Chipped Passport Cloned In Minutes

Death Metal Maniac writes "New microchip passports designed to be foolproof against identity theft failed the test when a researcher was able to manipulate one in minutes. The cloned passports were accepted as genuine by the computer software recommended for use at international airports. According to the article: 'A computer researcher cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber. The altered chips were then passed as genuine by passport reader software used by the UN agency that sets standards for e-passports.'"

Comments

Um, well...

[superphreak]

Is anyone surprised? At all? Seriously...

Re:Um, well...

[kingtonm]

The sad thing is, that as someone who has never been to the US and who can't see myself travelling frequently I don't want to have to pay for a poorly design or implemented system which my government might wind up relying on for things that actually do matter to me.

Re:Um, well...

[DrLang21]

I recently had a conversation at work about security issues. The fact is that any security system can be beaten. You can keep trying to make it more and more difficult to beat, but at some point you just have to decide that it's good enough. At the same time, you don't want your security to be so over the top that it is either prohibitive such that people are encouraged to find a work around, or it's just plain ineffectual. Adding chips to passports isn't a bad idea (if they actually put enough security in them to make it prohibitive to emulate), but it's not a replacement for old fasion visual inspection.

Re:Um, well...

[Swizec]

At the same time, you don't want your security to be so over the top that it is either prohibitive such that people are encouraged to find a work around, or it's just plain ineffectual.

Oh you mean like DRM? Prohibitive and ineffectual never stopped corporations before, why would it the government?

Re:Um, well...

[kingtonm]

Hang on a minute, so what they're really saying is that the mechanism for distributing peoples public keys and the trust around those keys so signatures could be verified. So if people aren't in the chain of trust then it doesn't work, that implies not a problem with the technology but the environment where it's being implemented. That affects our trust of the issuers outside the web and consumers outside the web of passports issued inside the web.

That implies it's sociopolitical not technological.

Re:Um, well...

[jimicus]

I recently had a conversation at work about security issues. The fact is that any security system can be beaten.

I have a variation on that.

The only 100% guaranteed secure computer system is one that's been pulverised into little shards of metal and encased in concrete.

Re:Um, well...

[Hal_Porter]

This is more like PGP signing. DRM has a flaw in that the user must be able to decrypt so the decryption key must be available. PGP signing is much more secure since you only need to know the private key if you sign. Verifying is done with the public key which is not secret.

The passport contains data - name, address, photograph (and in future fingerprints and retinal scans). When the passport is made this data is digitally signed with the private key in some secure system.

There is a trust chain from the per country CSCA (Country Signing Certificate Authority) down to the DS (Data Signers) down to the passports.

See here, page 13
http://www.rfidsec07.etsit.uma.es/slides/present/slides-1.1.pdf

In the UK as far as I know there is only one DS, the Foreign and Commonwealth Office even for passports issued overseas (I got mine renewed from a non biometric one in Stockholm and the issuer is still marked as FCO not British Embassy Stockholm). So to check the trust chain you need the public keys for the CSCA and the DS that made a passport. The article says that "But only ten of the forty-five countries with e-passports have signed up to the Public Key Directory (PKD) code system, and only five are using it." But elsewhere it says "Some of the 45 countries, including Britain, swap codes manually, but criminals could use fake e-passports from countries that do not share key codes, which would then go undetected at passport control". True, but if you used a clone British Passport anywhere with access to the shared keys it will be caught if you don't know the British private CSCA key. And any country that doesn't share it's public key could be threatened with being dropped from visa waiver programs, so it's fair to assume that given time they all will. Any country who leaked their private key could be handled the same way.

As someone commented to the article

Seemingly Mr Van Beek created only a copy of personal data with fake certificates, keys and signatures to fool only the reader he was using. In real life if he could have been able to put the chip into a real passport control systems where data is checked against the CSCA and DS certificates he would have been arrested at the same moment.

The problem with not having a PKD is that people who don't have access to manually swapped public keys cannot verify the passport. But I bet the scanners in airports do. Installing 45 CSCA keys, one per country, and one or more DS keys per country is not very hard to do.

I actually wonder how serious this is - of course a faked passport will not be detected by software that cannot verify the trust chain. The systems at airports can do this from what I've read.

Re:Um, well...

[conspirator57]

FWIR about 1/3 of Iran's population is blonde haired and blue eyed. The Caucuses mountain range (from which we get the term Caucasian) is partly in Iran. So if Iran or part of their population (the government) is evil that whole profiling thing starts to not work real fast.

How about the government leaves us alone and sees to its actual responsibilities and, oh i don't know, obeys its own laws and attempts to embody American ideals? Just a suggestion.

