Slashdot Mirror
Buffer Overflow Found in RFID Passport Readers
epee1221 writes "Wired ran a story describing Lukas Grunwald's Defcon talk on an attack on airport passport readers. After extracting data from the (read-only) chip in a legitimate passport, he placed a version of the data with an altered passport photo (JPEG2000 is used in these chips) into a writable chip. The altered photo created a buffer overflow in two RFID readers he tested, causing both to crash. Grunwald suggests that vendors are typically using off-the-shelf JPEG2000 libraries, which would make the vulnerability common."
With closed source protected access software this kind of thing would not happen.
The open source commie pig brigade can't go messing with your plans.
(tongue in cheek of course)
liqbase
Nothing to see here, please move along
These passports are full featured CPU's with up to 72KB of data. The "RFID reader" is actually a very bad name for a software system that is going to read out these passports. In most documents it will be referred to as an inspection system. It will not only read out the passport, but it will also test the biometrics, communicate with other systems etc.. This is a complicated process that will most likely take place on a full featured CPU, containing a modern OS, and a modern software stack. This allows for maximum flexibility, but it will also make the systems vulnerable for attack.
The only thing the manufacturers of these systems can do is thoroughly test their software, and make the attack possibilities as small as possible. For instance, they should check the signature under the data before passing the data on to the next layers. Of course, for this you need the certificate of the issuing state. You should also test if the underlying libraries that do this initial check are not vulnerable.
The question is : should I study Arabic or Spanish to welcome our new overlords.
Explain to me how this is an "attack" on passport readers?
Passport is scanned
Reader goes casters up
Reader is power cycled
Passport is scanned again
Reader goes casters up
Owner of said passport is hauled off to some secret room where all of their orifices are checked by an ex-prison guard with large hands.
This does show the lack of testing and hardening, but it seems a buffer overflow situation like this would be relatively easy to patch.
...if you pass a cracked RFID chip through a passport reader and then it crashes,
#1: the guard will humanly read your inside cover photo with extra vigilance...the chip is not the only method of ID
#2: you'll probably be detained for a bit while they re-test your passport; if it fails again, they'll tell you to get a new passport
(#2a: or be placed on a no-fly list, because you're a terrorist)
Plus, how exactly would a code-injection exploit work unless it's something like the GDI+ vulnerability that occurred with WMF files? (If a rogue guard is injecting evil code into the machine, the government had waaay more scary problems ahead than with some 'sploiting a passport reader).
All that being said, there are some things (i.e. voting machines) that just should not be electronic-ized, and I feel this is one of them.
Other than "it'll get you through faster!!", what is the point of using chips when, more than likely, the passport clerk has to humanly-read it to verify the info anyway? Especially considering that the particular RFID chip technology used in the passport is going to be obsolete or cracked in 3 years, and most passports don't expire for five or ten years?
It's not that RFID passports are a bad, insecure idea. It's just that they keep hiring complete morons that have no idea what they're doing to work on the systems. You know, kinda like voting machines.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
FTFA: "If a reader could be compromised using Grunwald's technique, it might be reprogrammed to misreport an expired passport as a valid one, or even -- theoretically -- to attempt a compromise of the Windows-based border-screening computer to which it is connected."
That does it. From now on I'm only travelling to countries which use OpenBSD to operate their border gateway protocols.
And: "Additionally, the International Civil Aviation Organization recommends that issuing countries protect biometric data on the e-passport with an optional feature known as Extended Access Control, which protects the biometric data on the chip by making readers obtain a digital certificate from the country that issued the passport before the equipment can access the information."
Sounds like in the future, the only people who'll be able to traveler with any degree of success will be those who can forge their passports...
Remember this /. story about RFID Passports Cloned Without Opening the Package? I'm not sure if RFID and security will ever get along at a satisfying level or if will be similar to the systematic breaking of DRM locks. Amongst other RFID stories, this "Security analysis report" paper [91 pages pdf, 967k] is most informative (via this blog).
Animoog.org
Why am I not surprised?
"That does it. From now on I'm only travelling to countries which use OpenBSD to operate their border gateway protocols." - by adnonsense (826530) on Saturday August 11, @10:55AM (#20195319)
Cambridge Researcher Breaks OpenBSD Systrace:
http://it.slashdot.org/it/07/08/09/138224.shtml
Nothing's "completely invulnerable"...
