Author Topic: What potting compound to use to protect from reverse engineering ?  (Read 3778 times)

0 Members and 1 Guest are viewing this topic.

Offline Arte

  • Contributor
  • Posts: 7
  • Country: fr
Hello !

I'm developing my first commercial electronics product and I have reason to some believe some people will want to steal the contents of RAM (there is a history of IP theft in that domain). On top of that, I use the RP2040, which doesn't have an internal flash (and thus any form of security measure). Finally, patents are way too expensive for one random guy like me.

Given that, I'm still trying to make it very hard to reverse engineer the device. Aside from any software things like encrypting the firmware in place or making it hell to read the ASM, I was planning to use a potting compound to prevent access to the electrical components.

At first I tried some random epoxy off Amazon (meant to make fantasy jewelry & other mold-based things - Dr Crafty). That didn't work very well. I could scrape off the cured epoxy with a knife, and I could cut it too, and once there was enough of a dent, I could remove it by hand and it would separate from the PCB. So clearly, far from enough adherence to the PCB.

Fine then, maybe I should use something meant for potting compounds as my potting compound. So I got some MG Chemicals 8810 Black Rigid Urethane. Unfortunately that's not working out very well for me either.



Two observations here: I put what I would consider a "normal" amount of coating on the right PCB, and it would seem bubbles have formed as in, the volume at least tripled. ... In fact the PCB does not fit in its enclosure anymore.
In my subsequent tries, I put few droplets, and I get something that, while having significantly grown in volume, at least doesn't render the PCB unusable. That's a very annoying behavior I didn't expect, and I'm not sure is expected. Also, I would guess that these bubbles lower the resistance, I mean, I can pierce them with a knife...
Secondly, I find this not that hard to remove. It's not as easy as the epoxy I used previously, but I would expect someone determined to be able to remove enough of it to access the interesting parts without any need of resorting to hazardous chemicals, in other words, it doesn't do the job.

We're very far from what I can read about the efficiency of these compounds in places like https://www.eevblog.com/forum/repair/removing-black-little-rubbery-feel-potting-compound/ where people agree it's very difficult to remove, for instance I read
"To make a long story short: Theres no "chemical" way to remove it without damaging the parts or PCB that i know of.
If it's the soft stuff, you just remove it with a cutter piece by piece, hoping it does not stick to well to the plastic foils around caps etc.
The problem is, once you cleared the PCB, i may be impossible to tear the PCB from the resin underneath without breaking it.

If it's the hard resin: Forget about it. I'm not saying it can't be done, but it's a fools errand. "


So, what am I doing wrong here ? It should be noted that since I was mixing droplets (10 droplets of A, 5 droplets of B...) the 2:1 ratio may not be perfect.. but still. What is this "hard resin" ? Am I using the wrong chemical ? Or just doing things wrong ? On that note, if I could use a chemical that doesn't behave like yeast, that'd really make my life simpler.

Thanks !
Regards, JB
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 9250
  • Country: us
    • Personal site
Re: What potting compound to use to protect from reverse engineering ?
« Reply #1 on: June 26, 2022, 07:38:18 pm »
With RP2040, I'd say forget about it. It does not matter how you coat it, it would be always possible to get access to the traces, so extraction of the firmware is next to trivial. You don't need to remove it all, you don't even need to remove the devices, all you need it to get access to the traces. Using very hard epoxy actually plays into attacker's hand - it can just be milled out. Using a slightly gummy product is more annoying.

And especially if the IP theft is common in the area, then this would not be an obstacle to anyone.

Also, as an attacker, what is the problem with  breaking a PCB? The analysis can be destructive. You can buy multiple device for reverse engineering.

And for the traces you also have XRay, for which your epoxy won't do anything.

