[IP] Guardian Unlimited: Cracked it!
Begin forwarded message:
From: bobr@xxxxxxxxxxxxxxxxxxxxxxxxxx
Date: November 17, 2006 1:57:17 AM EST
To: dave@xxxxxxxxxx
Subject: Guardian Unlimited: Cracked it!
Dave
Anybody on IP wanna buy a Passport -- or a new identity?
Bob Rosenberg
P.O. Box 33023
Phoenix, AZ 85067-3023
Mobile: 602-206-2856
LandLine: 602-274-3012
bob@xxxxxxxxxxxxxxxxxxxxxxxxxx
Cracked it!
Three million Britons have been issued with the new hi-tech passport,
designed to
frustrate terrorists and fraudsters. So why did Steve Boggan and a
friendly computer
expert find it so easy to break the security codes?
Steve Boggan
Friday November 17, 2006
Guardian
http://www.guardian.co.uk/idcards/story/0,,1950226,00.html
Six months ago, with the help of a rather scary computer expert, I
deconstructed the
life of an airline passenger simply by using information garnered from a
boarding-pass stub he had thrown into a dustbin on the Heathrow
Express. By using
his British Airways frequent-flyer number and buying a ticket in his
name on the
airline's website, we were able to access his personal data, passport
number, date
of birth and nationality. Based on this information, using publicly
available
databases, we found out where he lived, his profession, all his academic
qualifications and even how much his house was worth.
It would have been only a short hop to stealing his identity,
committing fraud in
his name and generally ruining his life.
Great news then, we thought, that the UK had just begun to issue new,
ultra-secure
passports, incorporating tiny microchips to store the holder's
details and a digital
description of their physical features (known in the jargon as
biometrics). These,
the argument went, would make identity theft much more difficult and
pave the way
for the government's proposed ID cards in 2008 or 2009.
Today, some three million such passports have been issued, and they
don't look so
secure. I am sitting with my scary computer man and we have just
sucked out all the
supposedly secure data and biometric information from three new
passports and
displayed it all on a laptop computer.
The UK Identity and Passport Service website says the new documents
are protected by
"an advanced digital encryption technique". So how come we have the
information?
What could criminals or terrorists do with it? And what could it mean
for the
passports and the ID cards that are meant to follow?
First it is necessary to explain why the new passports were
introduced, and how they
work.After the 9/11 attack on the World Trade Centre, in which fake
passports were
used, the US decided it wanted foreign citizens who presented
themselves at its
borders to have more secure "machine-readable" identity documents. It
told 27
countries that participated in a visa waiver programme that citizens
with passports
issued after the 26th of last month must have micro-chipped biometric
passports or
would have to apply for a US visa. Among those 27 countries are the
major EU
members, and other friendly nations ranging from Andorra and Iceland
to Singapore,
Japan and Brunei. The UK, of course, is also included.
Standards for the new passports were set by the International Civil
Aviation
Organisation (ICAO) in 2003 and adopted by the waiver countries and
the US. The ICAO
recommended that passports should contain facial biometrics, though
countries could
introduce fingerprints at a later date. All these would be stored on
a Radio
Frequency Identification (RFID) microchip, which can be accessed from
a short
distance using radio waves. Similar chips are commonly found in
retail, where they
are used for stock control.
Fatally, however, the ICAO suggested that the key needed to access
the data on the
chips should be comprised of, in the following order, the passport
number, the
holder's date of birth and the passport expiry date, all of which are
contained on
the printed page of the passport on a "machine readable zone." When
an immigration
official swipes the passport through a reader, this feeds in the key,
which allows a
microchip reader to communicate with the RFID chip. The data this
contains,
including the holder's picture, is then displayed on the official's
screen. The
assumption at this stage is that this document is as authentic as it is
super-secure. And, as we shall see later, this could be highly
significant.
Once the passports began to be issued in the UK in March, we began
laying the
foundations for examining them. Phil Booth, national coordinator of
the campaign
group NO2ID, suggested to his members that they apply for a new
passport. Anyone who
gets one before ID cards are rolled out will not have to register for
a card until
their passports expire in 10 years' time, and this appealed to Booth.
At the same time, Adam Laurie, my computer expert and technical
director of the
Bunker Secure Hosting, a Kent-based computer security company, and I
began laying
plans to examine the new passports. Laurie is actually not a scary
individual - he
is regarded in the industry as a technical wizard who cares about
privacy and civil
rights - but much of the electronic information he uncovers is. Two
years ago, he
revealed that Bluetooth mobile phones could be accessed remotely,
drained of their
contact details, diary entries and pictures, and manipulated to act
as bugging
devices. The cellphone industry spent millions of pounds plugging the
gaps he
exposed.
