Researcher: New passports vulnerable

[Ned]

When is our government going to finally believe the myriad of electronics experts, who have not just speculated, but demonstrated that the new RFID enabled passports are a security and identity theft nightmare? These passports must be halted immediately!

I'm writing my Senators and Representative immediately to get the Bush Administration to wake up and stop the nonsense with the new RFID enabled passport unless they use encryption and/or some other technology which will protect my identity instead of broadcasting it to every crook and terrorist who happens to be nearby, and don't think they won't be nearby once this passport is in general use.

If you don't know how to contact your Senators and Representatives go to Contacting Congress

Originally posted by by AP via CNN.com - August 6 2006
Researcher: New passports vulnerable
Defcon showcases latest discovered security weaknesses

LAS VEGAS, Nevada (AP) -- Electronic passports being introduced in the United States and other countries have a major vulnerability that could allow criminals to clone embedded secret code and enter countries illegally, an expert warned.

A demonstration late Friday by German computer security expert Lukas Grunwald showed how personal information stored on the documents could be copied and transferred to another device.

It appeared to contradict assurances by officials in government and private industry that the electronic information stored in passports could not be duplicated.

"If there is an automatic inspection system, I can use this card to enter any country," Grunwald said, holding up a computer chip containing electronic information he had copied from his German passport.

The research is the latest to raise concerns about the growing use of RFID, short for radio-frequency identification, which allows everyday objects such as store merchandise, livestock and security documents to beam electronic data to computers equipped with special antennas.

Countries such as Germany already use RFID in passports to help border officials guard against forgeries and automate the processing of international visitors. U.S. officials plan to start embedding RFID in passports in October.

A State Department spokeswoman said late Saturday she did not have enough information on the matter to comment.

The presentation was one of dozens delivered at the Defcon conference being held through Sunday in Las Vegas. The conference, attended by many of the world's best-known security experts, has become an annual showcase of the latest discovered weaknesses in computers, phone equipment and other machines.

To read the full article go to Researcher: New passports vulnerable

[mercwyn]

While I will write I'm fairly certain that the honorable Senators from Utah will choose to follow the President's lead. I know my Representative well enough that I may be able to convince him to push for the halt. Of course he doesn't have the greatest record at getting stuff through when you consider that every year he pushes for a repeal of the automatic pay raise that Congress gives itself and it has yet to pass.

[BarkingLeopard]

I'll be renewing my passport shortly, so I'm curious as to know exactly when the new chips will be in the passports.

I choose "no- for any other reason" simply because while I'm plenty concerned I'm too lazy to write, and old enough (cynical enough?) to know that my writing my senator and lawmakers won't make a whit of difference, despite the fact that my brother volunteers for our dear and admittedly rabid (aren't they all rabid?) Congresswoman Johnson.

Besides, my Senator (old Lieberman) is in the process of losing the primary by 3 percentage points or so, and I suspect he has more important issues on his mind for the next three months. Looks like I'll have the choice of a very liberal Lamont, a moderate Lieberman running as an independent, or a very conservative and very unknown Republican this November- should be an interesting race to watch. Yes, I know that this belongs in the other forum, but the point is that my lawmakers have other stuff on their minds and I don't think that they would do anything more than have an aide write me a kiss-@$$ letter unless I actually ponied up some big kickbacks and bribes - er, "campaign contributions". <_<

In hindsight, I guess I should have chosen "no- they won't do anything about it anyway". Oh well- they won't, especially after the right company officials drop some well-placed cash around.

<div class='quotetop'>QUOTE(mercwyn @ Aug 8 2006, 01:34 PM) [snapback]33756[/snapback]</div>

While I will write I'm fairly certain that the honorable Senators from Utah will choose to follow the President's lead. I know my Representative well enough that I may be able to convince him to push for the halt. Of course he doesn't have the greatest record at getting stuff through when you consider that every year he pushes for a repeal of the automatic pay raise that Congress gives itself and it has yet to pass.
[/b]

Mercwyn- am I the only one on these forums that sees the great irony and hypocrisy in a club of millionaires voting themselves pay raises (can you say "conflict of interest"?) at the same time they publicly pander to the "little guy" and welfare moms everywhere? Give your Congressman a hug and heartfelt thanks for me.

[Ned]

All US Passports issued starting in October of this year will have the RFIDs implanted in them.

During the comment period about the RFID implants, out of the 2,335 comments on the plan that were received by the State Department, 98.5 percent were negative, but the Bush administration said they were going ahead with their plans anyway.

