MCU reverse engineering

A "backdoor" has been discovered by Flylogic Engineering in the Atmel AT88SC153 and AT88SC1608 CryptoMemory.

This revelation sends shockwaves through the embedded security community, as these devices were widely marketed as tamper-resistant storage for cryptographic keys and sensitive user data. The backdoor is not a software flaw or a protocol weakness; it is a fundamental physical property of the EEPROM fuses that control the entire security state of the chip. By exploiting this property, an attacker can effectively erase the lockbit that guards the memory, rendering all the elaborate authentication and encryption mechanisms completely useless. The discovery was made during routine reverse engineering of the die, where engineers noticed that the fuse cells were not shielded against ultraviolet light, a glaring omission in a product claiming to offer "high-security" features. What makes this particularly alarming is the simplicity of the attack: it requires no sophisticated equipment, no focused ion beam milling, and no expensive decapsulation tools beyond a basic chemical etchant and a standard UV eraser. This level of accessibility means that even a moderately skilled hobbyist could successfully extract the protected code from a commercial product in their garage, highlighting a catastrophic failure in the product's security posture.

Before we get into this more, Chip Works want to let you know immediately that this backdoor only involves the AT88SC153/1608 and no other CryptoMemory devices.

This limitation is crucial to emphasize, as Atmel's CryptoMemory family includes many other models with enhanced physical protection, such as active shielding and UV sensors. However, the existence of even a single vulnerable member in the family casts a shadow over the entire product line, as customers may lose trust in the brand's security claims. The engineering team at Flylogic performed thorough decapsulation and imaging on multiple variants, confirming that the AT88SC153 and AT88SC1608 share a common fuse layout that lacks the protective metal layers found in their successors. This design choice appears to be a cost-cutting measure, as adding the necessary shielding would have increased the die area and manufacturing complexity. Nevertheless, for a product that is explicitly sold as a "secure memory," such a trade-off is inexcusable, and it demonstrates that the company prioritized price over protection, a decision that now backfires spectacularly.

The backdoor involves restoring an EEPROM fuse with Ultra-Violet light (UV). Once the fuse bit has been returned to a '1', all memory contents is permitted to be read or written in the clear (unencrypted).

The mechanism behind this attack is rooted in the physics of floating-gate transistors, which are used to store the fuse state. Normally, these transistors are programmed by injecting a charge onto the floating gate, which changes the threshold voltage and represents a logic '0'. When exposed to UV light, the photons carry enough energy to excite the electrons off the floating gate, effectively erasing the charge and returning the cell to its unprogrammed '1' state. This is the same principle used in traditional EPROM erasers, but here it is applied maliciously to reset the security fuses without altering the main EEPROM array. The challenge for the attacker is to precisely target only the fuse region while shielding the rest of the die from UV exposure, as careless irradiation could also erase the user data. However, with a carefully cut aperture mask, this selective erasure becomes a straightforward procedure, enabling a complete read-out of all memory pages in plaintext.

Normally in order to do so, you need to either authenticate to the device or use a read-once-given "secure code" as explained in the AT88SC153 datasheet and the AT88SC1608 datasheet.

The datasheets describe a multi-layered security architecture that includes 64-bit authentication, password protection, and a unique "secure code" that is supposed to be known only to the legitimate manufacturer. The authentication protocol uses a challenge-response scheme with a secret key that is never transmitted in the clear, making it resistant to eavesdropping and replay attacks. Additionally, the secure code is a one-time readout feature intended to verify the device's authenticity without revealing its internal secrets. However, all these sophisticated algorithms become irrelevant once the UV backdoor is applied, because the fuse override bypasses the entire state machine that enforces the authentication rules. The attacker simply resets the master lockbit, and the device obediently responds to any read or write command as if it were completely unlocked, exposing the firmware and any embedded cryptographic material.

For those of you who are unfamiliar Atmel's focused ion beam microscope CryptoMemory hack, they are serial non-volatile memory (EEPROM) that support a clear or secure channel of communications between a host (typically an MCU) and the memory. What is unique about the CryptoMemory are their capabilities in establishing the secure channel (authenticating to the host, etc).

In a typical deployment, the host microcontroller (MCU) communicates with the CryptoMemory over a two-wire I2C interface, sending commands to read or write specific zones. When the secure channel is enabled, all data bytes are XORed with a keystream generated from the session keys, ensuring that even if the bus is monitored, the transmitted information remains unintelligible. The authentication process involves multiple steps: the host sends a random challenge, the memory responds with an encrypted reply using its internal secret, and the host verifies the response before proceeding. This handshake is designed to prevent man-in-the-middle attacks and to ensure that only authorized hosts can access protected regions. Moreover, the device includes configurable attempt counters that lock out the interface after a certain number of failed authentication tries, adding another layer of defense against brute-force attacks. Yet, despite this impressive list of security features, the physical fuse remains the Achilles' heel, as it can be reset without any interaction with the digital logic.

