More e-passports hacked within minutes, security questions abound
By Darren Murph 
posted Aug 7th 2008 6:03AM
posted Aug 7th 2008 6:03AM
It's downright frightening that we've become numb to this news, but here again we're faced with another report of e-passports being hacked within minutes. The University of Amsterdam's Jeroen van Beek was reportedly able to clone and manipulate a pair of British passports in about the time it takes you to sip down your first cup of joe in the morning, and worse still, they were accepted as genuine by the software "recommended for use at international airports." The tests point out a number of vulnerabilities, including the fact that the microchips could be susceptible to having falsified biometrics inserted for use. As expected, talking heads at the Home Office still insist that any chip manipulation would be immediately recognized by the electronic readers, so we'll leave it up to you to decide who's telling the truth here.
Osama bin Laden, lol...
We all know he desperately want to visit Orange County to eat a burger from In-n-Out while driving along the Pacific coast highway down towards Laguna.
bert is a taliban.
wow...think of the consequences if someone manages to manipulate Bill Gates or Warren Buffet's passport......
A passport isn't a bank card ^_o
Makers of RFID proof passport sleeves are going to do pretty well.
They probably won't because no matter what happens most of the people are sheeps and don't give a fuck about things like that. Electronic data retention and all that surveillance bullshit doesn't keep anyone from plotting a terrorist attack and it makes life horrible for the rest of us. In a way, thanks to the paranoia and hysteria that was forced on the world by the US, the terrorists have achieved the ultimate victory. They don't even have to do something anymore, the government terrorizes it's people all by itself. Congratulations. I feel very safe now.
Just wanted to point out that sheep is the plural or sheep.
@ meist3r : "thanks to the paranoia and hysteria that was forced on the world by the US"
What the hell are you even talking about? You think electronic surveillance was "forced on the world by the US"? The UK has been using CCTV since the 70's, and there is a long list of countries that have had RFID passports before the US, Malaysia, New Zealand, Belgium, The Netherlands, Norway, Ireland, Japan, Pakistan, Germany, Portugal, and Poland.
Take your contempt for America somewhere else.
Oh wow. Time to quit the internet. I made a spelling/grammar error while publicly correcting one.
Some kind of freudian slip up ... somewhere between wimps and sheep was what I had in mind when I typed this. That puny s snuck in again. Thanks for the correction, though. Or to quote Homer Simpson: "People always are reaaally glad when they're corrected".
@Chris: True, the Brits used useless video surveillance for quite some time to maintain their illusion of security. But Let's not argue about the fact that after 9/11 everything changed in the perception of security. If the mightiest nation on the world starts controlling their borders like crazy and every little shit is made into a terrorist threat you can't expect those that are in alliance with the USA in a military and economical sense won't adapt to those changes. It's hysteria and you know it.
Most of the security related inconveniences are cuts on human rights originate in the US or would you like to deny that the "War on Terror" is a common idea that all of Europe had way before September 11th? It's the same excuse every time there is a new fingerprint scanner installed or phone line tapped. We are all looking for terrorists that might be a threat to the US and their allies. And the allies are only subject to terrorist threat because they are allied with the US in the first place, most of Europe held great business relationships with the Middle East and the so called "Axis of Evil" before they became a Fox News scare.
@Chris: An afterthought just occured to me. Because I actually do live in Germany I can say that Germany only got an RFID passport (despite protests from the public and several organizations) because our government used the terrorist threat excuse to push it through. It's a clear consequence of 9/11 and what happened to international security after that. So basically I can't give you that argument for my country at least. It's not like we would have gotten that if the US hadn't insisted on it. We even give these people intimate citizen data and bank records for no apparent reason. Nobody would do that if it wasn't for the US.
Gosh darnit, well don't try to type really fast kids. Your mind will spell things that it shouldn't.
The first sentence in the second paragraph of my original answer makes no sense that way. I changed it half-way through it was supposed to read:
...or would you like to claim that the "War on Terror" is a common idea that all of Europe had way before September 11th?
Sorry for the spamming guys.
And they had to find out now? after they are up-and-running?
E-fraud and cyber-terrorism (and every other cyber-(scary word)) is becoming one of the most relevant topics that no one seems to address. Lawrence Lessig, who mentioned in a recent interview that the government was working on a Patriot Act for the internet (iPatriot?) but according to this article http://www.internetevolution.com/author.asp?section_id=556&doc_id=160628&f_src=flffour , it's all Lessig trying to push his own, personal agenda.
so were the 'diebod voting machines' too - fullproof , so if they go ahead things are normal as usual
Say someone cloned my password, what can they do with the information?