By last month, Booth, Laurie and I each had access to a new biometric
chipped
passport and were ready to begin testing them. Laurie's first port of
call was the
ICAO's website, where the organisation had published specifications
for the new
travel documents. This is where he learned that the key to opening up
the secure
chip was contained in the passports themselves - passport number,
date of birth and
expiry date.
"I was amazed that they made it so easy," Laurie says. "The
information contained in
the chip is not encrypted, but to access it you have to start up an
encrypted
conversation between the reader and the RFID chip in the passport.
"The reader - I bought one for £250 - has to say hello to the chip
and tell it that
it is authorised to make contact. The key to that is in the date of
birth, etc. Once
they communicate, the conversation is encrypted, but I wrote some
software in about
48 hours that made sense of it.
"The Home Office has adopted a very high encryption technology called
3DES - that
is, to a military-level data-encryption standard times three. So they
are using
strong cryptography to prevent conversations between the passport and
the reader
being eavesdropped, but they are then breaking one of the fundamental
principles of
encryption by using non-secret information actually published in the
passport to
create a 'secret key'. That is the equivalent of installing a solid
steel front door
to your house and then putting the key under the mat."
Within minutes of applying the three passports to the reader, the
information from
all of them has been copied and the holders' images appear on the
screen of Laurie's
laptop. The passports belong to Booth, and to Laurie's son, Max, and
my partner, who
have all given their permission.
Booth is staggered. He has undercut Laurie by finding an RFID reader
for £174, which
also works. "This is simply not supposed to happen," Booth says.
"This could provide
a bonanza for counterfeiters because drawing the information from the
chip, complete
with the digital signature it contains, could result in a passport
being passed off
as the real article. You could make a perfect clone of the passport."
But could you - and what use would my passport be to you? A security
feature of the
chip ensures that information cannot be added or altered, so you
couldn't put your
picture on my chip. So is our attack really so impressive?
The Home Office thinks not. It correctly points out that the
information sucked out
of the chip is only the same as that which appears on the page,
readable with the
human eye. And to obtain the key in the first place, you would need
to have access
to the passport to read (with the naked eye) its number, expiry date
and the date of
birth of its holder.
"This doesn't matter," says a Home Office spokesman. "By the time you
have accessed
the information on the chip, you have already seen it on the
passport. What use
would my biometric image be to you? And even if you had the
information, you would
still have to counterfeit the new passport - and it has lots of new
security
features. If you were a criminal, you might as well just steal a
passport."
However, some computer experts believe the Home Office is being
dangerously naive.
Several months ago, Lukas Grunwald, founder of DN-Systems Enterprise
Solutions in
Germany, conducted a similar attack to ours on a German biometric
passport and
succeeded in cloning its RFID chip. He believes unscrupulous
criminals or terrorists
would find this technology very useful.
"If you can read the chip, then you can clone it," he says. "You
could use this to
clone a passport that would exploit the system to illegally enter
another country."
(We did not clone any of our passport chips on the assumption that to
do so would be
illegal.)
Grunwald adds: "The problems could get worse when they put
fingerprint biometrics on
to the passports. There are established ways of making forged
fingerprints. In the
future, the authorities would like to have automated border controls,
and such
forged fingerprints [stuck on to fingers] would probably fool them."
But what about facial recognition systems (your biometric passport
contains precise
measurements of key points on your face and head)? "Yes," says
Grunwald, "but they
are not yet in operation at airports and the technology throws up
between 20 and 25%
false negatives or false positives. It isn't reliable."
Neither is the human eye, according to research conducted by a team
of psychologists
from the University of Westminster in 1996. Remember, information -
such as a new
picture - cannot be added to a cloned chip, so anyone using it to
make a counterfeit
passport would have to use one that bore a reasonable resemblance to
themselves.
But during Westminster University's study, which examined whether
putting people's
images on credit cards might reduce fraud, supermarket staff drafted
in for tests
had great difficulty matching faces to pictures. The conclusion was
that pictures
would not improve security and they were never introduced on credit
cards. This
means that each time you hand over your passport at, say, a hotel
reception or
car-rental office abroad to be "photocopied", it could be cloned with
equipment like
ours. This could have been done with an old passport, but since the
new biometric
passports are supposed to be secure they are more likely to be
accepted without
question at borders.
Given the results of the Westminster study, if a terrorist bore a
slight resemblance
to you - and grew a beard, perhaps - he would have a good chance of
getting through
a border. Because his chip is cloned, with the necessary digital
signatures, and
because you have not reported your passport stolen - you still have
it! - his
machine-readable travel document will get him wherever he wants to
go, using your
identity.
