www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece
CLASSIFIEDS From The Times August 6, 2008 Fakeproof' e-passport is cloned in minutes A forged e-passport Steve Boggan New microchipped passports designed to be foolproof against identity theft can be cloned and manipulated in minutes and accepted as genuine by the computer software recommended for use at international airports. Tests for The Times exposed security flaws in the microchips introduced to protect against terrorism and organised crime. The flaws also undermine claims that 3,000 blank passports stolen last week were worthless because they could not be forged. In the tests, a computer researcher cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber. The altered chips were then passed as genuine by passport reader software used by the UN agency that sets standards for e-passports. The Home Office has always argued that faked chips would be spotted at border checkpoints because they would not match key codes when checked against an international data-base. But only ten of the forty-five countries with e-passports have signed up to the Public Key Directory (PKD) code system, and only five are using it. Britain is a member but will not use the directory before next year. Even then, the system will be fully secure only if every e-passport country has joined.
ANALYSIS: an essential tool for terrorism Some of the 45 countries, including Britain, swap codes manually, but criminals could use fake e-passports from countries that do not share key codes, which would then go undetected at passport control. The tests suggest that if the microchips are vulnerable to cloning then bogus biometrics could be inserted in fake or blank passports. Tens of millions of microchipped passports have been issued by the 45 countries in the belief that they will make international travel safer. They contain a tiny radio frequency chip and antenna attached to the inside back page. A special electronic reader sends out an encrypted signal and the chip responds by sending back the holder's ID and biometric details. In the wake of the September 11 attacks, the United States demanded that other countries adopt biometric passports. Many of the 9/11 bombers had travelled on fake passports. The tests for The Times were conducted by Jeroen van Beek, a security researcher at the University of Amsterdam. Building on research from the UK, Germany and New Zealand, Mr van Beek has developed a method of reading, cloning and altering microchips so that they are accepted as genuine by Golden Reader, the standard software used by the International Civil Aviation Organisation to test them. It is also the software recommended for use at airports. Using his own software, a publicly available programming code, a 40 card reader and two 10 RFID chips, Mr van Beek took less than an hour to clone and manipulate two passport chips to a level at which they were ready to be planted inside fake or stolen paper passports. A baby boy's passport chip was altered to contain an image of Osama bin Laden, and the passport of a 36-year-old woman was changed to feature a picture of Hiba Darghmeh, a Palestinian suicide bomber who killed three people in 2003. The unlikely identities were chosen so that there could be no suggestion that either Mr van Beek or The Times was faking viable travel documents. "We're not claiming that terrorists are able to do this to all passports today or that they will be able to do it tomorrow," Mr van Beek said. "But it does raise concerns over security that need to be addressed in a more public and open way." The tests also raise serious questions about the Government's 4 billion identity card scheme, which relies on the same biometric technology. ID cards are expected to contain similar microchips that will store up to 50 pieces of personal and biometric information about their holders. Last night Dominic Grieve, the Shadow Home Secretary, called on ministers to take urgent action to remedy the security flaws discovered by The Times. "It is of deep concern that the technology underpinning a key part of the UK's security can be compromised so easily," he said. The ability to clone chips leaves travellers vulnerable to identity theft when they surrender their passports at hotels or car rental companies. Criminals in the back office could read the chips and clone them. The original passport holder's name and date of birth could be left on the fake chip, with the picture, fingerprints and other biometric data of a criminal client added. The criminal could then travel the world using the stolen identity and the original passport holder would be none the wiser. The Home Office said last night that it had yet to see evidence of someone being able to manipulate data in an e-passport. A spokesman said: "No one has yet been able to demonstrate that they are able to modify, change or alter data within the chip. If any data were to be changed, modified or altered it would be immediately obvious to the electronic reader." The International Civil Aviation Organisation said: "The PKD ensures that e-passports used at border control points . However, all states issuing e-passports must join the PKD, otherwise that assurance cannot be given." Going biometric 1999 International Civil Aviation Organisation begins study into possibility of worldwide use of travel documents carrying biometric data 2002 After 9/11 US announces all passports issued from 2006 and used to enter the country must contain biometric information or holder will require a visa 2006 Britain and many EU countries introduce biometric passports 2008 45 countries have introduced biometric passports.
Have your say So what is going to happen is that the 45 Countries using these will all be lulled into a false sense of security. The fake passport with the tampered with chip will send a fake message to the 45 Countries all saying "this person is ok" and therefore it will make all 45 Countries even more at risk. malcolm, london, uk In 2004 at the Defcon hacker convention at las vegas a 14 year old Boy Cracked a Biometric Identity card in 9 Mins 42 Seconds. Makes it even easyer for the Criminals but still the Government says it will stop everything, here goes billions of Tax payers Money, Chip n Pin that stopped fruad did it?. nick walters, Corby, uk Remember, If man can make it, make can break it. John, Toronto, Canada I love the statement from the Home Office. This typifies this government complete self denial as the country continues to slide into the abyss. Did anyone expect anything engineered by this useless Government to work? They can't even arrange for our kids' test papers to be marked properly so what chance with national security? Williams, Stafford, Seriously, did anyone really expect these passports to be secure when the idea was first touted? Phill, The Wirral, England "e-passport" They named it accordingly. The only thing left in this world to be cloned is humans. jayil, london, uk I can't wait for this totally inept government to 'invest' over 20 billion of taxpayers' money in their Identity Cards system which will prove to be equally 'fakeproof'. Rick, London, England I see the government has its head in the sand as usual. Ives, England What bothers me is the arrogance with wich public officials went out and said: "with these new passoports security will certainly increase" when it was simply an order the white house gave to european, so-called "sovereign", countries because the yanks want to control our data and lives. Horace, Florence, Tuscany, Italy As Mcauley says, all of this is designed to control the activities of law-abiding people. It was never intended for serious use against gangsters and terrorists because they do not operate according recognisable rules or within enforceable regulations, and the governments know it. Martin, France The key problem is the very long lead time from concept to introduction when you are seeking international standards - what was technologically leading edge in 1999 is very old hat today. This blows any argument in support of UK ID cards out of the water. Neil Marshall, Cambridge, UK Only one way to make the...
|
http://csua.com/feed/