Here is how such things are removed in practice: https://youtu.be/Qk8Hg8uCRQE?t=123 The video is about removing the IC using a CNC mill for replacement, but the same principle applies for reverse engineering.
« Last Edit: June 26, 2022, 07:43:12 pm by ataradov »
Alex
 

Offline oz2cpu

  • Frequent Contributor
  • **
  • Posts: 640
  • Country: dk
    • webx.dk private hobby and diy stuff
Re: What potting compound to use to protect from reverse engineering ?
« Reply #2 on: June 26, 2022, 07:44:12 pm »
you can only slow the one person down, who WILL do it, no matter what,
in that work, you end up spending so much extra time and money into each unit you make..
is it really worth it ?

a good advice , call the epoxy coating you add, weather proof, and thermal improve, and vibration improve..
but dont belive it will secure your ip..

by the way :
eposy mixed with sand, is a pain to remove, it also wear hard on tools and patience
Radioamateur OZ2CPU, Senior EE at Prevas
EMC RF SMPS SI PCB LAYOUT and all that stuff.
 

Online coppercone2

  • Super Contributor
  • ***
  • Posts: 6548
  • Country: us
  • $
Re: What potting compound to use to protect from reverse engineering ?
« Reply #3 on: June 26, 2022, 08:08:06 pm »
and I don't think all those 'improvements' are true, potting compound can IMO make some stuff less reliable.

you can mail stuff in for circuit RE and depotting, they will have some guy go at it 0.1mm at a time till its nice and clean and then also x-ray it and ID all the chips for you. remember there are 195 countries in the world and most of them are poor and have willing people, you are likely wasting BOM and manufacturing cost. There are probably Chinese X-ray ID databases of IC right now lol
« Last Edit: June 26, 2022, 08:12:24 pm by coppercone2 »
 

Offline Conrad Hoffman

  • Super Contributor
  • ***
  • Posts: 1642
  • Country: us
    • The Messy Basement
Re: What potting compound to use to protect from reverse engineering ?
« Reply #4 on: June 26, 2022, 09:17:08 pm »
IMO, a waste of time. Almost all epoxies will succumb to a bath of hot NMP. Those that won't can be removed in other ways. Even if you had money for patents, they're nearly useless. The best defense is to make your money and be on to something new before the device is copied.
 
The following users thanked this post: mjkuwp, james_s, coppercone2

Offline Arte

  • Contributor
  • Posts: 7
  • Country: fr
Re: What potting compound to use to protect from reverse engineering ?
« Reply #5 on: June 26, 2022, 09:47:24 pm »
By IP theft being common, I was moreso saying that the people here have zero ethics. For the record the domain is a video game community. So the attacker wouldn't have mad funds either. And yeah I'm aware they only need traces, which is why the area covered in compound here is the chip, the flash, and the traces in between.. But I get what you're all saying.... Also I really don't care about the circuit, only about the algorithm within the chip. In fact even if they have the flash contents, I tried my best at making it hell to reverse engineer the ASM. Now if they can debug the chip, of course none of this helps.

While I'm here - would it help to wire the SWD pins to some net ? If I do that and wire them to say 3V, that would mean the reverse engineer would have to remove the chip from the PCB first, correct ?
 

Online SiliconWizard

  • Super Contributor
  • ***
  • Posts: 10170
  • Country: fr
Re: What potting compound to use to protect from reverse engineering ?
« Reply #6 on: June 26, 2022, 09:57:17 pm »
If you want a decent potting compound, have a look at Electrolube. Select what's appropriate: https://electrolube.com/products/encapsulation-resins/

Whether it's useless or not can be an endless debate. I suppose slowing down people, especially if you suspect average DIYers rather than large and well-equipped chinese companies, is better than doing nothing.
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 9250
  • Country: us
    • Personal site
Re: What potting compound to use to protect from reverse engineering ?
« Reply #7 on: June 26, 2022, 09:58:25 pm »
All they would need to do is get access to the flash IC or traces and then flash the same firmware on the dev kit. They don't need your hardware to debug.

You will be wasting time on that epoxy effort and it will take an interested party a couple of hours to dump the firmware. Seriously, it is a waste of time.

