Slashdot Mirror
UK National ID Card Cloned In 12 Minutes
Death Metal writes with this excerpt from Computer Weekly, which casts some doubt on the security of the UK's proposed personal identification credential: "The prospective national ID card was broken and cloned in 12 minutes, the Daily Mail revealed this morning. The newspaper hired computer expert Adam Laurie to test the security that protects the information embedded in the chip on the card. Using a Nokia mobile phone and a laptop computer, Laurie was able to copy the data on a card that is being issued to foreign nationals in minutes."
I just can't wait for national ID cards here in the States! It'll be great for plausible deniability: "Oh, you say you saw ID? Prove it was really me."
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
I think that will boost Nokia sales in the UK!
http://www.automatiq.se
With these things, that if it can be read by a device, then it can be broken. All that differs is how long will it take to break it..
People Talking in Movie shows.. people smoking in bed.. people voting republican.. GIVE THEM A BOOT TO THE HEAD!
Just ban cell phones and laptop computers!
I bet they head-hunted members of the Windows XP team to implement this in the UK. That can't be a coincidence. Great move guys...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Guess they got spent a bit longer on the security aspect than most Government IT projects then.
I unfortunately read the article...
He then created a cloned card, and with help from another technology expert, changed all the data on the new card. This included the physical details of the bearer, name, fingerprints and other information.
Lets hope this puts the final nail in the coffin for this stupid idea.
Sig (appended to the end of comments you post, 120 chars)
Actually, TFA is a post on Computer Weekly, who read the Daily Mail so you don't have to.
So, no, it is actually pretty bloody scary, as they successfully changed the biometrics of the copy.
'If Christ had tweeted the sermon on the mount, it might have lasted until nightfall.' - John Perry Barlow
If it's digital, exact copies are possible.
If it's digital, because of the convenience, analogue security measures will be taken less seriously.
If it's digital, uninformed politicians will think it cool, and believe in it like some do in 70 virgins.
If it's digital, the process is fast and can be automated, and the threat is increased a million-fold (out of arse, of course) by sheer statistics. We need slow electronics
If it's digital, tampering is undetectable.
Either way, this digitally secure ID thing can only lead to government saying: "Look! We've tried, and you also know that the only way to do this properly is to put you all in a database and track your every move."
Can we perhaps agree on forsaking digital security just because it's cheaper and faster in cases where we don't need it anyway (i.e. when people aren't up to no good)?
TFA says they managed to change the data on the card. It's still not clear if that is enough to make your own card or if it would fool a biometric scanner.
Biometrics are a terrible way to establish identity, which is why banks don't use them. Aside from the ease with which things like fingerprint scanners can be fooled, your biometric data can change (e.g. you burn your finger, loose and eye, get cosmetic surgery). That means there has to be a system for getting your card updated with the new data, and if such a system exists you can guarantee it will be open to abuse.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I work in the smartcard industry and most of the time those "breaks" mean nothing: usually the "hacker" simply reads the publicly available information and claims that the system is "broken". The reaction of the public is always interesting and shows that many users do not understand the goals of such a system, probably because the politicians that buy those systems do not explain them very well.
However in this case the article claims that they were able to clone the card AND modify the information in the cloned card, which is really the hack that those cards are trying to prevent. This article is heavier on details than many others and that makes it more credible, but the details are still muddy. I hope that the journalist missed a crucial point and that this card is not as insecure as he thinks.
Small-scale, private smartcard-based systems can be cracked, usually because they are badly installed and used. Large-scale, private smartcard-based systems can be cracked (just look into the MiFare Classic debacle) but it involves months of hard work from people with PhDs and access to expensive equipement. Large-scale, govermental smartcard-based systems can be cracked, but I would be really surprised if it took only a few minutes. Unless that hacker presents the attack in details, I will file this one in the "baseless fearmongering in order to sell more papers" folder (which is already bursting BTW).
Nobox: Only simple products.
If they had any sense whatsoever, all that data would be stored on the server and the card would simply have an ID number (and MAYBE a name) programmed into it. The fact that their system simply believes what's on the card and doesn't check a central database to make sure that the card hasn't been tampered with is just plain stupid.
So instead, they should trust the ID number? How is a number pointing to a block of data on a remote server is safer than the block of data itself? That's what credit cards are (they have a number in them, that ATMs and pay points check against the credit company's database), and this particular industry is rife with electronic fraud.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Oh, no doubt you can clone a new card with modified data. The real question is - can you get it to verify as genuine in Government readers now you've modified it? Unless the Government's really screwed up, the cards should have digital signatures, which means any unauthorised changes to the data will make them invalid. The Daily Mail article not only doesn't do a good job of addressing this issue, it fails to realise how significant an obstacle it is. I bet they only bothered to check the card in unofficial readers that don't verify anything...
My favorite part of this article, was the response by the officials. Excuse us we need time to come up with an excuse, err.. a response to these allegations. We could just say, "Yes we care about the protection of your identity, but first I need to doublecheck the validity of that statement. Thank you."
The system is perfectly safe ... just don't let your card out of your sight for more than 11m59s. Citizens do have to take some responsibility after all!
Storing a simple hash of the card contents with the hardcoded UID of the card and checking if they match when reading a card is enough to prevent any such attack. While you can copy the card and even change contents on it, it will never validate as an authentic card. Aside from that, smartcards have really gotten quite smart, as far as I know, there are no practical attacks against the newer MiFare cards(most hacks on Desfire or newer systems target the implementation of the system, not the cards themselves).
Unless there have been leeps and bounds in smart card technology in the past couple of years I think this is an overstatement. A few years back I made most my money buying blank smart cards, copying the information from the satelite TV smartcards, changing a few places in the hexidecimal coding, and selling full unblocked TV. Of course we would tell the user to remove the cards from the boxes at night when the companys would do system checks that fry any unauthorized cards. And the cost of such equipment, $49.95. Not expensive and on about average, 15 minutes of work. If the UK is using the same format, that would be a real easy "hack".
Unless the Government's really screwed up...
Let me guess - you're new, right?
Chuck Norris: Socialism == a thousand years of darkness.
Indeed. Please tag this story "DailyFail".
I've no grounds for arguing with the facts, and certainly agree with the disgust for these ID cards, but any story in the Mail that touches on "scrounging foreigners damaging our property values and insulting the sacred memory of Princess Di" is not to be trusted.
In other words, yes the government did really screw up.
On a side note, does slashdot have to link to a link to the article?
I must be new here...
Whilst this is a failure of some rudimentary security system that was supposed to protect the data stored on the chip, this is anot a cloned card per se.
The chips on these ID cards, and the new UK passports, are there to enhance the integrity of the DOCUMENT, not be secure stand-alone identifiers alone. For instance you can easily copy the data on a chip once the security has been defeated but to accurately copy the paper part of the document including the watermarks, UV sensitive fibres, holograms, raised ink, irridescent coatings, etc. takes a lot of time and effort that most people won't bother with. Some do bother as a lot of bent banknotes will testify to.
These cards like the passports SHOULD when tested/checked be read by a human being who knows how to check the security features (e.g running your fingers over the top of a banknote to check the raised ink), check the details and the photo are correct and do not seem to have been tampered with, then they can check that the data on the chip matches the data printed on the paper/plastic. If they match then there's a very high chance that the card/passport is genuine.
Just checking one portion rather than the other defats the purpose of these designs.
Weak systems will always be exploitable. UK Border Control staff/Police/Home Office drones need to know that that no document is unforgeable and to maintain the integrity of a system requires knowledge and training on the part of those who are attempting to enforce it.
Smokey, this is not 'Nam, this is bowling. There are rules.
In fact, the Daily Mail article says they used Jeroen van Beek's method of loading the card with data - however, the Wired article claims this is not actually what happens:
Unfortunately, a number of people have interpreted the Times story to mean that van Beek altered the data on a legitimate passport chip without it being detected. Englandâ(TM)s Home Office is among those who read it this way. The Office recently responded to the story by denying that anyone can change data on a passport chip without it being detected.
In fact, van Beek says he didnâ(TM)t change data on a passport chip.
"The Home Office has dismissed the report. "This story is rubbish. We are satisfied the personal data on the chip cannot be changed or modified and there is no evidence this has happened," said a spokesperson.""
http://www.theregister.co.uk/2009/08/07/id_card_hacked/
U+F8FF
And the government expert witness, on the goverment's payroll of course, will say the ID is nearly infallible and you'll end up in jail.
I think this is symptomatic of the biggest single problem with so many government powers.
Things will inevitably go wrong in any system as large and complicated as running a national government. This will be true even if everyone tries to be diligent and acts with nothing but good intentions. There is no point either pretending that this won't happen or pretending that it would be better if we dropped all government systems that could possibly cause such problems no matter how much good they might otherwise do.
However, there should always be a system in place that allows mistakes to be detected and put right quickly, and without making things any worse for the unlucky victim. This is particularly true in cases of mistaken identity or other factual errors, where the consequences might be anything from financial loss such as being denied benefits or overtaxed, through loss of reputation and all the damage to relationships and career that might entail, right through to violent arrest and detention (or worse).
As a declaration of interest, I am particularly sceptical about any claims relating to ID, because I was once overtaxed significantly due to a case of mistaken identity at a government tax office. It was bad enough that I was left short of money to pay my rent without warning, but even worse that it took nearly three months and a huge amount of effort on my part to get it put right, and I never received so much as a real apology or full explanation afterwards. I can forgive a data entry error by someone who's probably earning near the minimum wage and typing hundreds or thousands of these numbers every day. I can't forgive a system that damages me for months afterwards because it can't acknowledge that it made a mistake.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Did you read the page you linked to? It says:
'In Hiibel v. Sixth Judicial District Court of Nevada , the Supreme Court upheld state laws requiring citizens to disclose their identity to police when officers have reasonable suspicion to believe criminal activity may be taking place. Commonly known as "stop and identify" statutes, these laws permit police to arrest criminal suspects who refuse to identify themselves.'
http://www.knowmyrights.org/faq/4th-amendment/when-do-i-have-to-show-id.html
We send people to death row on little more than unreliable eye witness testimony
We do?
The US does. The Innocence Project has proven the innocence or had arranged the pardon of 4 people this past week. Ernest Sonnier had been in prison 23 years for rape when a DNA test cleared him. A report on the lab that originally ran tests that was used to convict him "details dozens of testing errors and questionable practices uncovered at the Houston lab." I don't recall if it was Alabama or Louisiana but one of them had a problem with an investigator, he had been caught manufacturing evidence. In one case though though he had been caught the state supreme court has upheld the conviction on another person on deathrow ruling to the effect than just because he manufactured evidence once it doesn't mean he did in all cases. Yet they wouldn't allow new tests.
Falcon
Should there be a Law?