1. Potential Risks for Smart Cards Firmware
S.ICZ
Security and Protection of Information
Brno 2005

2. Measuring Arrangement

4. Filtering

5. Real SIM
Begin
End
Life
Verify

6. Real Attack
Life
Difference
Difference
Life
Life
Difference

7. The Sample of Source Code
private void PulsePIN(APDU apdu, byte[ ] pbuffer) {
byte byteRead =(byte)(apdu.setIncomingAndReceive());
byte BlockPWD [ ]={(byte)0x00};
byte BlockPWDLen = 1;
MyPin.check(pbuffer, ISO7816.OFFSET_CDATA, byteRead); }

8. The Result 1x private void PulsePIN(APDU apdu, byte[ ] pbuffer) {
byte byteRead =(byte)(apdu.setIncomingAndReceive());
byte BlockPWD [ ]={(byte)0x00};
byte BlockPWDLen = 1;
MyPin.check(pbuffer, ISO7816.OFFSET_CDATA, byteRead); } 2x 3x

9. Another Sample of Program
private void PulsePIN(APDU apdu, byte[ ] pbuffer) {
byte byteRead =(byte)(apdu.setIncomingAndReceive());
byte BlockPWD [ ]={(byte)0x00};
byte BlockPWDLen = 1;
// Good PIN
MyPin.check(BlockPWD, (byte)0x , BlockPWDLen);
// Try PIN
if (!MyPin.check(pbuffer, ISO7816.OFFSET_CDATA, byteRead))
short tries = MyPin.getTriesRemaining();
// send error counter in APDU back
ISOException.throwIt( (short) (SW_PIN_FAILED + tries)); }

10. Bad X Good PIN

11. Public Phone Card

12. Conclusion Inexpensive Noninvasive Attacks Complexity X Security
Side channels program tracing
MyPin.check(pbuffer, ISO7816.OFFSET_CDATA, byteRead);