Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still.
There are sites that claim to have vulnerabilities for various Cortex chips.
- As I understand it, there could be a decapping process where the die is exposed and messed with
- There could be a JTAG/SWD hack with a special process or over/under voltage exploit, I don't know this exists for ARM, but I know it's possible on other chip (F U PIC)
- There is also a non-removable bootloader on almost all consumer ARM Cortex parts. I think STM32 is a USB and serial bootloader. NXP or Freescale or someone have a full Mass Storage Class bootloader. Since the code is kept hidden, there could be an undisclosed exploit there too.
Is there anything I can do to keep my code secure? Almost no one in my industry would have any idea what to do even if I handed them the C code. It's Chinese knock-offs / clones I need to worry about since they are using our name, logos, cloned hardware, my code, and undercutting official dealers.
- The plan I have currently is to require online authentication. So that if I see a chip that isn't on my masterlist, I burn it with bad firmware. If I see a duplicated chip I verify the original and burn the clones. If the chip is valid, I like it to the user's info and move along. The legit user should see nothing but an interface for their product.
With the above idea, some one ripping us off would still get the ROM so I still have the encryption keys in the wind. While the module wouldn't really work without using it online as the interface, it's still annoying and a potential issue.
One consideration is the Chinese haven't been willing or really likely able to replicate the code without 1:1 ripping it. So I sort of think it's a leap to assume they'd rip my code, then go to reverse engineering, because that just doesn't seem like the same class of criminal that's cloning our stuff. I think they attacked us because it's such simple PCB and the code was easy to get. They likely aren't going to also reverse all the online work to make an offline interface for it, I don't think anyhow.
Thoughts on anything else I could do?