To address concerns about ID theft, the Bush administration said the new passports will be outfitted with "antiskimming material" in the front cover to "mitigate" the threat of the information being surreptitiously scanned from afar. Nothing apparently on the back cover, however. The problem is it's not clear, how well the technique will work against high-powered readers that have been demonstrated to read RFID chips from about 160 feet away.

"The shielding in the passport is a physical device that basically, when the passport cover is closed, it's very difficult to read the chip," a State Department official, who did not wish to be identified by name, said. It's now been 10 months since the announcement that they're going to use "antiskimming material" and the State Department was still either unable or unwilling to provide any details about the "antiskimming material" protection. The National Institute of Standards and Technology, which has been working to evaluate the chip's vulnerability to skimming, continues to provide no information, as well.

Privacy advocates have said that the anti-skimming device was a decent start. But if the cover of the passport happens to be open, all bets are off.

[tdew]

<div class='quotetop'>QUOTE(Ned @ Aug 8 2006, 11:47 PM) [snapback]33841[/snapback]</div>

"The shielding in the passport is a physical device that basically, when the passport cover is closed, it's very difficult to read the chip," a State Department official, who did not wish to be identified by name, said. [/b]

That sounds like a perfect new business opportunity for a slip in cover envelope for all who are concerned.

I've been concerned about the tags being used on items we purchase, but can also see how it is a help to merchants for inventory control. I'd like to see a home device of some sort that you could deactivate the tags on anything you have already bought and paid for.

Luckily, all our passports are good for quite a while yet, so the bugs should be worked out before we have to renew them.

Terry
from Bodo, Norway

[Ned]

There was an interesting article about the new "e-Passports" today in the Wall Street Journal.

To start, the State Department now says it's going to start rolling out these new passports next Monday, out of the Colorado Passport Agency. They will continue the roll out their issuance, over the next several months, until by the end of the year all new passports issued will be "e-Passports."

The State Department says it has addressed key privacy concerns by adding metal sheets to the document's cover. The metal fibers make the chip inactive and data unreadable when the passport is closed. Then when the passport is open it can only be read by a scanner within a few inches of the passport. It's interesting that earlier this week, electronics experts were able to read the passports from as much as 160 feet away.

The State Department further states that the chip will be protected by an electronic-access-code system. The only trouble is that system is easily hacked, according to security experts.

Furthermore, anytime the passport isn't closed tight with the cover in contact with the RFID chip, the chip is broadcasting. Think about how your passport is carried in a pocket, or purse, etc. More often than not the passport is not "tightly" closed. T's right, "That sounds like a perfect new business opportunity for a slip in cover envelope for all who are concerned." At the very least people are going to have to take care of their passport much more carefully.

I'm going to have some kind of cover, case, whatever, ready to go before I get one of those babies.

[tdew]

<div class='quotetop'>QUOTE(tdew @ Aug 9 2006, 12:52 AM) [snapback]33843[/snapback]</div>

That sounds like a perfect new business opportunity for a slip in cover envelope for all who are concerned.
Terry
[/b]

Replying to my own post!

Someone listened....

http://gearlog.com/blogs/gearlog/archive/2...9/18/21488.aspx

[weblet]

http://www.schneier.com/essay-125.html

[Ned]

<div class='quotetop'>QUOTE(weblet @ Sep 22 2006, 09:58 AM) [snapback]37570[/snapback]</div>

http://www.schneier.com/essay-125.html
[/b]

It sounds like Mr. Schneier has been reading the posts here at Tripso. His essay is right on the money.

Frankly, one of the things I've been thinking about is that I wouldn't be surprised if many US citizens try to temporarily disable the chip, and what would be the consequences of doing so.

The State Department says, "Any passport which has been materially changed in physical appearance or composition, or contains a damaged, defective or otherwise nonfunctioning electronic chip, or which includes unauthorized changes, obliterations, entries or photographs, ... may be invalidated."

But, I'd be willing to bet that once these new passports have been in fairly wide circulation that someone(s) will come out with a device to temporarily disable them such as a tiny field emitter which you could clip on to the passport, which puts out a cancelling wave field. Security agencies use these to stop "bugs" from properly functioning.

[jfrenaye]

TDEW had a link in her post above for a wallet that will prevent the signal from escaping. It is made with Zinc which I imagine will be a no no at security checkpoints, so therefore you will have to put that in your carryon (which will no doub be searched because I do not believe zinc can be Xrayed) and leave you with your vulnerable passport for the duration of the security line which is exactly where anyone trying to get the info will be!