[IWE] Unpossible!!!! Hack-proof passports hacked!

[D. Scott Katzer]

http://voices.washingtonpost.com/securityfix/2008/09/tool_lets_users_change_their_p.html?hpid=topnews

=== begin cut ===
Software Lets Users Manipulate Passport Data

A security researcher has published a software tool that makes it easy 
to copy and modify identification data encoded onto the computer chips 
embedded in passports issued by the United States and dozens of other 
countries.

Jeroen van Beek, a security researcher at the University of Amsterdam, 
discussed his work at the Black Hat security conference in Las Vegas 
last month, but only this week released the tool that allows anyone to 
manipulate data on the passport chips.

The attack is targeted at electronic passports or "e-passports." 
According to the U.S. State Department, the United States stopped 
issuing passports without the chips in August 2007. Close to four dozen 
other countries also issue e-passports, which are designed around an 
open international standard.

[...]

The data encoded on the e-passport chips is signed with cryptographic 
keys held by the issuing country - thus allowing the issuing country to 
tell if a citizen had altered the data on the device. The problem is 
that only 10 of the 45 countries that issue e-passports have agreed to 
share the public keys that are needed to test the integrity of the data 
on one another's passport chips. Worse still, only five countries are 
actively sharing the data.

As a result, someone who has changed the name or swapped in a new photo 
on an e-passport chip can simply sign the information using his own 
personal cryptographic key, and relatively few countries would be able 
to detect the manipulation, said Adam Laurie, a freelance security 
researcher with RFIDiot.org, a site that hosts software and research 
designed to expose holes in RFID technology.

"This is the big problem with the whole thing: It relies on checking the 
digital signatures of the content on the passport, but if nobody's 
checking those signatures, you can't tell if the data is legitimate," 
Laurie said.

Following the 9/11 attacks, the United States told other countries they 
would have to adopt the e-passport system if they wanted their citizens 
to avoid applying for visas every time they wanted to enter the country. 
But Bruce Schneier, a renowned cryptography expert who serves as chief 
security technology officer for the British telecommunications giant BT, 
said the lack of an international system for checking the signatures 
actually makes the entire system less secure because countries are bound 
to place a higher degree of trust in the newfangled passports.

"In this case, the authority for the thing is the thing itself: It's 
like my giving you an ID card and saying it's valid only because I say 
it's valid," Schneier said.

For its part, the State Department says the e-passports will be 
supplemented by other security technologies. For example, the inclusion 
of the digital photograph on the e-passport chip enables biometric 
comparison, through the use of facial recognition technology at 
international borders, the government says.

But in an op-ed published this month in The Washington Post, Schneier 
warned that researchers would likely discover even more security 
weaknesses that could be used to defeat the security of the e-passport 
system.

"The security mechanisms on your passport chip have to last the lifetime 
of your passport," Schneier wrote. "It is as ridiculous to think that 
passport security will remain secure for that long as it would be to 
think that you won't see another security update for Microsoft Windows 
in that time."

=== end cut ===

What a surprise.  Not.

Personal data sources which retain information have their place (e.g. 
personal medical records to be used by personal physicians or on 
admission to a hospital).  But thinking that they're intrinsically safe 
or hacker-proof is silly.

Cheers,
Scott.