Also, don't forget to epoxy the other side too, since if the epoxy is too annoying, I'd just go with the mill from the other side and mill out the PCB under the ICs. And you don't need some crazy high tech equipment - a dremel with a grinding stone or burr will do.
« Last Edit: June 26, 2022, 10:01:43 pm by ataradov »
Alex
 

Offline Arte

  • Contributor
  • Posts: 7
  • Country: fr
Re: What potting compound to use to protect from reverse engineering ?
« Reply #8 on: June 26, 2022, 10:00:54 pm »
I can make the firmware depend on the flash ID. (I am so deleting these posts later on) Wouldn't that make pulling the firmware from the flash & using it elsewhere not an option ? And if I force them to take off the chip from the PCB, then if I rely on the shape of the PCB to build a decryption key, the decryption would fail, hence my idea of forcing them to remove the chip from the PCB because the SWD lines are wired to other stuff - would that not be a significant PITA to deal with ?
« Last Edit: June 26, 2022, 10:03:46 pm by Arte »
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 9250
  • Country: us
    • Personal site
Re: What potting compound to use to protect from reverse engineering ?
« Reply #9 on: June 26, 2022, 10:03:11 pm »
I can make the firmware depend on the flash ID. (I am so deleting these posts later on)
It is very trivial to debug. All you have to find is the place that reads the ID from the flash. And this is very easy to correlate with activity on the outside bus. And then it is even easier to patch out the check.

You are reinventing the wheel. None of this will do much to slow down the attacker. External flash with no hardware scrambling == no security.
« Last Edit: June 26, 2022, 10:05:58 pm by ataradov »
Alex
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 18298
  • Country: us
Re: What potting compound to use to protect from reverse engineering ?
« Reply #10 on: June 26, 2022, 11:35:04 pm »
If something is potted, it only encourages me to try to reverse engineer it, and I will say from experience that no matter what you pot it in I will find a way to access the components. I have access to an xray machine and a milling machine, I have a hot air pencil and various picks and scraping tools. I've yet to encounter a potting compound that did more than slow me down a bit, especially if I'm willing to destroy a sample of the device I will get into it. I'm just a hobbyist doing this stuff for fun, imagine how you are going to stop somebody who is really determined and is getting paid to do it.

Make your device as good as you can, offer value added features like top notch support and you will sell them. You cannot stop cloning by force.
 

Online ejeffrey

  • Super Contributor
  • ***
  • Posts: 2966
  • Country: us
Re: What potting compound to use to protect from reverse engineering ?
« Reply #11 on: June 26, 2022, 11:44:13 pm »
(I am so deleting these posts later on)

Please don't do that.  I'm not sure if it is officially against the forum rules and a banning offense, but it should be and either way is extremely offensive behavior.  People here are volunteering to help you for free.  Even if you don't like the answer, it is important to leave the record here so that other people searching can find it in the future.  If you want private or professional advice, pay someone for it.  There are plenty of people on these boards who do consulting.  Of course, you probably don't want to pay an hourly consulting rate for someone to tell you what everyone here has already said: potting compound is useless for preventing even casual reverse engineering.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 23598
  • Country: nl
    • NCT Developments
Re: What potting compound to use to protect from reverse engineering ?
« Reply #12 on: June 26, 2022, 11:48:13 pm »
In my experience PU based potting compound adhere much stronger to components. What you could consider is having the electronics potted using a mold so you don't have to use a casing. I have used this method for some products in the past. The trick is to find a company that has the necessary equipment (vacuum chamber) and experience to create a good looking product. In 'my' case the potting was done to make it impossible to tamper with a board without physical damage.

But as others have pointed out: for reverse engineering potting does nothing. Just make sure to market & price your product in a way that you get an optimal ROI. Spending too much time on reverse engineering measures can actually make your profits go away.
« Last Edit: June 26, 2022, 11:50:34 pm by nctnico »
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 
The following users thanked this post: james_s

Online jonpaul

  • Super Contributor
  • ***
  • Posts: 1424
  • Country: fr
Re: What potting compound to use to protect from reverse engineering ?
« Reply #13 on: June 27, 2022, 05:55:37 am »
 Bonjour à tous....

the chance that the OP really has a truly innovative and new invention is very low, suggest OP could check the field a bit deeper.
 
