At the Black Hat conference this year, the crypto-expert Karsten Nohl
demonstrated by the SRLabs dégats tool that allows you to smart cards -
can take a closer look at stored applications - such as credit and debit
cards.
A smart card is a small computer chip with ROM, which contains its
operating system and application software, flash memory for dynamic
data, an arithmetic unit and RAM. ROM, RAM and processing unit are
connected via buses. Such chips are often important information, such as
shared keys for pay-TV programs or basic data for TAN generation, so it
was in the past always desires to read it. Were popular until a few
years so-called timing attacks.
Ten years ago, the industry responded and introduced an encryption of
data on the smart card. Since then, there was hardly any development to
protect the smart card controller. It had to be used for data encryption
cryptographic algorithms to protect the RAM / ROM within one or more
clock cycles of the CPU of the smart card, the data from the bus on and
read. In addition, a small part of the ROM to be encrypted because the
encryption unit to the smart card must first upload the key to encrypt
it with the memory and the ROM / OS and the program to work on the map.
With the open-source tool for the researcher Karsten Nohl, you can now
use these internal hardware algorithms from the silicon reconstructed in
logical and program code. These are made from the silicon chips of a
microscopic photo of marked and then with the said software each logic
element. If all connections are marked with the software that spits out
dégats logical code that behaves like the chip.
A microscope image reveals the structure of the smart card chips. The
software allows dégats the reverse engineering of encryption thereon.
If the encryption algorithm of RAM and ROM known, nor is it to find the
key to. Frequently this is taken for reasons of cost and not in ROM
cheap flash, in the case he is not sure. ROM areas on a smart card is
also passively - that is without its own power supply - and optically
pure by light microscope can be read. Now, program and operating system
on the smart card stored in the ROM, you can decrypt and read. Thus,
insecure implementations can detect and assess security bugs that could
enable an attacker.
Key and dynamic data are safe on the other hand, if they are stored in
flash memory (EEPROM). Because this can only be extremely expensive
tools (up to several million-euro area) is read with needles on the
conductor. The same goes for RAM contents.
Even the most secure hardware chip is vulnerable if there are programs
on it unsafe. Since this is now possible to determine with dégats is
expected that not only the "good" to test the safety level, but also
criminals are active. You could hit some bad TAN generators or
"man-in-the-middle attacks" carried out as recently researchers at the
University of Cambridge. One can also expect new attacks on pay-TV
systems that use only a few key for many users.
No comments:
Post a Comment