Something else to make the experience of flying all that much more unpleasant for the rest of us!
The game.
Buffer overflows are so 90s. Isn't there a way to prevent them entirely, like using only good libraries?
How did they expect something that is to be valid for 10 years to remain technologically impregnable? I think the RFID chips have been in US passports for what, 2 years now, and significant inroads are already being made into their innards. Glad I've still got a few years left on my "old skool" passport while they possibly find a better solution. On a similar note, why's everyone up in arms about Real ID? They say it's a national ID card...um, so just what the hell is a passport?!
The problem is, as usual, the use of inherently unsafe and dangerous programming languages like C and C++.
There is no reason why any modern programming language should permit accidental buffer overflows; they are easily preventable without pushing the burden onto the programmer even in programming languages with the same power as C and C++.
'k, I'm staying at home from now on...
When it comes to counting voter-verified paper ballots, I would agree with you that this task should not be done electronically. Humans can (and do in many elections around the world) manually count voter-verified paper ballots.
But when it comes to preparing the voter-verified paper ballot, I don't see the harm with electronic assistance: electronic preparation & verification of voter-verified paper ballots is a serious advantage for blind and illiterate people to vote in private. The computer reads the candidate list aloud over headphones and the voter can press buttons to indicate their vote. This vote is printed on the ballot. All voters can use electronic devices to read the voter-verified paper ballot to double-check what the ballot says or bring in someone they trust to verify the ballot with them. Of course any electronic preparation or assistance must be optional for all voters.
All ballots should be voter-verified and on paper so they can be stored and recounted whenever anyone wants.
Champaign County in Illinois, USA uses a pair of ES&S machines to prepare and count (plus store) the ballots. Use of the ballot preparation machine is optional—one can fill in the bubbles manually with a pen or pencil. This machine can also (again, optionally) scan a completed ballot and report to the voter how it read the ballot (informing the user of how that user voted, and any over/undervotes). But all voters must feed their voter-verified paper ballot into the counting+storage machine. I despise the use of the second machine. I also despise that both of these machines run on proprietary software; some citizens in Urbana, Illinois are fighting for instant runoff voting for local elections and they have quite a fight ahead of them trying to convince the proprietor (ES&S) to change the vote-counting software to work with instant runoff. This is one reason I endorse the use of free software. Urbana ought to have the freedom to get whomever they want to alter the software to their liking. Urbana can pay to send their modified software through the government-required approval process.
Digital Citizen
``Grunwald suggests that vendors are typically using off-the-shelf JPEG2000 libraries, which would make the vulnerability common.''
Because everybody knows that, had they written their own code, it would have been much more secure. Just like magic.
Please correct me if I got my facts wrong.
They-reboot-it-after-each-customer?
Yeah BUT .. there is something the makers of compilers could do (if they wanted to thoroughly distinguish their product from all the others) - and that is to have the ability (if told to do so) to insert the necessary code to automatically handle data overflows the right way (and every programmer worth their salt knows what that is).
I always check all inputs before using the data. Don't other people do that?
Undressing in front of the uniformed agent, undergoing endoscopy with low-bid lubricant, then going through the rotating-brushes Lockheed Martin AlloScrub body wash to remove all possible caches and residues of others' DNA before having the blood draw, is the highlight of any ordinary business trip. The $635 airport security fee is a bit of a burden, though, as are the 12 hour fast and prep. enema.
Waiting 24 hours for DNA sequencing results, in the departure hall with monopoly $3.75 bottled water, $9 greenish-ham sandwiches, Soviet-grade customer service, and incessantly repeated shrieky PA announcements, always makes me feel good because I am doing my part for national security.
Eventually however, I might have to face the question of efficiency, and be compelled to move to some other country where I can inch through massive traffic congestion, then pay a fixer to have me waved into the squalid and grimy departure hall for a mere 2 hours, while watching the unsmiling gentlemen with the submachine guns make their frequent rounds. This followed by very close scrutiny of the rubber stamps on incomprehensible forms stamped only 45 seconds earlier by the person one floor below, as my luggage was being X-rayed to make certain that I was not trying to dodge both the stiff export tax on livestock and poultry, and the consequent opportunity to make a "facilitating payment".
... if you are being so open about it.
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..