Exposing The Deep-Secure Elements Of Smartcards | Christopher Tarnovsky | hardwear.io USA 2019

Christopher Tarnovsky presents his physical reverse-engineering of a Samsung smartcard IC protecting printer toner cartridges, devices generating millions in monthly revenue for printer manufacturers. The 4-layer metal chip at 130 nanometer aluminum process was systematically stripped using acid polishing and fuming nitric/sulfuric acid, then imaged with a scanning electron microscope at 20,000x magnification, producing composite images up to 150GB in Photoshop.

Using a focused ion beam (FIB) workstation, Tarnovsky attacked the chip's security. The device contained a 24KB executable ROM (encrypted), an EEPROM holding secrets, static RAM, and cryptographic algorithms. The ROM used XOR/XNOR operations with an unusual physical architecture tying left and right memory sides together via output enable lines.

Security features included 200–250 nanometer aluminum shield wires, a parity generator monitoring ROM fetches, and secondary flip-flops ('anti-fly logic') to prevent direct tampering. Tarnovsky used xenon difluoride gas to etch through the shield, creating windows and depositing platinum/tungsten connections to manipulate chip behavior.

A critical flaw emerged: Samsung used the high bit (D15) for branch instructions. By cutting this line or preventing it from toggling to 1, the chip could not branch, forcing sequential execution and revealing ROM code paths. The parity generator and active shielding proved ineffective—neither triggered alarms nor stopped the chip when tampered.

The work consumed ~5–6 hour FIB sessions per attack, destroying approximately 15 chips (~$110 each). While the asymmetric key protecting toner secrets remained inaccessible, Tarnovsky notes that Chinese company Apex and Static Control (North Carolina) somehow obtained it, generating over $1 million monthly from aftermarket toner sales. Samsung responded by switching to a functionally similar chip with different layout, prompting Tarnovsky to abandon the project due to cost and effort. He contrasts Samsung's approach (freeze-on-tamper) with ST Microelectronics (erase-on-tamper), highlighting different defensive philosophies.