Slashdot Log In
E-Passport Cloned In Five Minutes
Posted by
kdawson
on Sun Dec 17, 2006 08:50 PM
from the if-more-proof-were-needed dept.
from the if-more-proof-were-needed dept.
Last month a panel of EU experts warned that the e-Passport's security is "poorly conceived", and in fact a week later a British newspaper demonstrated a crack. Now another researcher has shown how to
clone a European e-Passport in under 5 minutes. A UK Home Office spokesman dismissed it all, saying "It is hard to see why anyone would want to access the information on the chip."
Related Stories
[+]
IT: RFID Passport Security "Poorly Conceived" 33 comments
tonk writes, "European expert researchers on identity and identity management summarize their findings from an analysis of passports with RFID and biometrics — Machine Readable Travel Documents or MRTDs — and recommend corrective measures that 'need to be adopted by stakeholders in governments and industry to ameliorate outstanding issues... By failing to implement an appropriate security architecture, European governments have effectively forced citizens to adopt new international MTRDs which dramatically decrease their security and privacy and increases risk of identity theft. Simply put, the current implementation of the European passport utilizes technologies and standards that are poorly conceived for its purpose.' The European experts therefore come to similar conclusions as the Data Privacy and Integrity Advisory Committee of the US Department of Homeland Security in a draft report, which seems to be delayed."
[+]
IT: British "Secure" Passports Cracked 305 comments
hard-to-get-a-nickna writes "The Guardian has cracked the so-trumpeted secure British passports after 48 hours of work:
'Three million Britons have been issued with the new hi-tech passport, designed to frustrate terrorists and fraudsters. So why did Steve Boggan and a friendly computer expert find it so easy to break the security codes?'"
[+]
Disabling the RFID in the New U.S. Passports? 294 comments
slashchuck writes "Along with the usual Jargonwatch and Wired/Tired articles, the January issue of Wired offers a drastic method for taking care of that RFID chip in your passport. They say it's legal ... if a bit blunt. From the article: 'The best approach? Hammer time. Hitting the chip with a blunt, hard object should disable it. A nonworking RFID doesn't invalidate the passport, so you can still use it.' While this seems a bit extreme, all indications seem to be these chips aren't very secure. How far will you go to protect or disable the RFID chip in your passport? Do you think such a step is necessary? Does anyone have an argument in favor of the technology's implementation here? "
[+]
IT: RFID Passports Cloned Without Opening the Package 168 comments
Jeremy writes to tell us that using some simple deduction, a security consultant discovered how to clone a passport as it's being mailed to its recipient, without ever opening the package. "But the key in this first generation of biometric passport is relatively easy to identify/crack. It is not random, but consists of passport number, the passport holder's date of birth and the passport expiry date. The Mail found it relatively easy to identify the holder's date of birth, while the expiry date is 10 years from the issue date, which for a newly-delivered passport would clearly fall within a few days. The passport number consists of a number of predictable elements, including an identifier for the issuing office, so effectively a significant part of the key can be reconstructed from the envelope and its address label."
This discussion has been archived.
No new comments can be posted.
E-Passport Cloned In Five Minutes
|
Log In/Create an Account
| Top
| 259 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Well then, (Score:5, Insightful)
(http://rtfm.insomnia.org/~qg/ | Last Journal: Wednesday November 16 2005, @07:11AM)
Re:Well then, (Score:5, Insightful)
Re:Well then, (Score:4, Interesting)
(Last Journal: Sunday February 18 2007, @11:40AM)
But isn't the whole point of a secure passport to secure the identity of an individual? If the identity is not secure, we may as well not waste the time or money.
Tin foil hats, everyone (Score:5, Insightful)
(http://en.wikipedia.org/wiki/User:H2g2bob)
Such ID numbers already exist (Score:4, Insightful)
(Last Journal: Sunday February 18 2007, @11:40AM)
Your birth certificate number could be read as CN.DN.cert-number. You have a social insurance number, social security number, or equivalent. You are numbered by your driver's license, your chequing account, your power bill, and a host of other unique identifiers.
I have no objection to SECURE identification. I object to wasting billions on useless crap.
Yes, but not co-ordinated like this (Score:5, Insightful)
Yes, governments have databases about the citizens of their countries, for tax purposes, medical purposes, driver licensing and so on. That in itself is not unreasonable, as long as the data collected is necessary for the purpose, properly and securely handled, with suitable checks made on those with access to it and confidentiality maintained.
The National Identity Register in the UK, however, will combine most of the existing government databases into a single, centralised point of failure. In practice, it will likely be the case that most government departments and many outside agencies will have access to all of the records about an individual, not just those they have reason to see.
A second major concern is that the NIR will track every time it is checked. That won't help with the identity theft problem that follows from the above, unless the security of access is near-perfect across many thousands of people with access to the database. It will, however, mean that once the national ID card becomes the "easy option" for identity verification, the government has a handy record of each citizen's entire life: where they shop, which financial services they've been using, jobs they've been applying for, where they've travelled and who with, etc. There is simply no need for any state organisation to keep this sort of information about any citizen, other than when conducting legitimate surveillance of a suspect for genuine security purposes, with independent oversight.
Identity thieves, however, already happy to be part of the fastest-growing and most profitable crime wave in recent history, have hit the jackpot. Just along the Slashdot front page from this story as I write this, there is another article estimating that 100 million personal information leaks have occurred within the past couple of years or so. If that combination isn't reason enough to stop the NIR plans right now, I don't know what kind of sanity prevails in the government's universe.
Re:Well then, (Score:5, Insightful)
(http://photo.net/photos/swillden | Last Journal: Wednesday July 19 2006, @01:42PM)
Stronger than that, the data on the chip is digitally signed, so even if you can tracelessly replace the chip in the passport with a different one that has the photo you want, you're not going to be able to generate the appropriate digital signature for the altered data. This technology makes the passports effectively unalterable, as long as the chip is intact.
Not exactly. To read the passport data you have to have the authentication key. To get the authentication key, you need to have the passport, because the data that the key is derived from is printed inside. Note, however, that it has been shown that a large enough portion of the printed data is guessable, given basic information like the passport holder's name and a guess at his or her age, that the rest can be brute-forced pretty quickly. So there *is* a possibility it could be read without the owner's knowledge, but it's not completely trivial and does require some additional information.
The US has addressed this issue by putting a shielding mesh in the passport cover, which isolates the chip when the cover is closed.
Re:Well then, (Score:5, Insightful)
Passport cloning isn't even the primary security concern here. Cloning a passport has become no harder or easier thanks to RFID. But Identity theft will become much much easier.
Can I zap it? (Score:4, Interesting)
(http://www.seanadams.com/)
Couldn't one kill the RFID chip by putting the passport in a microwave oven for a minute?
I can't imagine the rubber-stamper at immigration control not letting me through because he can't read my RFID tag... I'm sure a good percentage of non-zapped passports would fail to scan for one reason or another. If enough people did it, then they justn wouldn't be able to rely on them, period.
Re:Can I zap it? (Score:5, Interesting)
(http://www.alioth.net/ | Last Journal: Friday November 09, @03:53PM)
You make the invalid assumption that people at immigration desks are reasonable people - they are *not*. Some of them are little Hitlers with bad attitude, and the ones who aren't have their hands tied by the law - they have no discretion at all. If the law says you can't enter without a working chip, the immigration officer (even the world's friendliest and most reasonable one) has no choice but to deport you. Just as they would deport you if your passport photo was mutilated.
(I'll make one exception for the little Hitlers - one notable aberration is Houston's immigration desks - those people are polite and make you feel welcome to the United States - truly refreshing to get to an immigration desk where it isn't just stony faces and demands to see that you have a return plane ticket. I frequently travel through Houston and they've always had good people there. Dallas Ft.Worth on the other hand - I will never travel through that airport again).
Re:Can I zap it? (Score:4, Insightful)
What will happen if my Electronic passport fails at a port-of-entry?
The chip in the passport is just one of the many security features of the new passport. If the chip fails, the passport remains a valid travel document until its expiration date. The bearer will continue to processed by the port-of-entry officer as if he/she had a passport without a chip.
Re:Well then, (Score:5, Insightful)
(http://www.geocities.com/zemran | Last Journal: Friday November 07 2003, @06:07AM)
Just like it is hard to see why anyone would want to blow up an aircraft? I think that people are still thinking within the sandbox and not realising that the real risk is what we have not yet thought of. There will be lots of reasons to want to access the information and to change it or learn to create false IDs that Joe Average security assumes to be valid because it is state of the art.
Re:Well then, (Score:5, Interesting)
It's a common failure that occurs in these scenarios.
As part of my research on driver's licensing issues, when states added photos to driver's licenses (starting in the late 60's) the word "fraud" never entered the picture. Driver's licenses were essentially fraud free documents before the photographs were added--so it really never entered anyone's mind that things would change once the document became more powerful/useful/trusted.
Re:Then why put it on? (Score:5, Insightful)
(http://www.faqs.org/rfcs/rfc3675.html)
Was the Home Office spokesman an idiot? (Score:5, Insightful)
(http://www.saynotocrack.com/ | Last Journal: Friday February 09 2007, @03:02AM)
Something is just wrong with the UK's Home Office. Today I read that they will now classify panty theifs as sex offenders [sundaymirror.co.uk], receiving the same long-term classification on the sex offenders' registry as child abusers, rapists, and child pornographers.
