MCU attack technology and invasion process

　　At present, there are four main techniques for attacking microcontrollers, namely:
(1) Software attack
　　This technique usually uses the processor communication interface and exploits the security loopholes in the protocol, encryption algorithm or these algorithms to attack. A typical example of a successful software attack is the attack on the early ATMEL AT89C series of microcontrollers. The attacker took advantage of the loopholes in the timing design of the erase operation of this series of microcontrollers, and used a self-written program to stop the next step of erasing the program memory data on the chip after erasing the encryption lock bit, thereby turning the encrypted microcontroller into an unencrypted microcontroller, and then using the programmer to read out the program on the chip.
(2) Electronic detection attack
　　This technique usually monitors the analog characteristics of all power supplies and interface connections of the processor during normal operation with high time resolution, and implements the attack by monitoring its electromagnetic radiation characteristics. Because the microcontroller is an active electronic device, when it executes different instructions, the corresponding power consumption also changes accordingly. In this way, by using special electronic measuring instruments and mathematical statistical methods to analyze and detect these changes, specific key information in the microcontroller can be obtained.
(3) Fault generation technology
　　This technology uses abnormal working conditions to cause the processor to fail, and then provides additional access to attack. The most widely used fault generation attack methods include voltage shock and clock shock. Low voltage and high voltage attacks can be used to disable the protection circuit or force the processor to perform incorrect operations. Clock transient jumps may reset the protection circuit without destroying the protected information. Power and clock transient jumps can affect the decoding and execution of a single instruction in some processors.
(4) Probe technology
　　This technology directly exposes the internal wiring of the chip, and then observes, manipulates, and interferes with the microcontroller to achieve the purpose of attack. For convenience, people divide the above four attack technologies into two categories. One is an invasive attack (physical attack). This type of attack requires destroying the package, and then uses semiconductor testing equipment, microscopes and micropositioners to spend hours or even weeks in a special laboratory to complete. All microprobe technologies are invasive attacks. The other three methods are non-invasive attacks, and the attacked microcontroller will not be physically damaged. In some cases, non-invasive attacks are particularly dangerous because the equipment required for non-invasive attacks can usually be made and upgraded by yourself, and is therefore very cheap.
　　Most non-invasive attacks require the attacker to have good knowledge of the processor and software. In contrast, invasive probe attacks do not require much initial knowledge, and a set of similar techniques can usually be used to attack a wide range of products.
Therefore, attacks on microcontrollers often start with invasive reverse engineering, and the accumulated experience helps to develop cheaper and faster non-invasive attack techniques.
(5) General process of invasive attacks
　　The first step of an invasive attack is to remove the chip package. There are two ways to achieve this goal: the first is to completely dissolve the chip package and expose the metal connections. The second is to only remove the plastic package on the silicon core. The first method requires the chip to be bonded to a test fixture and operated with the help of a bonding table. In addition to the attacker's certain knowledge and necessary skills, the second method also requires personal wisdom and patience, but it is relatively easy to operate.
The plastic on the chip can be peeled off with a knife, and the epoxy resin around the chip can be corroded with concentrated nitric acid. Hot concentrated nitric acid will dissolve the chip package without affecting the chip and the connection. This process is usually done under very dry conditions, as the presence of water may corrode the exposed aluminum wire connections.
　　The chip is then cleaned in an ultrasonic bath, first with acetone to remove residual nitric acid, then with clean water to remove salt and dried. If an ultrasonic bath is not available, this step is usually skipped. In this case, the chip surface will be a little dirty, but it will not affect the UV light operation of the chip. The last step is to find the location of the protection fuse and expose it to UV light. Generally, a microscope with a magnification of at least 100 times is used to trace the connection from the programming voltage input pin to find the protection fuse. If a microscope is not available, a simple search is performed by exposing different parts of the chip to UV light and observing the results. During operation, the chip should be covered with opaque paper to protect the program memory from being erased by UV light. Exposing the protection fuse to UV light for 5 to 10 minutes can destroy the protection of the protection bit. After that, the contents of the program memory can be directly read out using a simple programmer.
　　For microcontrollers that use a protective layer to protect the EEPROM unit, it is not feasible to use ultraviolet light to reset the protection circuit. For this type of microcontroller, the microprobe technique is generally used to read the memory contents. After the chip package is opened, the chip can be placed under a microscope to easily find the data bus connecting the memory to the rest of the circuit.
　　For some reason, the chip lock bit does not lock access to the memory in programming mode. Exploiting this defect, placing the probe on the data line can read all the desired data. In programming mode, restarting the read process and connecting the probe to another data line can read all the information in the program and data memory.
　　Another possible attack method is to use a microscope and a laser cutter to find the protection fuse and then find all the signal lines connected to this part of the circuit. Due to the design flaw, the entire protection function can be disabled by cutting a signal line from the protection fuse to other circuits. For some reason, this line is very far away from the other lines, so a laser cutter can completely cut this line without affecting the adjacent lines. In this way, the contents of the program memory can be directly read using a simple programmer.
　　Although most common MCUs have the function of protecting the internal code by blowing the fuse, since general low-end MCUs are not positioned to make security products, they often do not provide targeted preventive measures and have a low security level. In addition, MCUs are widely used in a wide range of occasions, with large sales volumes, frequent commissioned processing and technology transfer between manufacturers, and a large amount of technical information leaked, making it easier to exploit the design loopholes of such chips and the manufacturer's test interface, and to read the internal program of the MCU by means of invasive attacks or non-invasive attacks such as modifying the fuse protection bit.