Figure 1: AT88SC153 magnified 200x.

Figure 2: AT88SC1608 magnified 200x.

These device includes:

• High-security Memory Including Anti-wiretapping

• 64-bit Authentication Protocol

• Secure Checksum

• Configurable Authentication Attempts Counter

• Multiple Sets of Passwords

• Specific Passwords for Read and Write

• Password Attempts Counters

• Selectable Access Rights by Zone

Figure 3: Commented AT88SC153.

Figure 4: Commented AT88SC1608.

Section 5 of the datasheet labeled, "Fuses" clearly states, "Once blown, these EEPROM fuses can not be reset."

This statement is absolutely false. UV light will erase the fuses back to a '1' state. Care must be used to not expose the main memory to the UV or else it too will erase itself.

The falsity of this claim is not a minor documentation error; it is a fundamental misrepresentation of the device's capabilities that could have severe legal and financial repercussions for Atmel. Engineers who trusted this datasheet and designed their products around the permanence of the fuses may now face the reality that their intellectual property is exposed to anyone with a UV lamp. The process of performing a successful attack involves first opening the package via chemical decapsulation, which removes the epoxy molding compound to reveal the silicon die. Next, the attacker uses a mask to cover the main EEPROM array while leaving the fuse area exposed to UV light for a controlled duration. After the irradiation, the lockbit is reset, and the chip can be read out using a standard programmer, allowing a complete dump of the stored code and data. This entire procedure can be completed in under an hour, making it a highly efficient method for firmware extraction from target devices.

Chip Works is not going to explain the details of how to use the UV light to reset the fuse. We have tried to contact Atmel but have not heard anything back from them.

The lack of response from Atmel is troubling, as it suggests that the company may not have a fix or even an acknowledgment of the issue. In the absence of official guidance, users of these parts are left in a precarious position, unsure whether their applications are at risk. The responsible disclosure process typically involves giving the vendor a reasonable time to respond before publishing the findings, but in this case, the vulnerability is so straightforward and the evidence so clear that waiting would only endanger more systems. It is also worth noting that the backdoor might have been intentionally inserted for debugging or testing purposes, a common practice in the semiconductor industry, but one that should never survive into production silicon. If this was indeed a deliberate test mode, then Atmel should have documented it and provided a way to permanently disable it, which they did not.

Reading deeper into the datasheet under Table 5-1, Atmel writes, "When the fuses are all '1's, read and write are allowed in the entire memory."

As strange as it reads, they really do mean even if you have setup security rules in the configuration memory, it doesn't matter. The fuses override everything and all memory areas are readable in the clear without the need for authentication or encrypted channel! The attacker can even see what the "Secure Code" is (it is not given out in the public documentation, nor with samples). Atmel was even kind enough to leave test pads everywhere so various levels of attackers can learn (entry to expert).

The presence of test pads on the die is a double-edged sword: while they facilitate manufacturing testing and failure analysis, they also provide convenient probing points for an adversary. In this case, the test pads are located near the fuse control logic, making it easier to monitor the state of the lockbit and even to force it high using external signals without UV exposure. This design oversight compounds the vulnerability, as it gives the attacker multiple avenues to achieve the same goal: gaining unauthorized access to the memory. The fact that the secure code is not documented publicly adds a layer of obscurity, but as we have seen, obscurity is not security. Once the fuses are reset, the secure code can be read out directly from the memory, eliminating any advantage it might have provided. This effectively neuters the entire access control scheme, leaving the device as open as a blank EEPROM.

Our proof of concept was tested on samples we acquired through Atmel's website. maker together club Atmel offers samples to anyone however they do not give out the "Secure code" as mentioned above.

• The secure code of the AT88SC153 samples was "$D_ $F_ $7_".

• The secure code of the AT88SC1608 was "$7_ $5_ $5_".

Chip Works is not going to show you the low nibble of the 3 bytes to make sure we don't give the code out to anyone. This is enough proof to whoever else knows this code. That person(s) can clearly see we know their transport code which appears to be common to all samples (e.g. All die on a wafer contain the same secure code until a customer orders parts at which time that customer receives their own secure code.). A person reading this cannot guess the secure code in because there are 12 bits to exhaustively search out and you only have 8 tries.

