them have enough plastic if any to do any harm to it. Some other component may be the culprit there (a bit of H2O and HCl may be ?, H2O and CH2Cl2 are not miscible in any proportion) Maybe so organic acid.

          MSDS @ link below. Look under "Stability". Can find additional material if you wish.

          http://msds.chem.ox.ac.uk/DI/dichloromethane.html

          Additional note: According to Wikipedia (if it can be trusted) paint strippers containing methylene chloride are outlawed in Europe. So I guess if sales are restricted to only that region then there would be no problem.
        10. AleAle Posts: 2,363
          edited 2009-03-05 15:32
          Beanie2k:

          I did test it myself: Nothing happens. But there are some caveats to note: Aluminum found normally is no pure aluminum, it is an alloy. Second as I said, it is covered with Al2O3 (aluminum oxide) that impedes the reaction of anything with it. You have to scratch the Al2O3 to get bare metal (alloy) and then it will react with the atmospheric water so rapidly that it will be covered by Al2O3 by the time you submerge it into the CH2Cl2.
          The reaction is not fast, so test the following: get you Al rod in a HCL 0.001 M solution and scratch it. You will see how a tree of Al2O3 grows over the scratched part, slowly.

          While all chlorides of methane react with alkali metals, in metal form, and not with the ions, the passivation present hinders its reaction (Mg and Al for instance). I wouldn't try with Na or K (Li) because they are conserved in oil and their passivation is not that strong.

          (Being a chemist I have access to quite a bit of info, but thanks anyways!)
        11. Beanie2kBeanie2k Posts: 83
          edited 2009-03-05 16:17
          @ Ale:

          You could be right. I was just going by the documentation. Anyway the real issue is whether the stuff attacks his potting compound. If Methylene Chloride is the "active ingredient" in Dynasolve that attacks epoxies (it might be something else) then I was concerned that any 12 year old kid with a can of paint remover kyped from his dad's garage could hack the module.

          Post Edited (Beanie2k) : 3/5/2009 4:28:01 PM GMT
        Sign In or Register to comment.