isquared.nl rss (atom)
Probing a SecureID Token
One of my friends gave me a few RSA SecurID tokens that are about
to expire.
I had noticed already sometime before that the part on the back, where
the serial number is written, appears
to be a added later, it is made of a different kind of plastic than the
rest of the case.
Having a few tokens to play with, I pryed off the badge with the serial
number and looked underneath.
There I found something that stimulated my curiosity even further....
The SecurID tokens, front and back
And now for the surprise...
I lifted the badge, put it aside on a sticker sheet, to find:
Yay! Programming pads! Or test pads, or whatever, at least something interesting. ;)
By the way, appropriate stickers, eh? :p
Those pads just beg to be abused to satisfy my curiosity further. So, I whipped up a simple jig to get easy access to them.
The jig
I cut up a piece of perfboard, soldered some 30 AWG wire wrapping wire to the pads on the SecureID and wrapped the other end of the wires to some wire-wrapping headers on the edge of the board.
Now I can easily attach my scope probes to see what signals are on those pads.
With the scope I found a nice 1 Hz pulse, about 20 ms wide on one
of the pins:
Sorry for the lousy quality, but it's hard to photograph this using a
full automatic camera. This pic was taken in many tries, in the dark, with
the camera on its lowest ISO setting.
I'm open for suggestions on how to photograph slow signals on a scope screen
with a budget digital camera. :)
Then I wrote a simple program for my Arduino that served as a poor-man's
logic analyzer to see all the pins at once:
This showed not much more than the scope did before, only a few pins
that wobbled every minute, when the SecurID's lottery number changes, but
nothing too interesting, alas.
So far my progress with this thing, if anybody had more information about the internals of the modern SecurID's or did something interesting with these pads already, I'd be happy to hear from you!