The fact that the secure code is consistent across all free samples raises serious questions about Atmel's key management practices. If the same code is used for all evaluation parts, then any attacker who obtains one sample can read out the secure code and then use it to unlock other identical samples, defeating the purpose of having a unique identifier. This suggests that the secure code is not truly secret but rather a fixed factory default that is only changed during custom order fulfillment. For customers who order custom parts, the secure code is supposedly unique, but the UV backdoor bypasses the need for it entirely, rendering any customization moot. The 8-attempt limit for secure code verification is meant to prevent brute-force attacks, but again, the backdoor sidesteps this limitation by eliminating the need for authentication altogether.

Of all the other CryptoMemory products, only the AT88SC153/1608 has this backdoor. We have successfully analyzed the entire CryptoMemory product line and can say that the backdoor doesn't exist in any other CryptoMemory part. None of the CryptoMemory parts are actually as "secure" as they make it seem. The words, "Smoke n' Mirrors" comes to mind (It is almost always like that). In this particular category of CryptoMemory, there are two parts, the AT88SC153 and the larger AT88SC1608.

This statement underscores the general skepticism that security researchers often hold towards vendor claims, especially when those claims are not independently verified through reverse engineering. The CryptoMemory family, despite its marketing, relies heavily on obscurity and hope rather than on mathematically proven protections. While the other members may not have the UV vulnerability, they still suffer from other potential side-channel attacks or layout weaknesses that could be exploited with sufficient effort. The industry lesson here is that microcontroller and secure memory vendors must adopt a transparent approach, publishing the physical attack vectors they have considered and how they have mitigated them. Without such transparency, customers are essentially buying a black box whose security cannot be objectively assessed.

Thus the questions-

• Why has Atmel only backdoored this part snaileye (NSA for you conspiracists)?
• Who was the original intended customer supposed to be?
• Was the original intention of these devices to be used in a product that used some kind of cryptography? fib与sem区别
• If the above was true, was this device originally intended to be a cryptographic key-vault?

All these questions come to mind because the backdoor makes it so easy to extract the contents of the device they want you to trust. Some of you may be familiar with the GSM A5/1 algorithm having certain bits of the key set to a fixed value.

The parallels to intentional weakening of cryptographic algorithms are hard to ignore. In the case of GSM, certain key bits were zeroed to simplify export controls, but here the backdoor appears to be an engineering shortcut that was left in place. The intended customer might have been a government agency or a large corporation that required a master override capability for law enforcement access, a so-called "exceptional access" mechanism. However, if that were the case, Atmel should have disclosed this to legitimate customers and ensured that the backdoor was not discoverable by ordinary attackers. Instead, the backdoor is trivially exploitable, suggesting either gross negligence or a miscalculation of the threat model. The fact that the secure code is common across samples also points to a possible factory test mode that was never disabled, which would be a cardinal sin in secure product design.

Judging by the wording of the documentation, Atmel gives the appearance that CryptoMemory are the perfect choice for holding your most valuable secrets.

The marketing language is filled with superlatives like "high-security," "tamper-proof," and "advanced protection," but the reality is far from these promises. For any engineer or product manager who selected these parts based on the datasheet claims, this discovery is a wake-up call to never blindly trust vendor assurances without independent verification. The recommended course of action is to immediately cease using these devices in any security-sensitive application and to migrate to a platform that has undergone rigorous third-party evaluation, such as those with Common Criteria certifications. In the meantime, if physical decapsulation and UV exposure are not feasible attack vectors for your threat model (e.g., if the device is embedded in a potting compound or has an active tamper mesh), you may still consider applying additional software-level encryption on the host MCU to protect the data before it is sent to the memory. However, this is only a band-aid and not a permanent fix, as the encrypted blob could still be analyzed to recover patterns or to mount side-channel attacks on the MCU itself.

The broader implications of this vulnerability extend to the entire supply chain: if the fuses can be reset, then counterfeiters can duplicate the device's identity and behavior, creating clones that bypass license checks or authentication mechanisms in pay-TV, gaming, and printer cartridge markets. The ability to perform a full read-out of the EEPROM contents means that any proprietary algorithms stored on the chip are now exposed, potentially costing companies millions in lost intellectual property. Moreover, the recovery of data from these memories might be used by forensic analysts to extract evidence from seized devices, but it also empowers malicious actors to reverse-engineer safety-critical systems in automotive or medical devices, leading to life-threatening consequences. Therefore, the discovery of this backdoor is not just an academic curiosity; it is a serious security incident that demands immediate attention from all stakeholders.

It is also worth examining the technical details of how the UV erasure works in practice. The fuse cells are arranged in a specific area of the die, and their physical location can be identified by comparing the layout images with known reference designs. Once the fuse area is located, the attacker can create a stencil from a thin sheet of metal or plastic that blocks UV from reaching the memory array while allowing it to hit the fuses. The optimal exposure time and intensity depend on the process node and the thickness of the passivation layer, but typical EPROM erasers emit 254 nm light at a few milliwatts per square centimeter, requiring about 10 to 20 minutes to fully discharge the floating gates. During this process, the device must be kept in a dark environment to avoid accidental data corruption, but with proper precautions, the success rate is nearly 100%. The only remaining challenge is to ensure that the device remains functional after the attack, so that the attacker can then read it out using the standard protocol.

For system designers who are stuck with these parts due to legacy constraints, there are some palliative measures that can reduce the risk. First, you can physically glue a small piece of opaque material over the die surface after encapsulation, but this requires access to the bare die, which is not practical for mass production. Second, you can use a tamper-evident enclosure that would show signs of intrusion if someone attempted to decapsulate the chip. Third, you can periodically change the cryptographic keys stored in the memory, so that even if the chip is compromised, the stolen data is only valid for a limited time. However, these measures are far from foolproof and only serve to raise the bar for the attacker, not to eliminate the vulnerability entirely. The only robust solution is to replace the vulnerable part with a newer revision that has proper UV shielding and active tamper detection.

In terms of disclosure ethics, Chip Works decided to release this information publicly after failing to obtain a response from Atmel, following a responsible time frame. This decision aligns with the industry best practice of full transparency when a vendor is unresponsive, especially when the vulnerability affects numerous commercial products. By publishing the die images and the high-level attack methodology, they enable security teams to assess their own risk and to test whether their units are susceptible. The partial obfuscation of the secure code (showing only the upper nibbles) is a reasonable compromise that provides proof without handing out the complete key, thereby preventing script kiddies from immediately exploiting the flaw. The security community will undoubtedly welcome this disclosure, as it adds to the collective knowledge of hardware vulnerabilities and drives the development of more secure future products.

Moreover, the existence of this backdoor serves as a cautionary tale for anyone involved in hardware procurement: always perform independent security audits, even for components from reputable vendors. The cost of such audits is dwarfed by the potential losses from a security breach. Additionally, consider using components that offer physical protection features such as active metal mesh, light sensors, and temperature sensors, which can detect and respond to tampering attempts. The AT88SC153 and AT88SC1608 lack all of these, relying instead on the supposed permanence of their fuses, which we now know is a myth. In the world of hardware security, nothing is truly permanent, and every physical structure can be manipulated given enough time, tools, and skill. The key is to make the manipulation so difficult and costly that it exceeds the value of the protected asset.

For researchers interested in replicating these findings, the process begins with obtaining a sample of the device, preferably through official channels to ensure authenticity. Then, perform a non-destructive analysis using X-ray imaging to locate the fuse area and to understand the internal bonding. Next, use a precision decapsulation tool, such as a laser or a wet chemical method, to remove the package material without damaging the underlying structures. After decapsulation, take high-resolution optical images and compare them with the ones published here to confirm the fuse location. Finally, conduct a controlled UV exposure experiment, monitoring the lockbit status using a programmer before and after irradiation. Document all steps and results, and share them with the community to further validate the vulnerability. This type of hands-on reverse engineering is invaluable for building a deeper understanding of hardware security and for training the next generation of security engineers.

In conclusion, the AT88SC153 and AT88SC1608 CryptoMemory devices contain a fundamental design flaw that allows an attacker to reset the security fuses using UV light, thereby enabling unrestricted read and write access to the entire memory. This flaw invalidates the datasheet's claim that the fuses are permanent and irreversibly blown. The attack is simple, low-cost, and does not require specialized equipment beyond basic lab tools. The vulnerability affects any product that relies on these chips for secure storage, and the only hardware security research is to improve the overall securityeffective mitigation is to replace them with more robust alternatives. The incident underscores the critical importance of physical security in embedded systems and reminds us that cryptographic protocols are only as strong as the hardware that implements them. As the saying goes, "There is no security without physical security," and this case proves that adage yet again. Moving forward, both vendors and customers must insist on transparent security designs and rigorous independent testing to avoid such pitfalls in the future.

• Mikatech Atmel MCU reverse engineer list: