New German Government ID Hacked By CCC 86
wiedzmin writes "Public broadcaster ARD's show 'Plusminus' teamed up with the known hacker organization 'Chaos Computer Club' (CCC) to find out how secure the controversial new radio-frequency (RFID) chips were. The report shows how they used the basic new home scanners that will go along with the cards (for use with home computers to process the personal data for official government business) to demonstrate that scammers would have few problems extracting personal information. This includes two fingerprint scans and a new six-digit PIN meant to be used as a digital signature for official government business and beyond." That was quick. Earlier this year, CCC hackers demonstrated vulnerabilities in German airport IDs, too.
OpenPGP (Score:5, Insightful)
Re:OpenPGP (Score:5, Insightful)
Keeping a copy of your private key *securely*. Yes, it's been amply demonstrated that nothing left under the control of the average user can be counted on to stay secure. And once someone else gets access to your private key, you're royally screwed.
Re:OpenPGP (Score:5, Funny)
Yes, it's been amply demonstrated that nothing left under the control of the average user can be counted on to stay secure.
It's because the "average user" has a girlfriend who can't keep a damn secret.
Luckily - we don't have that problem.
Re:OpenPGP (Score:4, Insightful)
Re: (Score:2)
Aren't girlfriends creatures of myth like Santa Claus, the Easter Bunny and Honest Lawyers?
And pumas. Don't forget pumas.
Re: (Score:1)
Sarge: What in Sam Hell is a 'Puma'?
Simmons: Uhh, you mean like the shoe company?
Grif: No. Like a Puma. It's a big cat, it's like a lion.
Sarge: You're making that up.
Grif: I'm telling you, it's a real animal.
Sarge: Simmons, I want you to poison Grif's next meal.
Simmons: Yes sir!
Sarge: Look, see these two tow hooks? They look like tusks, and what kind of animal has tusks?
Grif: A walrus.
Sarge: Didn't I just tell you to stop making up animals?!
Re: (Score:1)
Would you people please stop making up TLAs!?! WTF is RvB?!? Grumble, mumble, ...
Re: (Score:2, Insightful)
That's not an insurmountable problem, however. Indeed, it's more or less the same problem that any of these sorts of devices/designs (secure IDs) will face. Using asymmetric encryption just provides a better base. Also, the solution is already halfway complete:
http://en.wikipedia.org/wiki/Smart_Card#Cryptographic_smart_cards
Re: (Score:2, Informative)
Private keys have passwords which *should* protect the key if someone gets a hold your private key.
Ofc, if you're dumb enough to have no password or something that can easily be bruteforced, then it's your problem.
Re: (Score:2)
That is why I use eTokens for my PGP keys. I have mine configured so a few guesses will lock the user password, a few more will lock the admin password and render the data on the token permanently unusable unless someone has a chip fab with uncapping facilities at their disposal.
Trick is to have multiple tokens, and at least two keys. One key is generated on the token, and another key is copied onto all the tokens. This way, one can encrypt data with just the token-generated keys, as well as use the key
Re: (Score:3, Insightful)
Right, for the government to expect you to keep a number secure, knowing that if that number were exposed then someone could steal your identity, and to then rely on that number to identify and authenticate someone wishing to do business with them; that would be unthinkable.
Re:OpenPGP (Score:5, Interesting)
And once someone else gets access to your private key, you're royally screwed.
Royally screwed? I thought that's what key revocation was for. With PGP, you just revoke the old, generate a new key, and you are good to go from there on out. But how exactly do you revoke and reissue fingerprints?
Re: (Score:1)
Especially with your fingertips cut off.
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Even smartcards, which never expose the private key are at risk. If you have a compromised computer, someone can remotely use your smartcard whenever its inserted into the machine. Even hardware tokens with changing values are at risk to a keylogger and a script that fires off before the toekn pin changes.
It all boils down to the fact that if the computer isn't trustworthy, then anything you put in the computer is at risk.
Re: (Score:1)
In support of the parent post: can you even trust your own hardware? I remember a recent story on Slashdot regarding some common computer hardware (a video or a network card) had its firmware infected with a trojan. And even more recently, a company accidentally released a software update that was infected with a virus (the machine they used to compile was infected, so the compiled .exe got infected as well).
Re: (Score:2)
The system is not completly trivial, but it is not exactly rocket science either...
Re: (Score:1, Interesting)
But that would mean there had to be a central database containing the fingerprints and identities of all citizens.
Isn't that exactly what people are trying to avoid?
Re: (Score:2)
PGP not a panacea (Score:4, Insightful)
Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure.
An imperfect systems can still be useful. If card/scanner misuse is on the order of handwritten signature misuse then replacing dead trees with some bits might be a good idea in many situations.
The pgp digital sig proves it was sent by your computer perhaps, but not necessarily sent by you. There is a genuine need for biometrics to be involved. Note that a handwritten signature is a form of biometric ID and like the card/scanner system it can be faked. This is why for more important situations a signature must be witnessed and possible notarized. The card/scanner system can similarly escalate the process for more important situation. For example when someone uses a bank's ATM a swipe and a pin are sufficient. When they walk up to a teller for larger transactions then a swipe and a pin could be augmented with a photo being displayed on the teller's screen. Banks often have such photos for embedding into ATM and credit cards.
Re: (Score:3, Informative)
The pgp digital sig proves it was sent by your computer, or any other digital device in the universe that has a copy of your key , but not necessarily sent by you.
FTFY.
Re: (Score:2)
Even better, why not go to a true PKI infrastructure?
User gets a smart card, the government certifies the smart card is his/hers, and other authorities sign certificates relating to that person (like the person graduated, is over the age of 21, is able to drive, is not a felon, etc.) For things like criminal record status, those certificates could be SLCs refreshed daily or hourly (which is better than worrying about a CRL mechanism.)
Lost smart card? The user previously saves a revocation certificate whic
Re: (Score:2)
It is not possible because then the government would not be able to forge authentication in your name when needed. It is the same reason security certificates must be centrally managed.
Alle Ihre Passe sind gehoren uns (Score:3, Funny)
Alle Ihre Pässe sind gehören uns
Yes, that is what you think it is: A corrupt translation of a corrupt translation.
Re: (Score:2)
I like how your translation preserves the bad grammar of the original.
three courses of action... (Score:5, Insightful)
1: fix the problems.
2: abandon the plan.
3: arrest the people who embarrassed you, suppress any mention of the incidents.
Hmmm... let's see...
Re: (Score:1, Informative)
4. Get it on an episode of Mythbusters...
That's basically #3, they'd just be censored instead of arrested, like that time with the credit cards.
Re: (Score:2)
Re: (Score:2)
1: fix the problems.
2: abandon the plan.
3: arrest the people who embarrassed you, suppress any mention of the incidents.
4: ???
5: PROFIT!
Re: (Score:2)
A sound har-de-har-har from me. (Score:1, Interesting)
But please do note that at least the Germans know how to do it thoroughly: They'd give you a home reader with it, so you can actually use that card and incidentally also see what's on it. Oh, and pwn the crap out of it, but that's courtesy the CCC.
6 digits but what base? (Score:1)
6 digit base 10 may not be secure.
6 digit base *number of characters in all of the alphabets known to man even after eliminating potential look-alike characters like "l" and "1" and multi-glyph characters like the Spanish "ch"* or some other big number might be.
Re: (Score:2)
They said 'digits', not 'characters', so it's generally safe to assume it's base 10. Either that, or somebody is an idiot. (which isn't that unlikely I suppose...)
Why haven't gubbermints... (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Well duh. (Score:1)
Whoever designed the system is terrible at computer science.
These are home users, using a government provider scanner, and id card, and a key.
Would be pretty easy to build a rootkit filter driver that steals the data off the card during legitimate transactions, along with a keylogger. At that point, you can pretty much remotely impersonate anyone whom you've rootkitted. Doesn't matter how secure the back end is because you can easily dupe the scanner side.
Terrible, terrible design by idiots....you can't
Re: (Score:3, Insightful)
You're talking about the same government whose politicians during the national election thought a mere DNS-based filter could stop the problem of child pornography on the net.
Re: (Score:2)
Exactly.
The minimum proper security required for home computer use is something like an RSA key. An even more secure method has each action validated by the card (ie: for a bank, enter transaction amount on card's keypad, enter confirmation number in webpage.).
Re: (Score:1)
I've often thought we should establish a standard where the keyboard of a desktop computer can be used as a smart terminal when doing secure transactions.
The keyboard manufacturers such as Logitech and Microsoft would build the basic carcass to match a standard and the regulatory authority would provide a secure plug-in encrypting module. When you flip a switch the the keyboard would turn into a smart terminal with a small LCD screen and the main computer would be relegated to a communications device.
Key
Ugh: Identification vs authentication (Score:5, Insightful)
When the hell are security "professionals" going to wake up and realize that secure access to something requires three items: identification, authentication and authorization. You CANNOT store the authentication credential with the identification. It is 100% stupid to store the pin on the identification device. Authentication credentials and authorization decisions must be kept by, and made by, the service provider. The only item that should be left with the consumer is an identification badge.
For instance, a national "ID Card" is actually a good thing IF the only thing it has stored on it or about it is the owners identification, i.e. name and unique ID number. The ONLY thing the card should provide is a way to contact a national database/server which requires two things, the unique, public ID number from the card and a fingerprint (which is NOT stored or printed on the card in any way). The ONLY information the server should return is "Yes" or "No". But see... the fingerprint cannot be stored on the card in way for the same reason that the pin in the post should never be stored on the card. If somebody other than the legitimate owner comes into possession of the card then he possesses both the identification AND the authentication pieces of the puzzle and can do whatever the legitimate owner was authorized to do.
Security: it's simple. f*cking learn it.
Re: (Score:2, Informative)
The PIN is not stored on the card. The whole summary is quite misleading.
- This is not about extracting information from the ID card (be it PINs, finger prints or whatever)
- it has nothing to do with the RFID chip
What the CCC demonstrated is that, by typing your PIN on your PC keyboard, it can be logged by a key logger if your PC is infected by such a program.
The main problem is that the government wants to distribute "starter kits" with a simple card reader making use of the PC keyboard to enter the PIN. M
Re:Ugh: Identification vs authentication (Score:5, Insightful)
Re: (Score:3, Interesting)
Not entirely a bad idea, but the concept behind storing the information on the device itself is so that nobody except the owner has possession of it. And, in theory, every authorized agency has immediate access to the information if they have physical access to the device.
The alternative is a massive database that virtually every government agency needs to access with everyone's information in it. Data mining that carries substantial risks but is an opportunity that just couldn't be denied. Also, because
Re: (Score:2)
But see... the fingerprint cannot be stored on the card
Which naturally implies that you should do your best not to touch the card with your bare hands.
lobby+bigmouthed politicians (Score:1)
Your papers, please. (Score:2)
Phone/Notebook Fingerprint Scanners? (Score:2)
Do the fingerprint scanners embedded into some phones and notebooks actually work well to secure them?
Re: (Score:2, Informative)
According to Mythbusters (whatever you think of the show), getting a fingerprint is easy, and the scanners aren't that great at telling fakes from the real. You should watch that episode, it is quite revealing. The expensive scanner was worse than the one build into the laptop.
So, I wouldn't count on that to secure your Laptop/Phone.
Ve are happy to see you, Herr Gates (Score:1)
It ist sehr gut to see you Herr Gates - your ID ist in order und your private jet ist fueled und ready now.
Here ist the stack of gold coins you requested prior to takeoff.
Haf a nice trip!
Auf weidersehn ...
Government's reply: Stick Head in Sand (Score:3, Interesting)
"Meanwhile on Tuesday the Federal Office for Information Security (BSI) rejected the Plusminus' criticism of the new ID card. The agency's personal identification expert Jens Bender said the card was secure"
It's not secure. They just hacked it without special equipment, they used the scanner that you provide. Saying it's secure in response just means you're
Your ATM card doesn't have your pin on it. Neither does your credit card, or your student ID, employee ID, etc. unless someone really stupid designed the system. How does this get missed? Why are the fingerprint scans on there? Did more than one person look at the plan before they went ahead with it?
This is one of the largest mind-blowingly stupid decisions I've heard lately.
Re: (Score:2)
Your ATM card (any card of the currently used EMV chipcard standard) has knowledge of your pin embedded and can verify/authorize the PIN at an offline POS terminal without contacting the bank.
Re: (Score:2)
Most American cards are just plain magstripes, EMV chipcards haven't taken off here.
Re: (Score:2)
This kind of large scale security fuckup has happened twice? Great.
I'm glad we don't have EMV chipcards or offline POS terminals over here. If someone has your card, they have all the information they need to take all the money in your account. Might as well skip the bank & ATMs and just carry all your cash with you.
How does this crap even get to the design stage?
Re:Government's reply: Stick Head in Sand (Score:4, Informative)
It's far safer than magnetic cards; I've heard no fraud cases where the PIN has been successfully extracted from the chip or the chip data cloned - reading the chip's contents would generally be far more expensive than the maximum money limits on the card. Mag-stripe cards can be cloned by a cafe waiter or a tiny 10$ device hidden on an ATM and then your money used in any place that "verifies" only signatures.
Also for the ID card - if it has some way to send the fingerprint data or encryption key outwards, then that is a design fuckup; but if it is only able to verify pin and sign message packets with the key if the pin is valid, and permanently erase the key if pin is entered wrongly a few times, then the security is quite adequate.
Hmmm. (Score:1)
Actually ... (Score:2, Informative)
... it's not the ID card itself they managed to hack, but a basic reader ... ... Now, while the idea might sound good, they decided on giving out the cheapest kind of readers, which are basically JUST readers. They rely on the PC to enter the code for the card. This is where the attack was targeted - using some PC software, they managed to record the inform
Germany planed on handing out free readers (something like 1 million of them) for the ID cards, enabling people to sign electronic messages and the likes
they firmly denied (Score:2)