Re:Um, well...

[Jah-Wren Ryel]

I actually wonder how serious this is - of course a faked passport will not be detected by software that cannot verify the trust chain. The systems at airports can do this from what I've read.

Identity Shopping.

The process of finding a cryptographically secured ID of someone else that is "close enough" to pass visual inspection. No key swapping required.

The passport contains data - name, address, photograph (and in future fingerprints and retinal scans).

The day when real biometrics are included on passports is a long way off, and honestly I hope it never comes - but even if it does, the birthday problem will be enough to enable identity shopping.

Furthermore, rfid based passport data can be snooped from a relative distance, attempts to build a faraday cage into the cover are a colossal fail. Put a snooper in a doorframe somewhere high-traffic - like a touristy shopping area - and you can record the data of every passport that walks through, yielding thousands of potential identities to shop from every day.

Re:Um, well...

[bigstrat2003]

Really, this lets the gov't track the millions of people who use passports easily but has no effect on criminals or those NOT from the USA. Personally I'd be more worried about the 20-something male muslum flying in to the US and then around from city to city than grandma taking a vacation to canada which now requires a passport. Yes, it's profiling. But when was the last time someone's mid-western 68 year old white grandmother went on a shooting/terror spree?

I dunno, personally, I don't want government-sanctioned racism. But that's just me.

Re:Um, well...

[retupmoca]

Maybe it is, maybe it isn't - have you actually *seen* this mod point?

Embarassing, but not suprising

[Anonymous Coward]

It shows the benefit of this kind of outside security analysis, which should have probably been executed during the development process.

Better the issues be uncovered now than when the issuance is widespread.

There's always a loophole.

Electronic voting's cousin?

[Porchroof]

Are these electronic passports related to electronic voting?
It's becoming obvious that low-tech paper is preferable in both elections and passports.

Re:Electronic voting's cousin?

[pha7boy]

It's becoming obvious that low-tech paper is preferable in both elections and passports.

yes, cos god knows, paper passports were NEVER falsified.

Re:Electronic voting's cousin?

[DNS-and-BIND]

Mayor Daley and JFK would like a word with you. Or heck the PRI in Mexico stole elections for 90 years using nothing but paper ballots. Pretending that paper is somehow better is folly.

Re:Electronic voting's cousin?

[AGMW]

Pretending that paper is somehow better is folly.

Hmmmm. OK, but the corollary may well be that pretending something other than paper is any better is also folly!

As some other poster says above, you want a level of security that makes it sufficiently difficult for joe-public to not think about trying to beat it, but not so intrusive as to adversly affect people's lives too much in day-to-day use.

All the claptrap and palaver to do with air travel goes too far down the "intrusive" side of things, without actually offering any greater level of security (hence the term Security Theatre). The attempt to track every individual using ID cards, etc, is also too intrusive, and just as ineffective - whereas a simple chip containing a picture which is displayed when the passport (or credit card) is put into a reader would allow a human to easily compare the picture with the person and thereby foil most of the casual passport/credit card fraud.

Finally, you have to recognise that you CANNOT completely stop people from doing bad things and to think you can will lead to the 1984-type society that most right-minded people fear is where we are going already!

Re:Electronic voting's cousin?

[LaminatorX]

Sucessful paper forgeries are usually more time consuming to create, and require skills that are less common in this day and age.

Or another way, a forged passport is one forged passport. A broken authentication system is a thousand forged passports.

Re:Electronic voting's cousin?

[cmat]

As an aside, there is a parallel between pictures on ID and encryption: A picture on an ID allows me to verify that you look exactly like the guy on the ID (for various definitions of "exactly"), and symmetric encryption allows me to be fairly certain no one is listening in on a communication (assuming protected keys, sufficient key size, etc). But neither allow me to KNOW who you are or who I am communicating with. In other words, both systems fail at authentication, which is, in the end, what passports are trying to provide, and many people think encryption provides.

Re:Electronic voting's cousin?

[sa1lnr]

Customs don't get humour anywhere.

You Can't Say They Don't Have a Sense of Humour

[segedunum]

Come up with a lame technical 'solution' to identity theft to help stop the completely over-hyped global terrorism threat, and then make the whole thing even easier by allowing easy cloning of existing passports. Be in several places at the same time! All you need is one loophole and it propogates.

Additionally, I see no improvements to the initial checking of who is eligible for a passport to try and sort out the Day of the Jackal fraud:

http://en.wikipedia.org/wiki/The_Day_of_the_Jackal

Using some form biometric system that seems to be implicitly trusted is even more dangerous, since if you can get your bogus identity trusted then people aren't ever going to question it.

