UK RFID Passports Cracked (already), tin foil hats at the ready Options

[zetec]

http://techdirt.com/articles/20061117/183947.shtml

There's been an odd rush by governments to move to RFID passports, even though there are serious concerns about how secure they really are. Over in the UK, where many RFID passports are already in use, a security researcher and a reporter were able to crack some aspects of the passport. It is, admittedly, a limited crack, but it could potentially be used to make a clone RFID chip for a counterfeit passport. While the UK government claims this crack is no big deal, you'd have to think that it shouldn't take long for other problems to show up as well. What seems pretty clear from the description is that the implementation was done without all that much thought given to the security side of the equation. We're not as down on RFIDs as some people are -- but with all the questions about security and privacy issues, you would think that officials would have been extra careful before sticking them in something such as a passport. Apparently not.

And the US government thinks RFID is still the way to go, and will be mandatory in all new passports by i think it was 2012. Don't quote me on that, i forget the exact date.

still. creepy.

[impala454]

It is, admittedly, a limited crack, but it could potentially be used to make a clone RFID chip for a counterfeit passport.

I doubt there's any security measure they could do that'd be 100% effective, but I'm sure there's far less people who can clone a RFID chip than can just print up a fake passport.

[zetec]

fuck, i could clone an RFID tag, but getting that special hologram paper and shit, with all the microprinting, that's a lot harder than RFID for me. besides, it's not just the cloning that scares me, it's what people could do with that information (identity theft doesn't really even need people to have a "passport", the number and info inside would be more than enough)

[impala454]

so how praytell could you clone an RFID tag? and how do you know the person's information is stored in the tag, and that it's not just some code that verifies it as a legit passport?

[Hartmann]

so how praytell could you clone an RFID tag? and how do you know the person's information is stored in the tag, and that it's not just some code that verifies it as a legit passport?

Cloning an RFID tag is fairly simple: http://www.schneier.com/blog/archives/2006...rs_clone_r.html

Since all e-passports use (or will use) the ICAO standard it would be easy to do.

This is the same concept that has been used in the past to snatch TollTag/EasyTag identities and electronic keys.

Then again, I'm not too worried about this whole thing....

[impala454]

interesting... i guess it would have to be easy if they're thinking of using them for product tags at stores.

what this guy says is f'n stupid though:

The best way to solve a security problem is not to have it at all. If there's an RFID chip on your passport, or any of your identity cards, you have to worry about securing it. If there's no RFID chip, then the security problem is solved.

in someone's comment they mention "shielded passports" which can only be read when open. sounds like a pretty good idea. it's all new so of course they'll have to fine tune it, but I think RFID is here to stay.

[Hartmann]

interesting... i guess it would have to be easy if they're thinking of using them for product tags at stores.

what this guy says is f'n stupid though:
in someone's comment they mention "shielded passports" which can only be read when open. sounds like a pretty good idea. it's all new so of course they'll have to fine tune it, but I think RFID is here to stay.

Yeah, I need to find the article about the shielded stuff...

I think RFID has its place like you said, there is still just a lot to learn and understand about how to implement it.

[chook]

What frequency is RFid? If the wavelength of the frequency is smaller than the longest slit, then it can xmit

[impala454]

If the wavelength of the frequency is smaller than the longest slit, then it can xmit

AND

if it does not fit, you must acquit

[zetec]

lol they mentioned RFID in Jericho tonight.

that was the biggest RFID chip i've ever seen. (it was about the size of a playing card)