Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Government Privacy Security Your Rights Online

New German Government ID Hacked By CCC 86

Posted by timothy
from the danke-sehr-fuer-die-papieren dept.
wiedzmin writes "Public broadcaster ARD's show 'Plusminus' teamed up with the known hacker organization 'Chaos Computer Club' (CCC) to find out how secure the controversial new radio-frequency (RFID) chips were. The report shows how they used the basic new home scanners that will go along with the cards (for use with home computers to process the personal data for official government business) to demonstrate that scammers would have few problems extracting personal information. This includes two fingerprint scans and a new six-digit PIN meant to be used as a digital signature for official government business and beyond." That was quick. Earlier this year, CCC hackers demonstrated vulnerabilities in German airport IDs, too.
This discussion has been archived. No new comments can be posted.

New German Government ID Hacked By CCC

Comments Filter:
  • OpenPGP (Score:5, Insightful)

    by axx (1000412) on Thursday September 02, 2010 @12:59PM (#33454282) Homepage
    Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure. Oh well, too complicated for the "general public" I guess, I mean keeping a spare of your (digital) key? That's far too complicated!
    • Re:OpenPGP (Score:5, Insightful)

      by Chris Mattern (191822) on Thursday September 02, 2010 @01:04PM (#33454360)

      Oh well, too complicated for the "general public" I guess, I mean keeping a spare of your (digital) key? That's far too complicated!

      Keeping a copy of your private key *securely*. Yes, it's been amply demonstrated that nothing left under the control of the average user can be counted on to stay secure. And once someone else gets access to your private key, you're royally screwed.

      • Re:OpenPGP (Score:5, Funny)

        by Monkeedude1212 (1560403) on Thursday September 02, 2010 @01:12PM (#33454486) Journal

        Yes, it's been amply demonstrated that nothing left under the control of the average user can be counted on to stay secure.

        It's because the "average user" has a girlfriend who can't keep a damn secret.

        Luckily - we don't have that problem.

        • Re:OpenPGP (Score:4, Insightful)

          by electricprof (1410233) on Thursday September 02, 2010 @01:36PM (#33454864)
          Aren't girlfriends creatures of myth like Santa Claus, the Easter Bunny and Honest Lawyers?
          • Aren't girlfriends creatures of myth like Santa Claus, the Easter Bunny and Honest Lawyers?

            And pumas. Don't forget pumas.

            • by men0s (1413347)
              Oblig RvB:

              Sarge: What in Sam Hell is a 'Puma'?
              Simmons: Uhh, you mean like the shoe company?
              Grif: No. Like a Puma. It's a big cat, it's like a lion.
              Sarge: You're making that up.
              Grif: I'm telling you, it's a real animal.
              Sarge: Simmons, I want you to poison Grif's next meal.
              Simmons: Yes sir!
              Sarge: Look, see these two tow hooks? They look like tusks, and what kind of animal has tusks?
              Grif: A walrus.
              Sarge: Didn't I just tell you to stop making up animals?!
              • by tqk (413719)

                Oblig RvB: ...

                Sarge: Didn't I just tell you to stop making up animals?!

                Would you people please stop making up TLAs!?! WTF is RvB?!? Grumble, mumble, ...

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        That's not an insurmountable problem, however. Indeed, it's more or less the same problem that any of these sorts of devices/designs (secure IDs) will face. Using asymmetric encryption just provides a better base. Also, the solution is already halfway complete:
        http://en.wikipedia.org/wiki/Smart_Card#Cryptographic_smart_cards

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Private keys have passwords which *should* protect the key if someone gets a hold your private key.

        Ofc, if you're dumb enough to have no password or something that can easily be bruteforced, then it's your problem.

        • by mlts (1038732) *

          That is why I use eTokens for my PGP keys. I have mine configured so a few guesses will lock the user password, a few more will lock the admin password and render the data on the token permanently unusable unless someone has a chip fab with uncapping facilities at their disposal.

          Trick is to have multiple tokens, and at least two keys. One key is generated on the token, and another key is copied onto all the tokens. This way, one can encrypt data with just the token-generated keys, as well as use the key

      • Re: (Score:3, Insightful)

        by mea37 (1201159)

        Right, for the government to expect you to keep a number secure, knowing that if that number were exposed then someone could steal your identity, and to then rely on that number to identify and authenticate someone wishing to do business with them; that would be unthinkable.

