Slashdot Mirror
Hackers Clone Elvis' Passport
Barence writes "Hackers have released source code that allows the 'backup' of RFID-protected passports, although the tool can potentially be used to create fake or cloned documents. The Hacker's Choice, a non-commercial group of computer security experts, has released a video showing a cloned passport being approved by a security scanner at a Dutch airport. When the reader scans the passport, it is revealed to belong to one Elvis Aaron Presley, complete with picture. Reports of the hackers serenading security staff with 'Are You Clonesome Tonight' are unconfirmed."
Elvis has left the building
I am not stubborn. I am right!
That little problem goes right away... just add "Elvis Aaron Presley" to the no-fly list.
We is all secured again, and permanently this time!
Won't work. Elvis is everywhere
The 4 hour stop at security would be really hilarious...!
Personally, I'd be rather careful when it comes to ID fraud... Don't want to end up doing the Jailhouse Rock
"I don't know half of you half as well as I should like, and I like less than half of you half as well as you deserve."
I dare anyone to fake the ID of Osama Bin Laden and try to get to the US.
Love many, trust a few, do harm to none.
This "hack" just worked because scanner they used to validate the passport permitted self signed certificates.
Of course, it is good to show that scanners must be properly configured to be any good.
Please remove your blue suede shoes.
Comment removed based on user account deletion
You can't clone Elvis' passport; They didn't have access to the original.
They created a passport with fake details which matched the identity of another person. Nothing was cloned. I bet it wasn't even his passport picture, but a stock photo from the web.
Finally had enough. Come see us over at https://soylentnews.org/
I have no idea what kind of console that is, but it doesn't look like much of a "security console" to me.
This movie only shows that they have succesfully created a cloned passport, and that the scanner does not do any security checks. This was already demonstrated some time ago at a local town hall.
Doing this again at an airport adds nothing but hype. It does not prove that security in those things is broken.
Don't worry, it's all just 1's and 0's anyway...
"Never let a computer do a job that can be done by a human."
I just can't agree with this.
People can be fooled easily enough and the more that's automated properly the better. A human(well thousands of them) *could* do all the interest calculations at your bank but it would be stupid to do it that way.
There are loads of jobs out there which are better done by machines.
Hahahahahahahahahahahahahahahaha! Hahahahahahahahahahaha!
Of course we already knew, when U.S. passport encryption was broken in all of 2 hours, that this was inevitable.
And the government did it all in the name of more "security".
But as we know, it is actually less freedom, and LESS security. This is just more proof.
This isn't a security scanner anymore than the previous scanner he checked out at his local Govt building - in fact it's probably nearly the same damned thing! This is simply a device that is showing the data on the chip - I'm not convinced that it is doing ANY security checks that a "real" security scanner would do. How smart would it be to put a machine out with the same checks as a security portal to allow counterfeiters to practice on? Umm, Duh?? Cloning easy, modifying of data NOT!
Yes, the data has been modified and the signature broken, it remains to be seen what the scanner will do when it sees a broken signature or self signed cert on the passport. As was explained in the talk at BH SOME countries HAVE exchanged PKI information so at least some countries ought to be aware of what the signature SHOULD look like and SHOULD be able to spot fakes. It's also not clear that modifying the security file on the passport to change what security protections it reports isn't going to be spotted either since passing THAT information is also possible. Lastly, passing trusted PKI around need not actually take place - if I see 500 German passports who ALL have the same PKI signature and 1 that doesn't it's a pretty good bet that the *1* has an issue! No secret squirrel passing of certificates required in that case.
Bottom line is - no one knows exactly what the various security stations will actually check for and how closely they really follow the lax security of the Gold Disk standard that much of this presenters testing was based off of. The only way to know any of this is to attempt to USE one of these or get the Govt's to talk - what are the chances of THAT?!
So, interesting demo but I'm not convinced it proves that fake passports with *modified* data can be made. At least some better understanding of how the data is being stored and interacted with has occurred I'd say...
Build it, Drive it, Improve it! Hybridz.org
For conspiracy theorists: Elvis' middle name was Aron, not Aaron, right?
Wikipedia says "Presley's genuine birth certificate reads "Elvis Aaron Presley" (as written by a doctor). There is also a souvenir birth certificate that reads "Elvis Aron Presley." When Presley did sign his middle name, he used Aron. It reads 'Aron' on his marriage certificate and on his army duffel bag. Aron was apparently the spelling the Presleys used to make it similar to the middle name of Elvis' stillborn twin, Jesse Garon. Elvis later sought to change the name's spelling to the traditional and biblical Aaron. In the process he learned that "official state records had always listed it as Aaron. Therefore, he always was, officially, Elvis Aaron Presley." Knowing Presley's plans for his middle name, Aaron is the spelling his father chose for Elvis' tombstone, and it is the spelling his estate has designated as the official spelling whenever the middle name is used today. His death certificate says "Elvis Aron Presley." This quirk has helped inflame the "Elvis is not dead" conspiracy theories."
sarchasm: The gulf between the author of sarcastic wit and the person who doesn't get it.
Some of you may feel this is not "newsworthy", but this illustrates a very important point. Lets look at the whole voting machine mess. The machines were CERTIFIED by the States they were used in. That means that the certifying body agreed that they met all requirements. Yet, once hackers found all of the security flaws in the system, the voting machine manufacturers were "lynched" in the court of public opinion. Lets look at the whole financial mess we are in. The Federal Government is paid by taxpayers to oversee our economy. They failed miserably at this task, and now are trying to saddle taxpayers with the burden of fixing the mess. Ultimately, our Government and the Governments of other nations approved this RFID Passport System...a system which was, at least in part, intended to address security concerns. Now that it is coming out that this too is a failure DUE TO A LACK OF OVERSIGHT AND ACCOUNTABILITY AT THE GOVERNMENT LEVEL, who is going to be blamed this time? Security experts have nearly exhausted themselves trying to get the message out about a lack of security in RFID Passports (and other RFID systems), but are all but ignored. Ultimately, we are all getting what we deserve, because we are simply allowing those we have put in charge of assuring our well being to fail over and over again, and we simply foist the blame on everyone else but those we have employed to prevent these messes from happening. WAKE UP SHEEPLE !!!!
Actually, even cloned passports are an issue. They're just one you can't do a lot about very easily.
They're an issue because if you can find someone who looks vaguely like you and clone their passport with or without their cooperation, you can assume their identify. Just alter your features a bit from what is in the picture. If they have medium-long hair, get a buzz cut. If they have no facial hair, grow a bear, mustache. Or vice versa. This is especially effective if you are in a minority in the country you are using the passport, as the "they all look alike" effect will carry you very far. For extra measure you can practice forging their signature.
Yes, it's a less effective exploit, but one that is a lot harder to guard against. Even if you put more biometric data in the passport like fingerprints, retinal scans or even DNA, the realities of passport processing lines make it unlikely you will be caught.
Because passport data is supposed to be read by foreign authorities. Or would you vote for a big worldwide database containing all humans passport data, and accessible by every gouvernment of the world?