Technology cannot overcome human ingenuity

[erroneus]

...at least not human technology.

Without exception, everything we try to lock up with a key can be unlocked by someone else. I'd like to hear it from anyone else that they recognize the fact that locks only keep honest people out and then perhaps we can move on to the bigger issue of why they are trying so hard to control honest people.

Re:If one man can do it...

[Lumpy]

Sounds great, You're in charge to get all the countries in the world to agree to this.

How about an easier task, convince all countries to agree that one server somewhere is where all their trust of their passports is placed.

Really simple. you should have that done by the end of this week right?

Re:If one man can do it...

[MrMickS]

Of every passport holder in the world at all airports and processing it in real-time? At present I can get a same day passport by visiting the passport office and then use that passport to leave the country on that day. That's some pretty high powered, resiliant, system that you've got to do that. Not to mention that its got to be run by governments that all have to trust each other with the information not to mention privacy issues.

Anyone thinking that this system has a chance of faultless working once you go from design to implementation is a little naive. The theory is simple. In practice its just not going to work.

If you still believe this is possible I've something else that might interest you. I've a formula for turning base metals into gold. If you could just help fund me industrialising it you'll make a tidy profit.

Securtity is not a product

[DragonHawk]

So the chip itself hasn't been cracked, it's more a question of the international passport encryption network being worthless.

Technically accurate. But. The chip by itself is worthless. It's only worth something if it counters some kind of threat. This is why security isn't about products or techniques, it's about working systems. If the "chipped passports" don't have a working PKI, then there's really no point to the chips. They go together.

ObQuote: "Security is a process, not a product." -- Bruce Schneier

Re:Take a hammer to it...

[c1t1z3nk41n3]

Congratulations. You've created yourself a 6 hour delay and interrogation. At the end of it you'll simply be fingerprinted again and forced to pay for your new passport. I don't think the kind of semi-passive resistance you're advocating really works here. Though I still kind of like the idea I just find it hopeless.

Re:It can be done

[caluml]

Just a few years ago, the same USA demanded that ALL passports to be used while entering the USA had to be machine readable and it is the case now.

And from the people I speak to, lots of people aren't visiting the US due to all the information that the US requires, and the way they're treated at Immigration. Read some of the comments in this, and this, or this.
Yep, I can guess your response: Well don't come here then, we don't want you anyway.

Re:Take a hammer to it...

[sukotto]

Apathy: one of the greatest gifts you can give a tyranny.

Um, yes....

[Joce640k]

History tells us that cryptography usually falls down in implementation, not theory. As soon as you start building networks, selling chip readers, issuing passports then your theory starts to slowly crumble.

Even if the whole chain of trust is perfect it only takes one act of stupidity/corruption by a human to bring the whole thing crashing down.

Passports are also one of the worst possible places for security to fail. Passports, passport readers, etc. can't be updated via a patch, they need to be thrown away and replaced.

The technology for this is in its infancy and rushing out hundreds of millions of passports at an international level is doomed to failure.

I'm sure it won't stop philistine politicians from trying though - after all, it's not their money they're flushing.

Re:Um, yes....

[Joce640k]

Passport readers can be patched up to a point but a lot of them use tamper-proof chips and firmware which complicates things.

If they make it easy to change a passport reader's firmware then it's just another point of attack for the bad guys to inject bad code.

Re:Misleading info?

[kegon]

Now I could be wrong, but I thought all the 9/11 bombers were legally allowed to be where they were, and were using valid documents?

Why let the truth get in the way of a good wheeze to spend more money watching your citizens ?

My understanding is that most Muslim suicide bombers carry correct ID with them so that they can be properly identified for the sake of their families and martyred. I never understood the draw of spending eternity with 72 virgins - don't they quickly become uh non-virgins ?

Re:Misleading info?

[hughk]

Where did you here that? I understand that all the hijackers were 'white' travelling on their own non-terrorist identities. Yes, some had been flagged as suspicious (Mohammed Atta, I believe) by the Germans but this was ignored.

Remember that the British 7/7 bombers were British. the only possible red flag was the visit to Pakistan, but many do that legitimately.

Re:Take a hammer to it...

[doojsdad]

Apathy: one of the greatest gifts you can give a tyranny.

"Lethargy [is] the forerunner of death to the public liberty." --Thomas Jefferson to William Stephens Smith, 1787.

Re:I want one!

[Zenaku]

I would carry my secret data on it. The border agents might take my laptop, cellphone, music player, and perhaps my pants, but hopefully they will leave me my passport.