      • Re:OpenPGP (Score:5, Interesting)

        by LordKronos (470910) on Thursday September 02, 2010 @01:41PM (#33454964) Homepage

        And once someone else gets access to your private key, you're royally screwed.

        Royally screwed? I thought that's what key revocation was for. With PGP, you just revoke the old, generate a new key, and you are good to go from there on out. But how exactly do you revoke and reissue fingerprints?

      • Re: (Score:3, Insightful)

        by fluffy99 (870997)

        Even smartcards, which never expose the private key are at risk. If you have a compromised computer, someone can remotely use your smartcard whenever its inserted into the machine. Even hardware tokens with changing values are at risk to a keylogger and a script that fires off before the toekn pin changes.

        It all boils down to the fact that if the computer isn't trustworthy, then anything you put in the computer is at risk.

      • by Dumnezeu (1673634)

        In support of the parent post: can you even trust your own hardware? I remember a recent story on Slashdot regarding some common computer hardware (a video or a network card) had its firmware infected with a trojan. And even more recently, a company accidentally released a software update that was infected with a virus (the machine they used to compile was infected, so the compiled .exe got infected as well).

      • by Yvanhoe (564877)
        If the ID gets stolen, then cancel it by proving your identity with a fingerprint/iris scanner at your police station. You'll get another one and the public databases will be refreshed.

        The system is not completly trivial, but it is not exactly rocket science either...
        • Re: (Score:1, Interesting)

          by Anonymous Coward

          But that would mean there had to be a central database containing the fingerprints and identities of all citizens.
          Isn't that exactly what people are trying to avoid?

          • by Yvanhoe (564877)
            Isn't that, exactly, what biometric passports are ? Anyway I don't understand the fears about that. I would like to be able to prove reliably my identity and citizenship. The ability to do so is not the problem, it is to make identity tests abusively mandatory that is. The problem, however, is already here. We have to prove identity many times and we do that through insecure means. Having a secure way won't change the abuses much and will make identity theft much more difficult.
    • PGP not a panacea (Score:4, Insightful)

      by perpenso (1613749) on Thursday September 02, 2010 @01:21PM (#33454604)

      Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure.

      An imperfect systems can still be useful. If card/scanner misuse is on the order of handwritten signature misuse then replacing dead trees with some bits might be a good idea in many situations.

      The pgp digital sig proves it was sent by your computer perhaps, but not necessarily sent by you. There is a genuine need for biometrics to be involved. Note that a handwritten signature is a form of biometric ID and like the card/scanner system it can be faked. This is why for more important situations a signature must be witnessed and possible notarized. The card/scanner system can similarly escalate the process for more important situation. For example when someone uses a bank's ATM a swipe and a pin are sufficient. When they walk up to a teller for larger transactions then a swipe and a pin could be augmented with a photo being displayed on the teller's screen. Banks often have such photos for embedding into ATM and credit cards.

      • Re: (Score:3, Informative)

        by malloc (30902)

        The pgp digital sig proves it was sent by your computer, or any other digital device in the universe that has a copy of your key , but not necessarily sent by you.

        FTFY.

    • by mlts (1038732) *

      Even better, why not go to a true PKI infrastructure?

      User gets a smart card, the government certifies the smart card is his/hers, and other authorities sign certificates relating to that person (like the person graduated, is over the age of 21, is able to drive, is not a felon, etc.) For things like criminal record status, those certificates could be SLCs refreshed daily or hourly (which is better than worrying about a CRL mechanism.)

      Lost smart card? The user previously saves a revocation certificate whic

    • by Agripa (139780)

      Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure. Oh well, too complicated for the "general public" I guess, I mean keeping a spare of your (digital) key? That's far too complicated!

      It is not possible because then the government would not be able to forge authentication in your name when needed. It is the same reason security certificates must be centrally managed.

  • by Anonymous Coward on Thursday September 02, 2010 @12:59PM (#33454284)

    Alle Ihre Pässe sind gehören uns

    Yes, that is what you think it is: A corrupt translation of a corrupt translation.