Re:and if your name is written on said panties (Score:5, Funny)
(Last Journal: Monday November 21 2005, @12:24AM)
ob Simpsons:
Skinner: Oh, it's a miracle no one was hurt.
Otto: I stand on my record - fifteen crashes and not a single fatality!
Lou: Let's see your license, pal.
Otto: No can do. Never got one. But, if you need proof of my identity, I wrote my name on my underwear... Oh wait, these aren't mine!
Skinner: Well that tears it! Until you get a license and wear your own underwear, mister, you are suspended without pay!
Re:Was the Home Office spokesman an idiot? (Score:5, Funny)
Thank God stealing a bra is still ok...I was worried for a second there.
Re:Was the Home Office spokesman an idiot? (Score:4, Funny)
(http://www.the-h.net/)
Re:Was the Home Office spokesman an idiot? (Score:4, Insightful)
Re:Was the Home Office spokesman an idiot? (Score:5, Insightful)
Re:Was the Home Office spokesman an idiot? (Score:4, Insightful)
Says who? You? Heck, why don't we start arresting people for thought crimes, then?
In a nation of laws, people get punished for what they actually do, not for some prediction of what they might or might not do in the future. Apparently, you prefer to live in a totalitarian nation, in which the state can charge anybody with absolutely anything if they just so please.
Re:Was the Home Office spokesman an idiot? (Score:5, Insightful)
Only a tiny fraction of the people who are being branded second class citizens for life, and being subjected to a lifetime of harrasment and violence at the hands of vigilantes, did anything remotely like rape or molestation. Most commited only voluntary, consentual sex acts with people their own age.
Sex offender lists, and their sister paranoia law enforcement, Do Not Fly list, are part of our societies current irrational, paranoid, fear of boogie men - being afraid of sex offenders or terrorists depending on where you live and your political beliefs. Personally, I am far more disturbed by the people who believe their friends or neighbors are all devious sexual preditors lurking to rape their kids - If anything I would be far more worried about the guy who is constantly paranoid of sex offenders (ala Mark Foley), than I would the college football players who get arrested doing a panty raid on the girls sorority. Or I would be far more frightened of the people who think everyone named "Mohammed" may be a terrorist, than I would be of someone named "Mohammed" sitting next to me on a plane.
Maybe read Author Miller's "The Crucible" ( http://en.wikipedia.org/wiki/The_Crucible [wikipedia.org] ) to get a good idea of the sort of Moral Panic ( http://en.wikipedia.org/wiki/Moral_panic [wikipedia.org] ) our society is in today.
In other news, bureaucrats develop sentience (Score:5, Insightful)
(Last Journal: Thursday October 12 2006, @05:21AM)
into place will steadfastly deny that anything is wrong until they are forced to do so, as agreeing that those are
potentially high security risks would otherwise equate it with having to backtrack on what they previously approved,
even though they were amply forewarned by many in the security-related field.
It's really about not losing face at any cost, lest people start questioning other methods they employ.
Human nature, really. Look no further than the voting machines controversy for parallels here in the US.
Z.
At least they can publish this... (Score:5, Interesting)
Thanks to a software he himself has developed, called RFdump, he downloads the passport's data onto his computer and then onto a blank chip.
How long would it take for some 3 letter agency to show up at their door in the US?
completely ignores the point (Score:2)
(http://simon.oconnorlamb.com/)
Even if the info on the chip is just the same as what's printed in plain sight as they say... it's still defeating one of the security measures in short shrift. How is that not a concern? The fact that the electronic portion of it can be read and copied without actually needing the item (just need to be near it) is a great concern.
Also, the article states that the key to some encrypted information on the chip is something that's printed, in plain sight, on the passport... oh man.
It's a scary world when those who are old and have little clue about technology (the politicians) are told they need a high tech solution to a security issue. They hear a buzzword (RFID) and tell their people "Get something that used RFID into market STAT!"
Plus, I bet they don't even know what STAT means.
Re:completely ignores the point (Score:5, Insightful)
Careful. The hippies used to complain about how all the old farts in power didn't have a clue back then. Now they're running things, and look where we are. I shudder to think about what the world will be like when it's YOUR turn...
Open Rights Group - Biometric passport (Score:5, Informative)
(http://www.openrightsgroup.org/)
This is all FUD (Score:2)
(http://www.bobpitch.com/)
The point of the RFID passport et al is to be able to verify it's genuine. You wave the passport at a border, it summons the electronic version and a check can be made that they match - i.e. verifies that somebody hasn't inserted an alternate photo etc.