Potting has been discussed before eg for high voltage modules.
the impression that potting  easy or increases reliability is false.
The active chemicals, heat and mechanical stress during the curing can damage ICs and components and result in a dead device.


We made thousands of potted HV modules. We had a year to debug internal layout, stress relief, epoxy mix, process etc.
Initial yield was 50% and after a year of work we got 95% yield.
A vacuum oven cure cycle and anneal was required, with a proprietary epoxy 100% solids.

Finally beware that epoxy curing agents are active and toxic chemicals, eg aniline, which can cause skin rash, and other health hazards.

Nowadays reverse engineering of a fully potted assembly is with an x-ray, but usually heat will make the encapsulant crumble.
A determined competitor or adversary will always find a method.
Defense is always 10..100x more expensive and difficult than offense.

Bon Chance,

Jon

PS: Je pense que l'OP, M. Arte, est français ? Je vis à Paris...
« Last Edit: June 27, 2022, 06:59:33 am by jonpaul »
Jean-Paul (EE 1968, the Internet Dinosaur)
 

Offline vk6zgo

  • Super Contributor
  • ***
  • Posts: 6858
  • Country: au
Re: What potting compound to use to protect from reverse engineering ?
« Reply #14 on: June 27, 2022, 06:22:04 am »
If someone legitimately buys one of your devices, & uses it as intended, they then pretty much know what it does, and can design something which does the same job, even if the "guts" are different, so "reverse engineering" is probably not even necessary.

OK, they might miss one feature of your original design, but if the thing they make is cheaper than yours, it will still sell!
 

Offline David Hess

  • Super Contributor
  • ***
  • Posts: 14749
  • Country: us
  • DavidH
Re: What potting compound to use to protect from reverse engineering ?
« Reply #15 on: June 27, 2022, 09:28:34 am »
Mix the epoxy potting compound with silica sand.
 

Online coppercone2

  • Super Contributor
  • ***
  • Posts: 6548
  • Country: us
  • $
Re: What potting compound to use to protect from reverse engineering ?
« Reply #16 on: June 27, 2022, 08:54:12 pm »
IMO, a waste of time. Almost all epoxies will succumb to a bath of hot NMP. Those that won't can be removed in other ways. Even if you had money for patents, they're nearly useless. The best defense is to make your money and be on to something new before the device is copied.

That sounds like a useful solvent to have around.
 

Offline oz2cpu

  • Frequent Contributor
  • **
  • Posts: 640
  • Country: dk
    • webx.dk private hobby and diy stuff
Re: What potting compound to use to protect from reverse engineering ?
« Reply #17 on: June 27, 2022, 10:11:59 pm »
i once had the idea of a secret bag of poop deep inside the epoxy,
so the dude going carefully thru the epoxy will know how i feel about him,
there is no copyright on this idea if any one like to copy it, feel free,
Radioamateur OZ2CPU, Senior EE at Prevas
EMC RF SMPS SI PCB LAYOUT and all that stuff.
 
The following users thanked this post: SiliconWizard

Offline Smokey

  • Super Contributor
  • ***
  • Posts: 1817
  • Country: us
  • Not An Expert
Re: What potting compound to use to protect from reverse engineering ?
« Reply #18 on: June 27, 2022, 10:25:19 pm »
Hello !

I'm developing my first commercial electronics product and I have reason to some believe some people will want to steal the contents of RAM (there is a history of IP theft in that domain). On top of that, I use the RP2040, which doesn't have an internal flash (and thus any form of security measure). Finally, patents are way too expensive for one random guy like me.

Given that, I'm still trying to make it very hard to reverse engineer the device. Aside from any software things like encrypting the firmware in place or making it hell to read the ASM, I was planning to use a potting compound to prevent access to the electrical components.