What about the technical difficulties? The government claims the new
biometric
passport chips can be read over a distance of just 2cm, but
researchers all over the
world claim to have read them from further. The physics governing
those in British
passports says they could be read over a metre, but no one has yet
done that. A
Dutch team claims to have contacted chips at 30cm.
Laurie has, however, rigged up a piece of equipment that can connect
to a passport
over 7.5cm. That isn't as far as the Dutch 30cm, but it is enough if
your target
subject is sitting next to you on the London Underground or crushed
up against you
on the Gatwick Airport monorail, his pocketed passport next to the
reader you have
hidden in a bag.
It takes around four seconds to suck out the information with a
reader; then it can
be relayed and unscrambled by an accomplice with a laptop up to 1km
away. With a
Heath Robinson device we built on Tuesday using a Bluetooth antenna
connected to an
RFID reader, Laurie relayed details of his son's passport over a
distance of 10
metres and through two walls to a laptop.
Ah, the Home Office will say, but you still need to see the
information in the
passport that will form the key needed for connection. Well, not
necessarily.
Consider this scenario: A postman involved with organised crime knows
he has a
passport to deliver to your home. He already knows your name and
address from the
envelope. He can get your date of birth by several means, including
credit-reference
agencies or from the register of births, marriages and deaths (and,
let's face it,
he delivers all your birthday cards anyway).
He knows the expiry date - 10 years from yesterday, give or take a
day, when the
passport was mailed to you. That leaves the nine-digit passport
number. NO2ID says
reports from its 30,000 members up and down the country are throwing
up a number of
similarities in the first four digits of the passport number, so that
reduces the
number of permutations, potentially leaving five purely random
numbers to establish.
"If the rogue postman were to take your passport home, without
opening the envelope
he could put it against a reader and begin a 'brute force' attack in
which your
computer tries 12 different permutations every second until it has
the right access
codes," says Laurie. "A five-digit number would take 23 hours to
crack at the most.
Once all those numbers were established, you could communicate with
the RFID chip
and steal all the information. And your passport could be delivered
to you, unopened
and just a day late."
But is this really credible? Would criminals or terrorists really go
to such
lengths? Ross Anderson, professor of security engineering at the
University of
Cambridge computer laboratory, believes they would. "The point is
that once you have
extracted the data from the chip you can have a forged passport that
contains not
just forged physical stuff," he says. "You also have the digital bit-
stream so the
digital signature of the passport checks out. That makes it possible
to travel
through borders with it.
"What concerns me is that this demonstrates bad design on the part of
the Home
Office, and we know that government IT projects have a habit of going
terribly
wrong. There is a lack of security in what we can see - so what about
the 90% of the
iceberg in the system that we can't see?
"There isn't even a defence against the brute-force attack. In much
the same way as
you are only allowed three attempts to feed in your PIN number at an
ATM, the
passport chip could have been made to stop allowing repeated
incorrect attempts to
contact it. As things stand, a computer can keep trying until it gets
the numbers
right. To say this doesn't matter displays a cavalier lack of concern."
The problems we have identified with RFID chips in passports raise
all sorts of
questions about the UK's proposed ID card scheme, which will use the
same
technology. The government has not said exactly what will be
contained in the ID
card's chip, but there will be a National Identity Register that
could contain
around 50 pieces of information about you, ranging from your name,
age, and all your
addresses, to your national insurance number and biometric details.
Eventually, you
may need one to access healthcare. It could even replace the passport.
Already, then, criminals and terrorists will have identified just how
useful cloned
ID cards might be. It would be folly to think their best minds are
not on the case.
The Home Office insists that UK passports are secure and among the
best in the
world, but not everyone agrees. Last week, an EU-funded body entitled
the Future of
Identity in the Information Society (Fidis) issued a declaration on
machine-readable
travel documents such as RFID-chipped passports and ID cards. It said
the technology
was "poorly conceived" and added: "European governments have
effectively forced
citizens to adopt new ... documents which dramatically decrease their
security and
privacy and increase risk of identity theft."
The government is now facing demands from the Liberal Democrats and
anti-ID card
groups for a recall of the passports so that simple devices such as
foil covers can
be installed - at enormous cost. Such covers would at least stop
chips being scanned
remotely, though they wouldn't prevent an unscrupulous hotel
receptionist from
opening the passport and sucking out its contents the way we did.
It may be that at some point in the future the government will accept
that putting
RFID chips in to passports is ill-conceived and unnecessary. Until
then, the only
people likely to embrace this kind of technology are those with
mischief in mind.
Guardian Unlimited © Guardian News and Media Limited 2006
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/