Slashdot Mirror
New German Government ID Hacked By CCC
wiedzmin writes "Public broadcaster ARD's show 'Plusminus' teamed up with the known hacker organization 'Chaos Computer Club' (CCC) to find out how secure the controversial new radio-frequency (RFID) chips were. The report shows how they used the basic new home scanners that will go along with the cards (for use with home computers to process the personal data for official government business) to demonstrate that scammers would have few problems extracting personal information. This includes two fingerprint scans and a new six-digit PIN meant to be used as a digital signature for official government business and beyond." That was quick. Earlier this year, CCC hackers demonstrated vulnerabilities in German airport IDs, too.
Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure. Oh well, too complicated for the "general public" I guess, I mean keeping a spare of your (digital) key? That's far too complicated!
No wit here.
Alle Ihre Pässe sind gehören uns
Yes, that is what you think it is: A corrupt translation of a corrupt translation.
1: fix the problems.
2: abandon the plan.
3: arrest the people who embarrassed you, suppress any mention of the incidents.
Hmmm... let's see...
THL phish sticks
But please do note that at least the Germans know how to do it thoroughly: They'd give you a home reader with it, so you can actually use that card and incidentally also see what's on it. Oh, and pwn the crap out of it, but that's courtesy the CCC.
The agency's personal identification expert Jens Bender said the card was secure[,] and called the combination of an integrated chip with a PIN number a "significant security improvement compared to today's standard process of user name and password."
This is COMPLETELY the wrong way to do it. First, 6 digits is not secure, and can easily be bruteforced. It's much less secure than a long password.
Second, the article says that the 6 digit PIN can be used for digital signatures - how is that possible? If the government gives a citizen a document to digitally sign, and the citizen returns the 6 digit PIN, then the government could say that it sent ANY document to the citizen, and the citizen digitally signed it, because the signature isn't unique to the document. They should be using 4096 bit RSA for digital signatures, where the signature is unique to the document. Then, if the government switches out the document, to try to forge a signature, the signature will be invalid.
Why haven't gubbermints already gone the whole 666 route and forced us to get barcode tat's at birth? Being British I'm surprised the Blair government didn't suggest this instead of their failed ID card idea.
Todd: I hope it proves as delicious as the farmers that grew them
Never was, Never will. It is this by design. There are some measures to make things more difficult, but RFID was designed above all else to be a cheap transmitter. Why it was chosen to be a security token is beyond me.
Sometimes I wonder why it isn't possible to declare/register a PGP public key as official, and use that to authentify oneself. I mean, with that even email can be secure.
An imperfect systems can still be useful. If card/scanner misuse is on the order of handwritten signature misuse then replacing dead trees with some bits might be a good idea in many situations.
The pgp digital sig proves it was sent by your computer perhaps, but not necessarily sent by you. There is a genuine need for biometrics to be involved. Note that a handwritten signature is a form of biometric ID and like the card/scanner system it can be faked. This is why for more important situations a signature must be witnessed and possible notarized. The card/scanner system can similarly escalate the process for more important situation. For example when someone uses a bank's ATM a swipe and a pin are sufficient. When they walk up to a teller for larger transactions then a swipe and a pin could be augmented with a photo being displayed on the teller's screen. Banks often have such photos for embedding into ATM and credit cards.
Whoever designed the system is terrible at computer science.
These are home users, using a government provider scanner, and id card, and a key.
Would be pretty easy to build a rootkit filter driver that steals the data off the card during legitimate transactions, along with a keylogger. At that point, you can pretty much remotely impersonate anyone whom you've rootkitted. Doesn't matter how secure the back end is because you can easily dupe the scanner side.
Terrible, terrible design by idiots....you can't trust home user systems to be clean of rootkits.
There are several classes of card readers you can use to insert your card at home and identify yourself with a six-digit PIN.
The reader of the lowest security class ('basic') uses the PC keyboard, while readers of higher security classes use their own number keypad.
If I am not mistaken, CCC has shown that using the 'basic' card reader, somebody can get your PIN number - if your PC is infected by a trojan which logs your key strokes. That is more a general problem with trojan infected PCs, not with the new ID card system.
IMHO, if this is the only problem the CCC came up with, that is almost a bit encouraging. The only "scandal" here is that the government wants to distribute a certain number of free starter sets - which of course contain the cheapest, 'basic', insecure reader.
