Slashdot Mirror
Hackers Clone Passports In Driveby RFID Heist
pnorth writes "A hacker has shown how easy it is to clone US passport cards that use RFID by conducting a drive-by test on the streets of San Francisco. Chris Paget, director of research and development at Seattle-based IOActive, used a $250 Motorola RFID reader and an antenna mounted in a car's side window and drove for 20 minutes around San Francisco, with a colleague videoing the demonstration. During the demonstration he picked up the details of two US passport cards. Using the data gleaned it would be relatively simple to make cloned passport cards he said. Paget is best known for having to abandon presenting a paper at the Black Hat security conference in Washington in 2007 after an RFID company threatened him with legal action." Apparently this is a little unfair — he sniffed the data, he didn't actually make a fake passport.
Jules Verne called, he wants his time-machine back.
Dupe story:
http://it.slashdot.org/article.pl?sid=09/02/02/2224255
----- The internet has given everyone the ability to have their voice heard equally as loud.. even if they shouldn't be
Some sort of Faraday Cage will block RFID, or at least their power supply. I do not know whether ferromatnetics like iron and steel are more effective than non-magnetics like aluminum.
The summary clearly says:
During the demonstration he picked up the details of two US passport cards. Using the data gleaned it would be relatively simple to make cloned passport cards he said.
Anyone with even minimal English fluency would understand this as saying that he collected the data but didn't do anything with it.
We don't even need an automotive analogy, since the data was collected from one car by reading passport RFIDs in other passing cars.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
The Passport Card comes with a protective sleeve lined with foil on the inside designed to prevent such an intrusion.
Per usual, security usually fails because of the user.
"When you see a unixer brainwashed beyond saving, kick him out of the door." - Xah Lee
I was going to post this too. A simple solution would be to make a passport holder that blocked the RFID signals, that you could purchase if you wanted to be sure your details weren't being scanned from afar.
Thinkgeek actually makes a passport holder that blocks RFID signals. http://www.thinkgeek.com/gadgets/security/910f/
A cellphone has a powered transmitter, and a boosted receiver with a specialised antenna. An RFID chip must rely solely on the radio energy it receives to power itself up and transmit back, so I'm not sure that a cellphone is an adequate test.
The signal power you're talking about for a phone is going to be so much higher, and likely at totally different frequencies.
I think the only way to test it effectively would be to see if the RFID reader at the airport still works with the wallet, assuming the person working the desk doesn't mind you testing it out.
if it's RFID then the speed of the sources shouldn't really matter all that much. You're not going to get much doppler shift on a source moving 70mph.
It pays to be obvious, especially if you have a reputation for being subtle.
Just replying to confirm that the ThinkGeek wallets DO, in fact, work as advertised. I realized this after trying to leave my office's parking lot by fruitlessly waiving my newly-acquired RFID-blocking wallet (with parking pass inside) at the entry gate's sensor.
I always keep my passport on me. I've stuck some plastic tinfoil (use an emergency blanket) inside the wallet pocket where I keep the passport.
Note that you're talking about something completely different.
The US passport CARD is different from the passport BOOK which you use in international travel. The passport card only works when traveling between the US and Canada or Mexico; it's not accepted anywhere else.
If your passport BOOK is a US-issued one, you don't need the tinfoil because it's already built into the cover. Even if it weren't, the BOOK requires a cryptographic authentication using a key derived from data printed on the inside of the book, so someone has to either see the inside of your book or guess the data.
The CARD does not require cryptographic authentication and has no closeable cover.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Why not just use a smart card similar to the Common Access Card (CAC) used by the U.S. Department of Defense [wikipedia.org]? Those things can store a lot of data, are very easy to use, and cannot be hacked remotely via RFID equipment.
The chips in passport books (not cards) ARE the same sort of device that's in the CAC. The old CAC cards are contact-only, which doesn't work well for a passport book because it would be difficult to build a reader. The CACs are being replaced by PIV cards which are dual-interface (contact and contactless).
Other than the contact vs RF interface, though, these so-called RFIDs in passport books (not cards) are exactly the same sort of technology as CAC cards. The chips have plenty of storage and provide cryptographic authentication capabilities.
It appears that a different, longer-range technology with no cryptographic authentication requirements was used for the passport cards.
Don't get one. Get a passport book. It costs a little more, but it can be used for visiting countries other than Canada and Mexico, and it doesn't have these security issues.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Why make up a story title whose claims are unsupported by TFA? Nothing was 'cloned' here.
The cloned chip article is here;
http://www.rsa.com/rsalabs/staff/bios/ajuels/publications/EPC_RFID/Gen2authentication--22Oct08a.pdf
It was on pasport and Washington Driver license chips.
The truth shall set you free!
It's absolutely worth noting this is about cloning US Passport Cards, which are completely useless outside the US, not real passports.
Passport Cards use a simple RFID system (EPC) where the chip simply spits its ID number out.
Passports, on the other hand, require a reader to authenticate by passing a hash of (passport number, date of birth, date of expiry). I don't think that's nearly enough information to ensure security, but at least it's better than nothing.
A Faraday cage, must totally enclose the device, i.e. no magnetic flux lines can leave the cage, and terminate outside the cage.
so unless you have a tiny phone I doubt a wallet was designed to totally contain an object the size of a phone
I always thought of Creationism as the Raving Right's version of the Loony Left's Anthropogenic Global Warming-brightmal
this kind of technology makes people and their information LESS secure, rather than more. Because it makes it far too easy to read someone else's information and clone it.
The RFID Nazis will be quick to tell you that there is also a unique encryption key in the passports, but as has been pointed out elsewhere, only 5 of the 45 signatory nations supply their keys to the international database, and as long as any of those 45 nations fail to do so, the keys are meaningless because it is possible to clone passports from any of the non-compliant nations.
And we KNOW that it is possible to physically duplicate passports effectively... after all, that was the justification for using RFID in the first place. So that isn't an argument.
You may not even have to find someone who looks all that similar. My husband and I just got our passports renewed and the new "theft prevention" measures makes id'ing someone by the photo difficult. There are so many wavy multicolored lines over the picture that it is very difficult to make out any distinguishing features. We can barely recognize ourselves.
Don't anthropomorphize computers. They *hate* that.
Assuming the document ID (any identifiable string) can be determined at a distance, yes.
There are two solutions to this. The first is the fact that the RF technology used by these chips does not work well at long ranges. In lab environments it's possible to get distances of up to a meter, but in the real world the limit is around 10 cm, assuming nothing is between card antenna and reader antenna (and assuming reader antenna is a high-gain type). The super long-range stunts you read about use a battery-powered repeater placed within a few centimeters of the card.
Note that the above applies to the passport books. I'm not sure what the passport cards use, but it appears to be a different RFID technology which supports longer-range operation. It's highly likely that they also do not contain the same level of personal information that is in the books, simply because the 900 Mhz RFIDs (unlike the 13.56 Mhz contactless smart cards) don't provide the same storage capabilities.
The other solution is ATR randomization. When powered by the reader field the chip transmits an "Answer To Reset" which includes some unique identifying information. Many researchers have called on the ICAO to specify that this should be randomized, exactly to prevent the sort of thing you describe. Manufacturers produce chips that do randomization. AFAIK, the US state dept. is not yet using them, although it's not unlikely that within a few years there will be no chips on the market that do NOT randomize their ATRs.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.