    • by Sique (173459)

      I like how your translation preserves the bad grammar of the original.

  • by gandhi_2 (1108023) on Thursday September 02, 2010 @12:59PM (#33454292) Homepage

    1: fix the problems.
    2: abandon the plan.
    3: arrest the people who embarrassed you, suppress any mention of the incidents.

    Hmmm... let's see...

    • Number 3 is the only feasible choice of course ...
    • You left some crucial steps;

      1: fix the problems.
      2: abandon the plan.
      3: arrest the people who embarrassed you, suppress any mention of the incidents.
      4: ???
      5: PROFIT!
    • by Jesus_666 (702802)
      I assume they'll go with option 4: Ignore that anything happened. Maybe they'll play it down in the media. Either way they'll all act very surprised when someone manages to break the cards once they're out in the wild.
  • by Anonymous Coward

    But please do note that at least the Germans know how to do it thoroughly: They'd give you a home reader with it, so you can actually use that card and incidentally also see what's on it. Oh, and pwn the crap out of it, but that's courtesy the CCC.

  • Why haven't gubbermints already gone the whole 666 route and forced us to get barcode tat's at birth? Being British I'm surprised the Blair government didn't suggest this instead of their failed ID card idea.
    • This has been considered in the US. We tried bar codes on a baby's backside. Unfortunately, with our average diet, the bar code expands in size exponentially over time requiring unacceptably large readers.
    • Why on earth would you need a bar code when your very DNA will suffice?
  • Whoever designed the system is terrible at computer science.

    These are home users, using a government provider scanner, and id card, and a key.

    Would be pretty easy to build a rootkit filter driver that steals the data off the card during legitimate transactions, along with a keylogger. At that point, you can pretty much remotely impersonate anyone whom you've rootkitted. Doesn't matter how secure the back end is because you can easily dupe the scanner side.

    Terrible, terrible design by idiots....you can't

    • Re: (Score:3, Insightful)

      by lennier1 (264730)

      You're talking about the same government whose politicians during the national election thought a mere DNS-based filter could stop the problem of child pornography on the net.

    • by Rakishi (759894)

      Exactly.

      The minimum proper security required for home computer use is something like an RSA key. An even more secure method has each action validated by the card (ie: for a bank, enter transaction amount on card's keypad, enter confirmation number in webpage.).

  • by jwiegley (520444) on Thursday September 02, 2010 @01:29PM (#33454734)

    When the hell are security "professionals" going to wake up and realize that secure access to something requires three items: identification, authentication and authorization. You CANNOT store the authentication credential with the identification. It is 100% stupid to store the pin on the identification device. Authentication credentials and authorization decisions must be kept by, and made by, the service provider. The only item that should be left with the consumer is an identification badge.

    For instance, a national "ID Card" is actually a good thing IF the only thing it has stored on it or about it is the owners identification, i.e. name and unique ID number. The ONLY thing the card should provide is a way to contact a national database/server which requires two things, the unique, public ID number from the card and a fingerprint (which is NOT stored or printed on the card in any way). The ONLY information the server should return is "Yes" or "No". But see... the fingerprint cannot be stored on the card in way for the same reason that the pin in the post should never be stored on the card. If somebody other than the legitimate owner comes into possession of the card then he possesses both the identification AND the authentication pieces of the puzzle and can do whatever the legitimate owner was authorized to do.

    Security: it's simple. f*cking learn it.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      The PIN is not stored on the card. The whole summary is quite misleading.

      - This is not about extracting information from the ID card (be it PINs, finger prints or whatever)
      - it has nothing to do with the RFID chip

      What the CCC demonstrated is that, by typing your PIN on your PC keyboard, it can be logged by a key logger if your PC is infected by such a program.

      The main problem is that the government wants to distribute "starter kits" with a simple card reader making use of the PC keyboard to enter the PIN. M

    • by wiedzmin (1269816) on Thursday September 02, 2010 @02:01PM (#33455364)
      Now if only security professionals were involved in making top-level (government) decisions, we'd be set. Unfortunately these are made by sales and marketing people - the solution that gets implemented is the one that 'wins the contract', not the one that works the best... unfortunately security professionals and technical people do not make best salesmen. All too often a contract is won because of a good game of golf, or a sexy slide deck.
    • Re: (Score:3, Interesting)

      by cdrguru (88047)

      Not entirely a bad idea, but the concept behind storing the information on the device itself is so that nobody except the owner has possession of it. And, in theory, every authorized agency has immediate access to the information if they have physical access to the device.