If the RFID is just containing a serial number - then why not just use a barcode etc. If passport is broadcasting full details including photos, then the crack that's interesting is if somebody concocts their own passport - and then gets it recognized as a fully signed valid one.
Seeing as most passport fraud is just a genuine one, obtained by a similar looking (or even using the photo of the person going to use it), non-travelling person - then all these schemes are pointless. The weakest link is right at the start with the passport application process. The person who issues your passport hasn't got the slightest clue who you are - and as passports by their very definition are international, if you have trouble getting one in one country, you can just try from another.
huh? (Score:5, Insightful)
(http://my.voyager.net/unicycle)
If no one would want to access that information, then why is it on the chip? Why even bother with the chip? Why even bother with the information?
Could someone address the points raised? (Score:1, Interesting)
2. If the passport page contains anything useful, how easy or difficult will it be to get hold of this information? Can you stand next to someone in a queue and scan the passport in their carry bag, or do you actually need to hold it close? My ID card at work has an RFID chip, that works only at about 4cm.
3. Is it correct that forging RFID passports will be more difficult? Obviously, if you used to have to manufacture a passport or switch a picture, and you now need to _both_ do that _and_ insert or change an RFID chip, then that raises the bar. So the followups to this question are;
3a. Will passport controls be replaced by RFID scans, or in addition to? I would hardly think the former, but please inform.
3b. Is it possible to change the information on an RFID chip without actually having physical access to the circuitry? As in, are there read/write scanners so you can avoid having to manufacture a chip and replacing it in a passport?
If the answers to these are no, difficult, yes, in addition to and no/no, then I can certainly see it providing additional security. And vica versa. Someone in the know?
And the problem is... (Score:3, Interesting)
Cheers,
-b.
Breaking news... (Score:1)
If this happened in the 3rd world... (Score:2)
"What do you expect?" "It's the 3rd world."
They need more "technical assistance" from us who are more developed.
But I am not surprised, after all the US, which is the "most technically advanced" country in the world, cannot secure its borders. But is it?
The Solution is Obvious (Score:5, Funny)
(http://www.geekazon.com/)
why indeed? (Score:3, Insightful)
a simple way to correct cluelessness (Score:3, Informative)
(http://killpeople.com/breathe/)
I think it's time someone cloned his passport and got busted importing drugs or weaponry or child porn or similar while on that passport. Hell, he's probably got a diplomatic passport == no search. Pure gold to anyone wanting to move anything *really* profitable.
yes minister ... (Score:1)
This answer "...it's hard to see why...." is a line right out of this show. It doesn't say that the information is worthless, nor does it criticise e-passports for being insecure. Instead it says that the spokesman found something (irrelevant) hard to imagine. That's something completely different.
A masterpiece of misdirection, IMHO and just illustrates how hard it is to get a straight answer out of the b@$+@%ds
6 years ago... (Score:1)
Tinfoil (Score:2, Informative)
(http://erroraccessdenied.com/)
BRB, I'm making a tinfoil hat for my passport, so it matches mine.
encrypted data is printed on the passport anyway (Score:1)
The proper response is... (Score:5, Insightful)
(http://www.silverglass.org/)
The proper response to that spokesman is "Well then, you won't mind lending us your passport for a minute, so we can copy it and put copies on sale in <district with notorious reputation>, will you?".
Some politicians simply need the problem made their personal problem before they'll see it.
Shielding? (Score:1, Interesting)
How about a switch (Score:2, Interesting)
I can't imagine it being that hard in theory, although divising a reliable and rugged switch may be a bit more challenging.
Still, I bet it could be done, and it pretty much eliminates all the concerns about people reading the chip without your permission.
Imagine this scenario (Score:2)
(Last Journal: Monday January 02 2006, @01:32PM)
Alternatively, imagine a government putting monitoring devices in public places, or at the entry ways to residential buildings, and tracking when/if people of certain profiled countries are congregating.
The technology makes be feel assured (Score:2)
What I worry about is a working hack that allows people to insert a different photograph into the information on the chip. There is not border guard in the world who will reject a passport if his electronic scanner shows the photo of the person standing in front of him.
In the "old days" a passport could have had a new photo glued over the top. These could be spotted and rejected. Any new hacks that had a glued-over photo that corresponded with the pic in the RFID chip, would be far less likely to be picked-up. Guards would believe it, because the technology would convince them the passport was genuine.
In any case, we may get to the situation where nobody would look anyway. I came through the gates of Melbourne Airport in Australia a few days ago with my ePassport. I was told by a border guard that soon I would be able to "check myself in" using the passport, without needing to see a border guard.
Identification isn't the problem. (Score:3, Insightful)
(Last Journal: Sunday November 05 2006, @05:31AM)