At first I tried some random epoxy off Amazon (meant to make fantasy jewelry & other mold-based things - Dr Crafty). That didn't work very well. I could scrape off the cured epoxy with a knife, and I could cut it too, and once there was enough of a dent, I could remove it by hand and it would separate from the PCB. So clearly, far from enough adherence to the PCB.

Fine then, maybe I should use something meant for potting compounds as my potting compound. So I got some MG Chemicals 8810 Black Rigid Urethane. Unfortunately that's not working out very well for me either.



Two observations here: I put what I would consider a "normal" amount of coating on the right PCB, and it would seem bubbles have formed as in, the volume at least tripled. ... In fact the PCB does not fit in its enclosure anymore.
In my subsequent tries, I put few droplets, and I get something that, while having significantly grown in volume, at least doesn't render the PCB unusable. That's a very annoying behavior I didn't expect, and I'm not sure is expected. Also, I would guess that these bubbles lower the resistance, I mean, I can pierce them with a knife...
Secondly, I find this not that hard to remove. It's not as easy as the epoxy I used previously, but I would expect someone determined to be able to remove enough of it to access the interesting parts without any need of resorting to hazardous chemicals, in other words, it doesn't do the job.

We're very far from what I can read about the efficiency of these compounds in places like https://www.eevblog.com/forum/repair/removing-black-little-rubbery-feel-potting-compound/ where people agree it's very difficult to remove, for instance I read
"To make a long story short: Theres no "chemical" way to remove it without damaging the parts or PCB that i know of.
If it's the soft stuff, you just remove it with a cutter piece by piece, hoping it does not stick to well to the plastic foils around caps etc.
The problem is, once you cleared the PCB, i may be impossible to tear the PCB from the resin underneath without breaking it.

If it's the hard resin: Forget about it. I'm not saying it can't be done, but it's a fools errand. "


So, what am I doing wrong here ? It should be noted that since I was mixing droplets (10 droplets of A, 5 droplets of B...) the 2:1 ratio may not be perfect.. but still. What is this "hard resin" ? Am I using the wrong chemical ? Or just doing things wrong ? On that note, if I could use a chemical that doesn't behave like yeast, that'd really make my life simpler.

Thanks !
Regards, JB

By IP theft being common, I was moreso saying that the people here have zero ethics. For the record the domain is a video game community. So the attacker wouldn't have mad funds either. And yeah I'm aware they only need traces, which is why the area covered in compound here is the chip, the flash, and the traces in between.. But I get what you're all saying.... Also I really don't care about the circuit, only about the algorithm within the chip. In fact even if they have the flash contents, I tried my best at making it hell to reverse engineer the ASM. Now if they can debug the chip, of course none of this helps.

While I'm here - would it help to wire the SWD pins to some net ? If I do that and wire them to say 3V, that would mean the reverse engineer would have to remove the chip from the PCB first, correct ?

I can make the firmware depend on the flash ID. (I am so deleting these posts later on) Wouldn't that make pulling the firmware from the flash & using it elsewhere not an option ? And if I force them to take off the chip from the PCB, then if I rely on the shape of the PCB to build a decryption key, the decryption would fail, hence my idea of forcing them to remove the chip from the PCB because the SWD lines are wired to other stuff - would that not be a significant PITA to deal with ?

:)
 

Online coppercone2

  • Super Contributor
  • ***
  • Posts: 6548
  • Country: us
  • $
Re: What potting compound to use to protect from reverse engineering ?
« Reply #19 on: June 27, 2022, 11:37:23 pm »
i once had the idea of a secret bag of poop deep inside the epoxy,
so the dude going carefully thru the epoxy will know how i feel about him,
there is no copyright on this idea if any one like to copy it, feel free,

yes, the guy in a third world country trying to repair the module 10 years after its obsolete is gonna love it :clap:
 