They don't have my physical passport...
I don't see the problem, can someone enlighten me?
They could go through an airport with your identity so they can't be traced, instead everyone will think it was you.
This might be a problem then?
http://news.bbc.co.uk/1/hi/uk/7530180.stm
Passports are merely documents and documents can be forged. Coincided with the recent theft of several thousand blank passports in oldham, a technology to forge digital data will lead to criminals/ terrorists and illegal immigrants being able to enter and leave the country freely. It's not necessarily just about cloning but the cloning itself is dangerous as a passport will give access to many services. Namely banking, information held on files and access to many other services.
It is an incredibly dangerous prospect, its only saving grace is that it's only going to be done by a minority. It is another major reason why ID cards are a bad idea.
I would say, "barcode everyone" but even that can be readily compromised. So, how about RFID? Instant DNA checking?
I hope to god you're being sarcastic and not genuinely wanting a '1984' world.
I suggest tattooing the code right onto the forearm. There was a little Reich called Germany a couple of decades ago that where pretty successful with that kind of stuff. I wonder what happened to them.
As long as we give up a little more freedom, we'll all be safe.
... That's a sickening mindset you got there, unless sarcastic. You are being trained to submit like a head of livestock. And that feeling isn't security, it's the warm loving embrace of slavery.
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." --Ben Franklin
Some things are better left in the analog age. Like passports and voting machines...
Simple solution...
Abolish all iDols & Religions!,
(low rank in 4,3,2,1... and here we.... go)
What would that achieve?
It would remove some irrational terrorism, but there are plenty of other terrorists with secular motives; however, their reasons for committing terrorism may seem slightly more reasonable than killing people because they call Allah God or Adonai (They're basically the same religion anyway). Abolishing religions still leaves this security hole open. The true solution is to abolish all humans so that the security hole cannot be exploited (though it still leaves the hole open, which isn't a very good solution, just an effective one).
(Unknown rank in GO!)
As long as we could abolish all greed bastards as well, it's a fairly sound solution.
Oh, apart from the disregard for human rights issue.
OH NO I have an e-passport.
Don't worry. You'll have company.
Pretty soon, someone else will have your e-passport too.
These the same minutes as they were in the last post?
Also good? Rather they're hacked and fixed now before they're out, rather than after. Not like this doesn't already happen with normal passports anyway.
apart from the fact that they are already out in the uk!
yeh yeh blah blah old news.
I wound up in the file directory of some unknown server (legitamtely *cough*cough*) located in the Netherlands. There were all sorts of papers and abstracts about how to do this stuff. So naturally I installed "DOWN 'EM ALL" for Firefox and saved all the PDF's in one fell swoop.
...and the point being?
I think his point is that he is ten years old.. can't be sure
Scary stuff, makes me afraid to fly. But you can't let fear control you, thats how they win against you (terrorizies). The company is no doubt denying the claims while feversly trying to reconcile its flaws...
So the dude from Dawson's Creek is now hacking passports?
Whey doesn't each issuing agency sign the data stored on the passports? Maybe I'm missing something, but wouldn't that put a stop to tampering?
Whey? Whey??? Why can't I spell why?
Uh nevermind, I missed the operative word "Cloned"
I knew it! Burt is involved with Osama bin laden, once again your plan has been foiled puppet!
The purpose of the chip is to have a digitally signed copy of the passports data. The chip in the British e-passport (along with German and others that have gotten "hacked") isn't supposed to be a token so cloning it is as much of an attack as copying a public key certificate.
On the other hand, the ICAO machine readable travel document specification has an optional active authentication scheme that makes the chip a token. Some countries have implemented active-auth in their e-passports. (incidentally, I specified the AA requirement in my countrys e-passport project) Now hacking that would be noteworthy as the chips used are specifically designed and common-criteria EAL verified to be tamper proof crypto-chips.
Also, I don't see how they could insert falsified biometrics - the biometrics are digitally signed. Unless the british document manufacturers really royally botched up and leaked their private key. Or the SHA-1 RSA-1024 signature scheme is broken, which would have much graver consequences than forged passports.
This current hack is as much newsworthy as someone photocopying a passport.