When the hell are security "professionals" going to wake up and realize that secure access to something requires three items: identification, authentication and authorization. You CANNOT store the authentication credential with the identification. It is 100% stupid to store the pin on the identification device. Authentication credentials and authorization decisions must be kept by, and made by, the service provider. The only item that should be left with the consumer is an identification badge.
For instance, a national "ID Card" is actually a good thing IF the only thing it has stored on it or about it is the owners identification, i.e. name and unique ID number. The ONLY thing the card should provide is a way to contact a national database/server which requires two things, the unique, public ID number from the card and a fingerprint (which is NOT stored or printed on the card in any way). The ONLY information the server should return is "Yes" or "No". But see... the fingerprint cannot be stored on the card in way for the same reason that the pin in the post should never be stored on the card. If somebody other than the legitimate owner comes into possession of the card then he possesses both the identification AND the authentication pieces of the puzzle and can do whatever the legitimate owner was authorized to do.
Security: it's simple. f*cking learn it.
I will never live for sake of another man, nor ask another man to live for mine.
I think you have attacked the wrong article, Mr. Coward. And, nobody steals from Microsoft. Why would we want to move backwards, seeing how they are always playing catch-up.
6 digit base 10 may not be secure.
6 digit base *number of characters in all of the alphabets known to man even after eliminating potential look-alike characters like "l" and "1" and multi-glyph characters like the Spanish "ch"* or some other big number might be.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
security experts have been telling them its shit and unsafe for years, but this is how lobby driven projects get pushed through. really a shame. and of course totally overpriced.
I guess that means the chipping of the populace just bit the dust.
The mind conceives, the body achieves, the spirit manifests.
Do the fingerprint scanners embedded into some phones and notebooks actually work well to secure them?
--
make install -not war
It ist sehr gut to see you Herr Gates - your ID ist in order und your private jet ist fueled und ready now.
Here ist the stack of gold coins you requested prior to takeoff.
Haf a nice trip!
Auf weidersehn ...
-- Tigger warning: This post may contain tiggers! --
"Meanwhile on Tuesday the Federal Office for Information Security (BSI) rejected the Plusminus' criticism of the new ID card. The agency's personal identification expert Jens Bender said the card was secure"
It's not secure. They just hacked it without special equipment, they used the scanner that you provide. Saying it's secure in response just means you're
Your ATM card doesn't have your pin on it. Neither does your credit card, or your student ID, employee ID, etc. unless someone really stupid designed the system. How does this get missed? Why are the fingerprint scans on there? Did more than one person look at the plan before they went ahead with it?
This is one of the largest mind-blowingly stupid decisions I've heard lately.
This sentence no verb.
A card that contains a digital copy of large amount of personal and private information? Given to every person? What's the worst that could happen?
Awesome. Truly awesome.
Personally, I can't wait for the US Federal Government to require all individuals to have these types of IDs. They think they're going to exert control over me by always being able to track me.
But I know that hackers will figure these things out, and ultimately no door that needs an ID will be safe from me.
Oh, sure, the non-technical people will suffer. But me? I'm going to do the things none of the other serfs will be able to do. For them, the ID will be a prison. For me, it will be my ticket to go anywhere I feel like.
Bring it. :D
Microsoft leads to Bluescreen; Bluescreen leads to downtime; downtime leads to suffering.
Here in the U.S. our driver's license cards are impenetrable. While it's true that some have 2D bar codes on the backs of them, you can bet that that they're heavily encrypted and it's not possible to obtain any social security numbers or anything that could be used to steal someone's identity off them.
I have 20 digits. Some people have 21 or more.
No all we need is to start distributing artificial gummy fingers using the fingerprints of Thomas de Maizière worldwide :)
is that u need something heavily centralised.........
that means........super single point of failure........when it occurs.......the world ends.....
The Germans should go back to basics.
... it's not the ID card itself they managed to hack, but a basic reader ... ... Now, while the idea might sound good, they decided on giving out the cheapest kind of readers, which are basically JUST readers. They rely on the PC to enter the code for the card. This is where the attack was targeted - using some PC software, they managed to record the information sent to and from the reader. Once you have the code, you could then steal the ID and use it to fake your identity. More expensive readers have displays and keypads that keep all unlocking away from the actual PC, so keyloggers or similar won't be able to steal the code ...
Germany planed on handing out free readers (something like 1 million of them) for the ID cards, enabling people to sign electronic messages and the likes
the existence of the Crazy Chaos C Compiler
My ism, it's full of beliefs.