Slashdot Mirror
Hackers Clone Passports In Driveby RFID Heist
pnorth writes "A hacker has shown how easy it is to clone US passport cards that use RFID by conducting a drive-by test on the streets of San Francisco. Chris Paget, director of research and development at Seattle-based IOActive, used a $250 Motorola RFID reader and an antenna mounted in a car's side window and drove for 20 minutes around San Francisco, with a colleague videoing the demonstration. During the demonstration he picked up the details of two US passport cards. Using the data gleaned it would be relatively simple to make cloned passport cards he said. Paget is best known for having to abandon presenting a paper at the Black Hat security conference in Washington in 2007 after an RFID company threatened him with legal action." Apparently this is a little unfair — he sniffed the data, he didn't actually make a fake passport.
Jules Verne called, he wants his time-machine back.
Dupe story:
http://it.slashdot.org/article.pl?sid=09/02/02/2224255
----- The internet has given everyone the ability to have their voice heard equally as loud.. even if they shouldn't be
The RFID is the most important part. Check the rest of the web for more info.
Never trust a man wearing a coat and tie!
Recall the man who made his own airline tickets
not all that long ago?
Recall the sh*t storm that brought about ?
Folks are learning the best way to keep the
lawyers and police off their back is to prove
the point, but don't go as far as producing any
thing illegal.
Some sort of Faraday Cage will block RFID, or at least their power supply. I do not know whether ferromatnetics like iron and steel are more effective than non-magnetics like aluminum.
The summary clearly says:
During the demonstration he picked up the details of two US passport cards. Using the data gleaned it would be relatively simple to make cloned passport cards he said.
Anyone with even minimal English fluency would understand this as saying that he collected the data but didn't do anything with it.
We don't even need an automotive analogy, since the data was collected from one car by reading passport RFIDs in other passing cars.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
The Passport Card comes with a protective sleeve lined with foil on the inside designed to prevent such an intrusion.
Per usual, security usually fails because of the user.
"When you see a unixer brainwashed beyond saving, kick him out of the door." - Xah Lee
I was going to post this too. A simple solution would be to make a passport holder that blocked the RFID signals, that you could purchase if you wanted to be sure your details weren't being scanned from afar.
As a very frequent traveller, (including to some fairly scary places), I always keep my passport on me. I've stuck some plastic tinfoil (use an emergency blanket) inside the wallet pocket where I keep the passport. Works a treat. Why do this, well:
1. FTA:
Using the data gleaned it would be relatively simple to make cloned passport cards he said. Real passport cards also support a âkill codeâ(TM) (which can wipe the cardâ(TM)s data) and a âlock codeâ(TM) that prevents the tagâ(TM)s data being changed.
However he believes these are not currently being used and even if they were the radio interrogation is done in plain text so is relatively easy for a hacker to collect and analyse.
2. What information can they get? Well, depending on the passport type, at least your picture, and sometimes your fingerprints too.
See:
http://en.wikipedia.org/wiki/Biometric_passport
And all this while you are having a drink at a roadside café with your passport 'safely' in your pocket...
Thinkgeek actually makes a passport holder that blocks RFID signals. http://www.thinkgeek.com/gadgets/security/910f/
Of course he only sniffed the data and didn't make a fake passport.. If merely sniffing the data proves your point, why would you subject yourself to penalties for forgery ?
I certainly would have stopped at successfully sniffing the data. besides all a terrorist has to do is rig the bomb so it will automatically go off when it detects a pre-specified number of US RFID passports in the vicinity.. Now, don't you feel that RFID in your passport has made you more secure ?
far...out
Imagine how easily US Citizens can be found in a crowd. I wonder if the RFID "lighthouse" in my passport will put me at a higher risk than other nation's citizens?
Wow, they moved on from cloning RFID tags to cloning
tags!
The information he read was from an EPC Class1 Gen2 encoded UHF tag. It was encoded as a Global Document Type Identifier (GDTI-96). The Company Prefix is 0893599002, and the Document Type is 1. The serial numbers of the documents are there, but I'm not going to post them. I don't have access to the GS1 Company Prefix database, and it's not searchable here. - anyone else have those mappings?
It is trivial to program an arbitrary tag ID into a blank Gen2 tag - I do it all the time wrt DOD-encoded tags.
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
What is the point in putting RFID into passports other than to make them easier targets for cracking?
Why not just use a smart card similar to the Common Access Card (CAC) used by the U.S. Department of Defense? Those things can store a lot of data, are very easy to use, and cannot be hacked remotely via RFID equipment.
I have a bad feeling about this...
Security doesn't fail because of the user; if the user is getting it wrong then it is bad security. Theoretical security is (in principle) not hard. Practical security is very hard indeed, and easy to get wrong. Is there any reason this card needs RFID as opposed to a standard credit-card style chip which requires physical contact?
[FUCK BETA]
I always keep my passport on me. I've stuck some plastic tinfoil (use an emergency blanket) inside the wallet pocket where I keep the passport.
Note that you're talking about something completely different.
The US passport CARD is different from the passport BOOK which you use in international travel. The passport card only works when traveling between the US and Canada or Mexico; it's not accepted anywhere else.
If your passport BOOK is a US-issued one, you don't need the tinfoil because it's already built into the cover. Even if it weren't, the BOOK requires a cryptographic authentication using a key derived from data printed on the inside of the book, so someone has to either see the inside of your book or guess the data.
The CARD does not require cryptographic authentication and has no closeable cover.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
It's also important to note that real U.S. passports actually have shielding (effectively, a Farraday cage) built into the covers so that the RFID chip is only able to be powered and transmit when the passport is opened.
I use irony whenever I can, but my shirts are still wrinkled...
Quite. And in a more general sense: Can (we) geeks in general PLEASE stop referring to users as "stupid" simply because they are NOT AS DEEPLY INTO THE SAME SHIT WE ARE?! I'm highly intelligent (recorded IQ over 160), and frankly, I HAVE OTHER STUFF ON MY MIND when I'm traveling (like "Where's the freakin WC?", and "After 19 hours in the air, I'm hungry and tired and miserable."). For dear FSM's sake, if there is anything wrong with security design -- or product design in general -- all over the Earth it is this same ignorant, even STUPID, attitude on the part of the designers.