Comment by jacquesm
17 days ago
That would work on an already configured wallet that you stole but the skill level required is orders of magnitude higher than what's on display here. I know all of the theory on that one but I would probably not be able to pull that off.
The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip. You'd have definitely been able to spot the difference. This was at the millimeter level. Recently there was a post about a group doing this at the chip level, which I thought was extremely impressive, and again, even with the recipe out there duplicating it would still be very hard.
Xbox Kamikaze hack (How a drill defeated the Xbox 360’s console security)
https://www.xda-developers.com/how-drill-defeated-the-xbox-3...
Hah! Very similar, they even made a jig like I did.
> The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip.
Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.
> Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.
Market segmentation?! What device is high quality enough to be potted but still has the same hardware modified by jumpers across models?
Not quite a jumper. CB transceiver.
Did you blog about it? That would be like catnip around here.
No, this was a couple of decades ago, I didn't have a blog back then and I have zero evidence. But I can tell you some of the details: the device was a Philips 'Marc' CB transceiver. They made only one model both for the US and the EU market so there were 22 channels available in the EU and 40 iirc in the United States. But the rotary channel selector did have all 40 positions. That made me wonder... what if? So I opened the device and there was this very large plastic blob in the middle of the circuit board with obviously a large (40 pin iirc) chip underneath it. I realized that if I tried to physically remove the blob that I would most likely break the chip so that wasn't going to work.
But it was clear what it did: as soon as the channel selector went to a forbidden channel the blob sprung into action to disable the chip underneath. I measured the effect on the pins underneath that were accessible from the other side of the board and noticed that a whole bunch of them got shorted to ground. That was the hint I needed. A friend ran a laser game company and they had a nice little IR camera with built in display, that was used for calibration of the IR beam collimators in the laser guns (the laser doesn't actually do any of the shooting, the thing is basically just a very powerful remote control with a lens that sends out a relatively narrow beam). I set it up above the the blob and set the channel selector to a good channel and let it warm up. Had a look with the camera. Then set the channel selector to a bad channel, let it warm up again and had another look with the camera. The difference was pretty obvious, there was a hotspot right in the middle of the blob. I marked the spot and made a drill jig, then it took me a few days to gather courage and stick the drill in, it worked on the first try. That gave 18 nearly empty channels to play with. Once I had it figured out the second one was a lot easier :)