Security expert cracks RFID chip in U.K. passport
602412
(InfoWorld) - A security expert has cracked one of the U.K.'s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration. The attack, which uses a common RFID (radio frequency identification) reader and customized code,Â siphoned data off an RFID chipÂ from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said. "That's the really scary thing," said Laurie, whose work was detailed in the Sunday edition of the Daily Mail newspaper. "There's no evidence of tampering. They're not going to report something has happened because they don't know." The British government, which began issuing RFID passports about a year ago, eventually wants to incorporate fingerprints and other biometric data on the chips, although privacy activists are concerned over how data will be stored and handled. Currently, the chip contains the printed details on the passports, the person's photograph, and security technology to detect if those files have been altered. The attack was executed while the passport was still in its original envelope used to send it from the passport service, since RFID chips can be read from a few inches away, Laurie said. He used a passport ordered by a woman affiliated with No2ID, a group that opposes the U.K.'s biometric passport and ID card programs. The data on the passport's chip is locked until an RFID reader provides the encryption key, Laurie said. The encryption key is calculated using a combination of the person's personal data, such as date of birth, and is contained in the "machine-readable zone" (MZR) -- the string of characters and digits on the bottom of the passport's first page. At an immigration desk, the optical character reader scans the MZR and gets the key. The RFID chip is unlocked, and the information on the chip is matched with that on the passport. However, Laurie was able to do this process himself. He analyzed ICAO 9303, the standard from the International Civil Aviation Organization that been adopted worldwide for machine-readable passports, to see how the MZR is organized. Laurie also knew some of the woman's personal details -- used to calculate her passport's key -- and found out more through Internet research. He then wrote what's known as a "brute force" program, which repeatedly tries different combinations of data to discover the key. After about 40,000 attempts by the program, he cracked the key. To scan the chip, he used a common RFID reader from ACG ID, now part of Assa Abloy Identification Technology of Germany. The attack could then let Laurie begin the process of making an exact copy of the woman's passport. "[The biometric passport] has been sold to us as something that increases the security of the passport, but so far I don't see anything about it that increases my security," Laurie said. The greatest weakness with the passports is using relatively easy-to-find data to compose the encrypted key, Laurie said. It would be better to include more random elements that would render brute-force style programs nearly useless, he said. Laurie's work spawned from concern over how users can know what's on their passport's chip. "At the moment, if you want to see what's in your own passport, you have to go to passport office," Laurie said. "With my code, you can do it at home." Laurie has published a library of open-source tools written in the Python programming language that will run on RFID readers made by ACG and by Frosch Electronics, based in Austria. Â
20572
The U.K.&#39;s busiest airport is starting to affix radio chips to the luggage of passengers as part of an experiment aimed at reducing lost bags.The six-month trial will involve tagging around 50,000 bags a month with RFID (radio frequency identification tags) for passengers traveling or transferring on Emirates Airline between Dubai and Heathrow, said BAA, the company that runs the airport.Barcode tags are currently used, but the barcodes can be misread by scanners, especially if the tags are wet or creased. Those problems increase costs for BAA and the airlines, as well aggravating passengers with slower baggage handling.The RFID tags, which will be attached by staff at nine specially-equipped Emirates check-in desks, will be encoded the passenger&#39;s name and route. Higher-capacity chips could contain more data but won&#39;t be used for this trial, BAA said. Barcodes will still be used with the RFID tags.The RFID chips can be read by scanning equipment from a short distance away as the luggage passes through Heathrow&#39;s baggage system. Once at their destination, some passengers will receive a text message on their mobile phone informing of the baggage reclaim belt, BAA said.
546149
UK.gov's own facebook The Passport Office has stopped 600 fraudulent passport applications using a facial recognition system it rolled out as a pilot across its fraud units last year.â¦
79168
Independent security researcher stumbles upon usernames and passwords to nearly 1,000 government officials worldwide.
426070
Researcher who demonstrated the "sidejack" attack at Black Hat USA now says even encrypted Gmail can be compromised.
37595
INSPECTOR Hacker of the Yard has fingered the collar of a UK man suspected of stealing source code from Cisco Systems in May. Cyber plods from the Metropolitan Police Computer Crime Unit swooped on houses
238020
The country will embed remotely readable RFID chips in license plates next year to crack down on car theft. While the technology might not deter thieves, it's surely a great way to track citizens. In 27B Stroke 6.
598197
Technique lets intruders exploit flaws previously thought to be insignificant, says security researcher.
468098
He turned over a new leaf, and turned it back again: A man previously convinced of hacking hundreds of military and government computers has been busted again, this time for massive credit-card theft. In between he became -- what else? -- a well-known security researcher.
427479
The United States plans to issue passports with personal data stored on radio frequency identification chips. The documents would be harder to forge, but might leave holders vulnerable to identity theft. By Ryan Singel.
710328
Laptop stolen from Royal Navy officer contained passport and bank details of 600,000 people
3389
Relay attack hands baton to fraudsters Doctored payment machines could be used to lift confidential authorisation codes from Chip and PIN credit and debit cards, security researchers at Cambridge University have discovered.â¦
453054
A vulnerability in radio-frequency ID chips could put millions of users of wireless car key tags or speed pass payment devices at risk, according to a recent study by researchers at Johns Hopkins University and RSA Laboratories.
472918
Count them in, count them out, count them all about... Immigration Minister Liam Byrne this week unveiled - to a certain amount of derision - his vision of the ID Card scheme as some sort of 21st Century equivalent of the 19th Century railway network or the 20th Century national electricity grid. It will be pervasive, and in 20 years time it will be a great British institution, "part of the fabric of British life."â¦
258959
British TV presenter learns Web lesson: Never give out ID freely. Also: MBR Rootkit takes aim at Windows users.
585248
A British computer expert, accused by Washington of "the biggest military hack of all time", was given permission on Monday to take his fight against extradition to the United States to Britain's highest court.
371378
Following a lawsuit threat, a security researcher goes ahead with a presentation on vulnerabilities in RFID access cards-- but doesn't demonstrate problems with HID Global's system. By Kim Zetter.