      The alternative is a massive database that virtually every government agency needs to access with everyone's information in it. Data mining that carries substantial risks but is an opportunity that just couldn't be denied. Also, because

    • by JimBobJoe (2758)

      But see... the fingerprint cannot be stored on the card

      Which naturally implies that you should do your best not to touch the card with your bare hands.

  • security experts have been telling them its shit and unsafe for years, but this is how lobby driven projects get pushed through. really a shame. and of course totally overpriced.
  • I guess that means the chipping of the populace just bit the dust.
  • Do the fingerprint scanners embedded into some phones and notebooks actually work well to secure them?

    • Re: (Score:2, Informative)

      According to Mythbusters (whatever you think of the show), getting a fingerprint is easy, and the scanners aren't that great at telling fakes from the real. You should watch that episode, it is quite revealing. The expensive scanner was worse than the one build into the laptop.

      So, I wouldn't count on that to secure your Laptop/Phone.

  • It ist sehr gut to see you Herr Gates - your ID ist in order und your private jet ist fueled und ready now.

    Here ist the stack of gold coins you requested prior to takeoff.

    Haf a nice trip!

    Auf weidersehn ...

  • by Posting=!Working (197779) on Thursday September 02, 2010 @02:15PM (#33455592)

    "Meanwhile on Tuesday the Federal Office for Information Security (BSI) rejected the Plusminus' criticism of the new ID card. The agency's personal identification expert Jens Bender said the card was secure"

    It's not secure. They just hacked it without special equipment, they used the scanner that you provide. Saying it's secure in response just means you're

    Your ATM card doesn't have your pin on it. Neither does your credit card, or your student ID, employee ID, etc. unless someone really stupid designed the system. How does this get missed? Why are the fingerprint scans on there? Did more than one person look at the plan before they went ahead with it?

    This is one of the largest mind-blowingly stupid decisions I've heard lately.

    • by Peeteriz (821290)

      Your ATM card (any card of the currently used EMV chipcard standard) has knowledge of your pin embedded and can verify/authorize the PIN at an offline POS terminal without contacting the bank.

      • by b0bby (201198)

        Most American cards are just plain magstripes, EMV chipcards haven't taken off here.

      • This kind of large scale security fuckup has happened twice? Great.

        I'm glad we don't have EMV chipcards or offline POS terminals over here. If someone has your card, they have all the information they need to take all the money in your account. Might as well skip the bank & ATMs and just carry all your cash with you.

        How does this crap even get to the design stage?

        • by Peeteriz (821290) on Thursday September 02, 2010 @05:40PM (#33458394)

          It's far safer than magnetic cards; I've heard no fraud cases where the PIN has been successfully extracted from the chip or the chip data cloned - reading the chip's contents would generally be far more expensive than the maximum money limits on the card. Mag-stripe cards can be cloned by a cafe waiter or a tiny 10$ device hidden on an ATM and then your money used in any place that "verifies" only signatures.

          Also for the ID card - if it has some way to send the fingerprint data or encryption key outwards, then that is a design fuckup; but if it is only able to verify pin and sign message packets with the key if the pin is valid, and permanently erase the key if pin is entered wrongly a few times, then the security is quite adequate.

  • A card that contains a digital copy of large amount of personal and private information? Given to every person? What's the worst that could happen?
  • Actually ... (Score:2, Informative)

    by garry_g (106621)

    ... it's not the ID card itself they managed to hack, but a basic reader ...
    Germany planed on handing out free readers (something like 1 million of them) for the ID cards, enabling people to sign electronic messages and the likes ... Now, while the idea might sound good, they decided on giving out the cheapest kind of readers, which are basically JUST readers. They rely on the PC to enter the code for the card. This is where the attack was targeted - using some PC software, they managed to record the inform

  • the existence of the Crazy Chaos C Compiler

You might have mail.

Working...