Offline vk6zgo

  • Super Contributor
  • ***
  • Posts: 6858
  • Country: au
Re: What potting compound to use to protect from reverse engineering ?
« Reply #20 on: June 28, 2022, 02:56:19 am »
i once had the idea of a secret bag of poop deep inside the epoxy,
so the dude going carefully thru the epoxy will know how i feel about him,
there is no copyright on this idea if any one like to copy it, feel free,

yes, the guy in a third world country trying to repair the module 10 years after its obsolete is gonna love it :clap:
Many products are figuratively speaking, "a bag of poop", so why not literally. ;D

In Oz, we like to think of ourselves as a "first World Country", but I have run into plenty of cases of manufacturers using public domain circuitry, then trying to protect their non-existent IP by sanding the markings off ICs.
It is usually pretty obvious what the device is, after chasing up the surrounding circuitry, but it is an additional cost to the customer.
Encapsulation is just the poop icing on the cake!

Then there are devices which are "unobtainium" except from the manufacturers, who if they are in Europe, may as well be on the moon!
Back in the day, a special IC in an LGT TV transmitter which was still a current design croaked, with a spare "maybe" avaliable in 3 months------A workaround, using discrete components on a VERO board was designed in a couple of days, & in service within a week.

Never discount the ingenuity of a Tech being harassed by his/her Boss!
 

Offline Ice-Tea

  • Super Contributor
  • ***
  • Posts: 2796
  • Country: be
    • Freelance Hardware Engineer
Re: What potting compound to use to protect from reverse engineering ?
« Reply #21 on: June 28, 2022, 06:34:34 am »
As other pointed out: probably not worth the time/effort. You're better of investing that energy and $$ either in keeping the product cheap (which potting does not do) so it makes less sense to reverse engineer it or to improve your product continuously so you stay one step ahead.

Offline AnalogueLove1867

  • Regular Contributor
  • *
  • Posts: 68
  • Country: au
Re: What potting compound to use to protect from reverse engineering ?
« Reply #22 on: June 28, 2022, 11:38:21 am »
Very disappointed with all the people here openly encouraging the OP to just let other people easily pirate his design.....  :palm:
I have some valuable family items locked in a miniature safe that is bolted onto concrete...
BUT
Somebody could easily break in when I'm at work and open it up with a welder....
So there is no point right? Might as well just leave it out in the front yard for the local meth-head to snatch up lol.
All the other points made by people here...  just bizarre. Anyway, to the point!




And then PC builders have whole how-to videos about directly spray-painting motherboards on youtube.
So you could
!) first spray paint the whole circuit.
2)The cover it with a layer of nail varnish or glue gun etc.
3) Finish off with a second final spray paint.



« Last Edit: June 28, 2022, 11:44:06 am by AnalogueLove1867 »
 

Offline Ice-Tea

  • Super Contributor
  • ***
  • Posts: 2796
  • Country: be
    • Freelance Hardware Engineer
Re: What potting compound to use to protect from reverse engineering ?
« Reply #23 on: June 28, 2022, 12:05:20 pm »
You're going to protect the circuit with...

*checks notes*

hot melt? So, the criminal essentially has to put the device in the sun and wait for the goop to drip out? IMO, a commercial product and hot melt don't go together. Ever.


Offline AnalogueLove1867

  • Regular Contributor
  • *
  • Posts: 68
  • Country: au
Re: What potting compound to use to protect from reverse engineering ?
« Reply #24 on: June 28, 2022, 12:17:08 pm »
You're going to protect the circuit with...

*checks notes*

hot melt? So, the criminal essentially has to put the device in the sun and wait for the goop to drip out? IMO, a commercial product and hot melt don't go together. Ever.

Cool potatoes! Don't Use the hot glue then! Use one of the many other things listed in the vids.
Also The point isn't to prevent all potential humans on the planet from ever reverse-engineering the product for three hundred years.
The point is that you make it HARDER and more INCONVENIANT/TIME-CONSUMING.
And I hate to tell you this... but I have come across products from china that have been pasted over with some sort of thermoplastic that HAS melted.
So yeah, commercial products.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf