Chinese PCB Fab Security

[robotix3]

I saw that PCBway recently started allowing you to upload Altium PCB files instead of just exported gerbers, which is a great improvement. This brought up a conversation about definitely not doing this because this gives the fab basically everything they need to assemble the board and this one file could be leaked and clones could be made, new products could be compromised, etc. Most of my co-workers agree that even sending just the gerbers to a over-seas fab is a bad idea. I've been using PCBway for a few years now and I view them as being a pretty professional company and feel comfortable letting them handle my designs.

I could see this being a risk if your Apple or something, but is this a risk for small to medium sized companies (not household names)? Has anyone had a clone of their design and suspect it was due to this? I wouldn't bother discussing this if there were plenty of affordable US fabs...

[elecman14]

Clones have happened to products I used to work on. It is unlikely the PCB design files were used in the copy. Reversing a PCB and getting a bom, netlist, gerber, firmware are possible and fairly cheap from some overseas vendors. Last time I looked it was a couple hundred usd for a complete reverse engineering of a product.

If you are manufacturing you should be auditing your PCB suppliers fairly regularly. Understanding how they safe guard your design is one of the audit items. This involves the design files and also what happens to scrap PCBs.

If it makes your feel better just send the gerbers. If someone wants to copy your product it will more than likely happen no matter what file format you send.

[james_s]

I've reverse engineered and duplicated a discontinued board more than once, giving me all the recreated source files and reverse engineered many more for diagnostic and curiosity purposes. If I can do that at home then a company willing to spend a bit of effort can do it easily. The only way to stop someone from being able to fairly easily make copies of your PCB is to never sell the product to anyone. If I'm willing to sacrifice one for the cause, I can strip all the components and scan both sides of the board, for multilayer I can xray it. If one really wanted to make copies, I'm sure it wouldn't be too hard to write some software that could turn a good quality scan into a board file for whatever EDA. Now most stuff these days that is interesting enough for someone to want to copy it is going to have firmware and that's generally not trivial to reverse engineer.

To get to the point, I see no reason to worry about uploading Altium or other design files to the fab. If they want to steal your design they will. They already have to be able to manipulate the source because they panelize boards.

[sleemanj]

Most any product these days involves more than just the hardware,  a schematic or pcb layout doesn't do you much good without the MCU firmware or FPGA configuration, anything desirable enough to re-develop that is probably desirable enough to reverse engineer from a finished product.

Besides there's unlikely much association between the schematic/pcb and what the end result actually is or does anyway, without fairly considerable effort either in reverse engineering, or googling.

[rx8pilot]

So far, I have only sent gerbers for my designs. I feel like it obscures the final product well enough. I also stopped putting part numbers on the design and I order through an account that uses a random Gmail account unrelated to my business.

Not exactly foolproof, but a cloner would have to put in considerable effort to fill in the blanks and develop firmware.

Sending native design files seems foolish if you have any hope of privacy.

Short and misplld from my mobile......

[james_s]

Sending a gerber is little different than sending the native design file, both provide the same information, the gerber is just not quite as convenient to modify but it wouldn't be hard to convert from a gerber to a native design file. If you want a schematic that's more work, but not impossible. None of that changes the fact that if you actually sell the product to the public, then anyone can get hold of one to reverse engineer.

[rx8pilot]

While it is true that anyone can reverse anything..... if it is hard enough, it reduces the number of people willing to try.

If you send an Eagle file to a fab, it includes the BOM, values, DigiKey part numbers, etc depending on how you configure your library. That makes it way easier than just seeing a bunch of pads on a board. I stopped printing part numbers and setup account with isolated and random emails.

Again, this only keeps out the casual counterfeiting. If someone wants my design, they will buy one to reverse - a leak from a fab house probably will not be a part of that.

Short and misplld from my mobile......

[mikeselectricstuff]

Might be amusing to send a design file with all the part values subbed with really bizzare ones...

[rea5245]

Might be amusing to send a design file with all the part values subbed with really bizzare ones...

They're not going to pirate a design if they can't figure out what it is.

- Bob

[Fire Doger]

I used pcbdoc to pcbway before a year+, its not new.
But they used older AD version and some text was @#$* up.
As everyone said before, reverse engineering pcb is a piece of cake for them (dirty pcb offers pcb to gerber for 2L).

Also an experienced designer will review it, he knows when something may worth copying, printing your website and product name on pcb will make it more interesting...

And they are not going to pirate a design when your market is so small that you cant afford a local manufacturer.

[Elasia]

This. Depending on a stupid non programmable PCB to protect your idea is not feasible anymore for long.
There is a reason why Chinese designs don't use AVR. We use STM32/STM8 and internal NVM CPLD/FPGAs extensively -- those are all known to be very expensive to clone, sometimes impossible depending on luck and budget.

+1 for FPGA and its cousin the CPLD... only viable option if someone really wants to stop pirating of something of value.  Love PICs etc but to easy to just decap and rip the firmware right out especially if you have multiple samples and lots of places that offer this service now to boot

[sokoloff]

Most any product these days involves more than just the hardware,  a schematic or pcb layout doesn't do you much good without the MCU firmware or FPGA configuration, anything desirable enough to re-develop that is probably desirable enough to reverse engineer from a finished product.

This. Depending on a stupid non programmable PCB to protect your idea is not feasible anymore for long.
There is a reason why Chinese designs don't use AVR. We use STM32/STM8 and internal NVM CPLD/FPGAs extensively -- those are all known to be very expensive to clone, sometimes impossible depending on luck and budget.

How is ESP32 with flash encryption (code protection) turned on in this regard?

[Mr. Scram]

How is ESP32 with flash encryption (code protection) turned on in this regard?

I'm not sure I would completely trust the ESP silicon itself, to be honest.

[Elasia]

How is ESP32 with flash encryption (code protection) turned on in this regard?

I'm not sure I would completely trust the ESP silicon itself, to be honest.

Just eyeballing it, looks like the key is stored in a fuse block.  Pretty penny but still doable to attack the chip silicon. Mostly due to the randomization of the keys which is not a bad idea to stop blatant decapping services and restore some of the cost barrier.

[Elasia]

For normal markets you shouldnt... you wont see that relied on by defense contractors if there is any secret sauce to protect.  If someone had access to the right gear it would eat right through that fuse block.. but no way in hell your typical hack and slash clone op is going to be anywhere near that sophisticated... yet anyway.  In 10 years who knows... tech just keeps falling from the sky

[sokoloff]

Thanks, guys! My contemplated device is a low-volume piece of industrial test gear. I just want to make sure I can cover the NRE without it being trivial to clone. Sounds like I'm covered there.