Hackers clone passports in drive-by RFID heist

[Aviator]

http://www.itnews.com.au/News/95588%2Chackers-clone-passports-in-driveby-rfid-heist.aspx

Hackers clone passports in drive-by RFID heist

    *
    * Email a Friend
    * Print Page

By Iain Thomson
4 February 2009 03:55PM
Tags: cards | rfid | passport | security | used | data
Hackers clone passports in drive-by RFID heist

Related Articles

    * RFID maker gags security researcher
    * RFID passports raise security fears
    * Symantec shifts focus to data security
    * Unencrypted networks threaten data security
    * RFID 'out of the lab': Deloitte

A British hacker has shown how easy it is to clone US passport cards that use RFID by conducting a drive-by test on the streets of San Francisco.

Chris Paget, director of research and development at Seattle-based IOActive, used a US$250 Motorola RFID reader and an antenna mounted in a car’s side window and drove for 20 minutes around San Francisco, with a colleague videoing the demonstration.

During the demonstration he picked up the details of two US passport cards, which are fitted with RFID chips and can be used instead of traditional passports for travel to Canada, Mexico and the Caribbean.

“I personally believe that RFID is very unsuitable for tagging people,” he said.

“I don’t believe we should have any kind of identity document with RFID tags in them. My ultimate goal here would be, my dream for this research, would be to see the entire Western Hemisphere Travel Initiative be scrapped.”

Using the data gleaned it would be relatively simple to make cloned passport cards he said. Real passport cards also support a ‘kill code’ (which can wipe the card’s data) and a ‘lock code’ that prevents the tag’s data being changed.

However he believes these are not currently being used and even if they were the radio interrogation is done in plain text so is relatively easy for a hacker to collect and analyse.

The ease with which the passport cards were picked up is even more worrying considering that less than a million have been issued to date.

Paget is a renowned ‘white hat’ ethical hacker and has made the study of the security failings of RFID something of a speciality.

In 2007 he was due to present a paper on the security failings of RFID at the Black Hat security conference in Washington but was forced to abandon the plans after an RFID company threatened him with legal action.

He points out that RFID tags are increasingly being used in physical security systems such as building access cards and the technology needs significant security adding before it could be considered safe for commercial use.

Copyright © 2008 vnunet.com

<a href="http://www.youtube.com/v/9isKnDiJNPk" target="_blank" rel="noopener noreferrer" class="bbc_link bbc_flash_disabled new_win">http://www.youtube.com/v/9isKnDiJNPk</a>

[E-man]

Luckily I have an old school passport that doesn't expire until '14. My kids have the new one though.

You can get a wire mesh sleave that acts as a Faraday cage to prevent reading, or you can permanently disable it with a few seconds in a microwave (not too much power, or the heated chip might char the paper) or a strategic wack with a hammer.

[pecan]

Luckily I have an old school passport that doesn't expire until '14. My kids have the new one though.

You can get a wire mesh sleave that acts as a Faraday cage to prevent reading, or you can permanently disable it with a few seconds in a microwave (not too much power, or the heated chip might char the paper) or a strategic wack with a hammer.

water is a good shield too.  So keep yuh passport in a bottle of water.

[E-man]

Luckily I have an old school passport that doesn't expire until '14. My kids have the new one though.

You can get a wire mesh sleave that acts as a Faraday cage to prevent reading, or you can permanently disable it with a few seconds in a microwave (not too much power, or the heated chip might char the paper) or a strategic wack with a hammer.

water is a good shield too.  So keep yuh passport in a bottle of water.

Yeah didn't think of that, as long as it's less than 3 oz of water, of course.

[pecan]

Luckily I have an old school passport that doesn't expire until '14. My kids have the new one though.

You can get a wire mesh sleave that acts as a Faraday cage to prevent reading, or you can permanently disable it with a few seconds in a microwave (not too much power, or the heated chip might char the paper) or a strategic wack with a hammer.

water is a good shield too.  So keep yuh passport in a bottle of water.

Yeah didn't think of that, as long as it's less than 3 oz of water, of course.

in troot oui.  I did forget about this rule:

3-1-1 for carry-ons = 3 ounce bottle or less (by volume) ; 1 quart-sized, clear, plastic, zip-top bag; 1 bag per passenger placed in screening bin. One-quart bag per person limits the total liquid volume each traveler can bring. 3 oz. container size is a security measure.