For economic reasons, even though there are some security problems, the commands of re-initializing and writing patch code are widely used in smart cards. The current software tester has difficulty in detecting these trapdoor commands because trapdoors are not published and programmed sophisticatedly. Up to now the effective way to detect them is to completely reveal and analyze the entire code of the COS with applications such as the ITSEC. It is, however, a very time-consuming and expensive processes. We propose the new detecting approach of trapdoors in smart cards using timing and power analysis. With our experiments, this paper shows that the proposed approach is more practical than the current methods.