Aug_EDFA_Digital

edfas.org 21 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 23 NO . 3 final step was to connect SDA from the via to another location on the board. SDA already had a via, and layer 5 of the board was very sparse. So, a trace was added on layer 5 between the newly added via and the pre-existing via. This is shown in Fig. 6. To complete the additionof the unwanted component, the solder mask layer was edited, using NXP’s recom- mended pattern for solder mask for aWLCSP-16 package, and a silk screen label (U4) and a silk screen orientation marking (a dot near pin A1) were added. The final version showing the silk screen, solder mask, and top-side layer is shown in Fig. 7. The added component would be difficult to notice at a glance. Toprovide a rough idea of the physical appearance of the board, a black square made of paper the size of the actual added component was added to the board. The complete circuit board is shown in Fig. 8, both unmodified and modified. The addition of the extra component was emulated in Fig. 8 by using apiece of paper roughly the size of an actual LPC802 device. The paper shown in the figure is slightly larger than actual size. It canbe found by locating the stacking connector andoriginalmicrocontroller and then moving left to find the pullup resis- tors. A zoomed-in view of the photo mock-up is shown in Fig. 9. To recap, a footprint of a WLCSP- 16 package was added to the Gerber files (and N/C drill file) of a circuit board. The footprint was selected to match a commercially soldmicrocon- troller (specifically an NXP LPC802) and the added component was con- nected to power, ground, and the original board’s I 2 C bus. The modi- fied Gerber files could then be used to create a counterfeit board with an extra, unwanted component that would be difficult to detect without careful inspection. Because the added component is a fully program- mable microcontroller, monitoring or even altering bus traffic would be straightforward. CONCLUSION Circuit boards are extremely vul- nerable to unwanted modification. These modifications can permit an Fig. 9 Recreation of an actual added-component attack. The added component is a fully functional 32-bit microcontroller added to the I 2 C bus. Fig. 8 Unmodified (left) and modified (right) circuit board, using a black square of paper the size of the actual added component to emulate the added device. The board’s actual size is 10 cm by 10 cm. Fig. 7 Complete version of Gerber files with added com- ponent. The view includes the original micro- processor, pullup resistors, and stacking connector for reference. Fig. 6 Layer-5 trace added to connect SDA to the sur- reptitiously added microcontroller.