Safe Speed Forums

http://www.guardian.co.uk/idcards/story ... 29,00.html

Recall demand after cloning of new biometric passports


Steve Boggan
Friday November 17, 2006
The Guardian

The government was facing demands to recall 3m micro-chipped biometric passports last night after a Guardian investigation which found that they could be electronically attacked and cloned with a £174 microchip reader.

Biometric data was transferred to a PC after gaining access to the chips in three passports. The findings are likely to put pressure on John Reid, the home secretary, to rethink plans for ID cards.

The Identity and Passport Service has spent £60m on new passport production lines for the £66 documents, which were introduced in March.

Nick Clegg, the Liberal Democrat home affairs spokesman, demanded a full recall. "Three million people now have passports that expose them to a greater risk of identity fraud than before.

"We need an urgent redesign of the biometric passport and a recall of all insecure passports once a new protected design is available. In the interim the government should provide commercially available RFID-shields for passports to those with the insecure design."

The biometric passports were introduced with the promise that they would make ID theft more difficult, but using information published by the International Civil Aviation Organisation, which lays down specifications for the travel documents, the Guardian investigation was able to break through security safeguards. The investigation was conducted with the campaign group NO2ID and computer expert Adam Laurie, who spent just 48 hours writing software designed to suck information from the chips.

He said: "The Home Office is using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are breaking one of the fundamental principles of encryption by using non-secret information published in the passport to create a 'secret key'. That is the equivalent of installing a solid steel front door to your house and putting the key under the mat."

The Home Office said the investigation exposed no significant weaknesses. "This doesn't matter. What use would my biometric image be to you?" He added that ID cards would contain enhanced encryption technology.

Gus Hosein, an expert in information systems at the London School of Economics, said: "This is stupid technology. If chips can be cloned they will be used in counterfeit passports."

Ross Anderson, professor of security engineering at the Cambridge University computer laboratory, said: "To say this doesn't matter displays a cavalier lack of concern."

***

Predictable or what?

_________________
Paul Smith
Our scrap speed cameras petition got over 28,000 sigs
The Safe Speed campaign demands a return to intelligent road safety

Yes and yet another billion down the drain.

_________________
Useless laws weaken necessary laws.

The government and their advisers aren't really very good at this "technology" lark, are they?

_________________
"Politicians are the same the world over... We build bridges where there aren't any rivers." - Nikita Kruschev

They're really good at wasting our money.

So what's the easiest way to destroy the RFID in my passport? I don't have one currently but I see no option to have a passport without one when I need to renew it.

Microwave might set the whole thing on fire.

I suppose it's easy to destroy physically, but then there's legal issues. (what is a passport?)

What if I just pulled it out of the passport?

Are they two-way, ie. I could write back to the chip and erase it that way?

_________________
Andrew.

1) overlioad the RF circuit with a strong radio signal

2) Electrostatic discharge like a spark igniter for a gas fire.

_________________
Speed camera policy Kills

What frequency do they use? Would this be likely to set fire to it? (like putting in microwave which I believe does the same thing at ~2.4GHz)


Oooh sparks are fun

I think it's about time I got or made an RFID 'reader'.

_________________
Andrew.

Or aTesvac

I reckon you'd be okay to nuke it for a second or two (speaks the voice of experience through experimenting with things in microwaves when drunk at uni )

13.56MHz (ISO14443) According to here.

I suppose if you accidentally spilled some water on your passport you might put it in the microwave to dry out...

_________________
Andrew.

Microwave? No officer, why do you ask?

_________________
Paul Smith
Our scrap speed cameras petition got over 28,000 sigs
The Safe Speed campaign demands a return to intelligent road safety

Trouble is "Officer" would likely be in America. With a gun.
But they have my biometric data already. I might be a terrorist you know.

_________________
Andrew.

Missing the point completely, guys. But then you can't be blamed as the government spokespeople touting biometric passports themselves don't understand the reason for it.

The purpose of biometrics is to prove the validity of the document and prevent a 'working' passport (ie. one that would pass border checks) being in the hands of a person who should not have it, NOT prove the identity of the bearer of it.

The fact that the data is easily extracted is of no consequence if you understand that point. At the end of the day the passport was designed to be easily accessed, in exactly the same way as the printed information inside is meant to be easily read. Having the data contained in the RFid is pointless if (a) you haven't the resources to put the data in another document and (b) if you do manage to create a replica passport the data within still doesn't match that of the bearer.

This article explains it well.

The whole scare is because there is a growing belief that biometrics in ID cards can be used as absolute proof of identity ie. don't bother checking the reality, just believe what the computer says.

Every time you go past an RFID reader (like when you enter/exit a shop) they could read your passport and know who you are.
I don't know if it's been hacked to quite that degree yet, but let's assume it can be.

That's the bit I don't like.

If it was, for example, a smart card type interface (requiring contact with the reader) and was not encrypted (completely open so you could see what is on there) then it wouldn't be so bad.

Until they start putting fingerprints and DNA on there.

_________________
Andrew.

Signing in blood - an idea ahead of it's time?

No no NO! They would read your passport and know your passport passed their readers. End of story. It is an assumption that the bearer is the person identified - nothing more.

I repeat, the point of biometric passports is to make passports more difficult to forge, NOT make the RFid info a substitute for proper cross checking of the info.

Be that as it may, if you're wandering round with your RFID passport in your pocket/bag/wherever, you can be tracked by the readers you pass.

That's a pretty good point.

It is a fair assumption though, that most of the time the person holding the passport (or more likely with ID cards) is the person it belongs to, and this may be able to be validated by cross-checking at the checkout with a credit card.

(Unless the RFID reader is near a camera with facial recognition which can be compared to the data on the passport. I suppose this is the same for ID cards, if either have the data on them.)

I suppose the other big problem is that they have your name and address on so could be used for this supposed identity theft we're all meant to be afraid of. Oh wait, the government are telling us to be afraid of identity theft and the government want us to have ID cards. DAMNIT why didn't I make that link before?

_________________
Andrew.

NO NO NO - your PASSPORT can be tracked!! I repeat - it is merely an unprovable assumption that the bearer of the passport is the person identified.

It is, however, this assumption that will cause all the problems and is the reason why people are jumping to the wrong conclusions over how easy it is to read biometric data on a passport. If the presence of RFid data is mistakenly used as proof of ID and that data is accepted without question and loss is incurred because the data is false or stolen then the people relying on the data deserve to be hit for millions in compensation for their stupidity.

I repeat once more - the purpose of the biometric data is to deter forgery of the document and prevent free passage of someone who should be denied it, NOT to prevent the presentation of a false identity.

At the end of the day the person bearing the passport still has to be verified as the person who is identified on it - there is no substitute for this process. RFid read biometric data is merely an additional and more reliable means for the person's identity to be verified at point of presentation.

Stealing someone's biometric data then presenting it as your own should be incredibly easy to catch as there is no way you can alter your physiology to match the data you are presenting.

If you try to patch your own biometric data in with someone else's particulars then again this will show up very easily as there will be inconsistency between the record on the passport and the database.

If someone, however, fails to make these checks then it is no different to accepting a false name when presented with one.

Moot point, if you're carrying your passport, you can be tracked, who wants that?

In many foreign countries visitors are obliged to keep their passports with them at all times, giving rise to the opportunity for tracking.