Neoseeker : News : Insecurity of Homeland Security RFID passports shown by researcher

Insecurity of Homeland Security RFID passports shown by researcher
Kevin Spiess - Tuesday, February 3rd, 2009 | 11:18AM (PT) 0 Favourites (0)


Guy has no trouble driving around town, collecting private information from RFID ID

Insecurity of Homeland Security RFID passports shown by researcher Image 1

Under a plan called the Western Hemisphere Travel Initiative, the U.S Department of Homeland Security has now been issuing a new type of  passport. The passports use radio frequency identification technology. This means that the passports emit electromagnetic radiation that can be read quickly and easily by the government.

But not only by the government can such an easy time reading the RFID passports. An intrepid data security researcher named Chris Paget devised a simple method of collecting and absorbing RFID passport information for the illumination of his peers at the ShmooCon hacker convention (held in Washington, D.C.)

Chris devised a fairly inexpensive method of tracking and reading the passports. He bought a $250 RFID scanner on eBay to do the actual card-reading. Then he purchased a cheap, simple antenna to boost his range of the scanner. Then, he went driving in San Fransisco.

The current EPC Gen 2 RFID tags used in the wallet-sized Homeland Security passports use no encryption, and are unable to selectively transmit any data. Instead, the RFID tags broadcast sensitive information, enabling anyone with the proper equipment -- such as Chris Pagent -- to collect information that could potentially be used for identity theft, or other nefarious purposes. "The passport card is a real radio broadcast, so there's no real limit to the read range. It's conceivable that these things can be tracked from 100 meters -- a couple of miles," he was quoted as saying.

Chris had no trouble collecting -- and copying -- information from the RFID passports of six people, in a half-hour of driving around.

Chris called this security exercise "war-cloning." (This word comes from "war-driving", which in hacker-speak means to drive around trying to break into unsecure WiFi networks. "War-driving" in turn comes from "war-dialing", which was done back in the stone-age days of modems, where hackers would use programs to dial numbers sequentially, trying to find insecure networks.)

"My goal is to inform people about the risks with these things and how much impact it could have on your personal privacy and security if you don't keep [these IDs] in a protective wallet or if you carry it on your person," Chris said. For his live demonstration at the Shmoocon conference, Chris borrowed an e-passport from his boss, and copied it in front of an audience.

Source: Dark Reading

Section: Technology

  • 0 thumbs!
    riiaku since Feb 2008 | Feb 3, 09
    How could the government be this stupid? Seriously now, If this hacker can go around and pick up peoples rfids with such ease then our government has just exponentially endorsed identity theft.
  • 0 thumbs!
    Chiggins since Jun 2003 | Feb 3, 09
    Wow, my dad just got a new passport. I wonder if his has the RFID technology on his.

    *runs to e-bay to buy a RF reader*
  • 0 thumbs!
    Guest | Feb 3, 09
    The passport cards are shipped with an Identity Stronghold Secure Sleeve. If you don't keep your card in it then it can be read. That being said the passport card doesn't have personal information on it. Just a unique code like any other tag on a bottle of shampoo or box of software.

    The Passport Book on the other hand does contain personal information but has a shorter read range due to a lower frequency. It does have some shielding in the cover but if it isn't closed all the way you can potentially read it.

    You can get a passport size shielding sleeve or drivers license/credit card size from Identity Stronghold at www.idstronghold.com

    What should be most disturbing is credit card companies are shipping millions of new credit cards with RFID chips in them that emit your credit card number, expiration date and name. These are the easiest method of identity theft. Much easier than the passport book or passport card. The same Secure Sleeves will block these as well.
  • 0 thumbs!
    kspiess since Jun 2007 | Feb 3, 09
    What!?! They have RFID credit cards? I didn't know that. That is one of the dumbest things I've heard since Monday (if they aren't using at least decent encryption.)

    -- huh. Did some Googling. RFID CCs have been around for awhile now. I guess they haven't made it up here into Canada as quickly.
    Last edited by kspiess :: Feb 3, 09
  • 0 thumbs!
    Hellfire29 since Jun 2007 | Feb 3, 09
    The CCs could be heavily encrypted, meaning that it may not be easier.
  • 0 thumbs!
    Guest | Feb 3, 09
    This is no good no matter how you look at it! Knowing that someone else has control of all you private info is a bad bad thing! Whats next, a chip in your head or hand that will allow you to live a normal life, and if ur a suspect all the government can do is just disable the chip and you wont be able to do a thing!!! this is control.... not freedom!
  • 0 thumbs!
    kspiess since Jun 2007 | Feb 4, 09
    quote Hellfire29
    The CCs could be heavily encrypted, meaning that it may not be easier.
    I looked into it for a couple of minutes, and apparently the C'Cs don't use encryption either. You can read the CC number, names and such easily with only a 10$ RFID scanner, believe it or not (source: a video on Boing Boing TV)
    Last edited by kspiess :: Feb 4, 09
  • 1 thumbs!
    THM since Jan 2008 | Feb 4, 09
    Well, while this new technology is quite good for national security and terrorism prevention, the United States government also needs to realise that global terrorism cannot be defeated by advanced technology alone in the twenty-first century.

    National and global security initiatives demand wider spectrum of acts in terms of both in technological areas and non-technological areas, for instance, flexible diplomatic missions and mutual understandings and cooperation are also much needed amongst nations which possess different cultures and traditional beliefs.

    Of course, national security is a formidable task to initiate or control in the long-term. Nonetheless, at least, for a while, I do anticipate that Obama administration will yield profound results in preventing and eradicating future terrorist acts by incorporating the proper foreign policy into nation building tasks while abandoning the infamous Bush's legacy of "Unilateralism" towards eliminating global terrorism.
    Last edited by THM :: Feb 5, 09
  • -1 thumbs!
    kspiess since Jun 2007 | Feb 4, 09
    I think it's pretty interesting to look at what constitutes a "war", and then taking a gander at the definition of "terror", and then trying to figure out what a "war on terror" is. It is amusing. It is sort of like saying you are "fighting combat." Jingoisms generally serve as a method of misdirection.

    Regarding unilateralism, an old trick, used to increase support for your leadership, is to convince others that you are defending them from a mutual enemy.
    Last edited by kspiess :: Feb 4, 09
  • 0 thumbs!
    THM since Jan 2008 | Feb 4, 09
    quote
    Regarding unilateralism, an old trick, used to increase support for your leadership, is to convince others that you are defending them from a mutual enemy.
    Well, Kevin, there is no such thing as mutual enemy in War on Terror nor in other conventional wars.

    There are only mutual understanding and cooperation in the fight against "War on Terror" which needs not constitute a term called "war" in the first place.

    Unlike other conventional wars, War on Terror is simply targeted on innocent civilians. So it cannot be defined conventionally from the traditional old politics' point of view. Above all, in the fight against terrorism, Coalition forces need not only coordinated military cooperation but also diplomacy between the host country which breeds gratuitous terrorist organisations and the allied forces which intend to fight those terrorist forces aggressively.

    Note: Jingoisms had long been abandoned by the British government since the 20th century.
    Last edited by THM :: Feb 5, 09
- This news story is archived and is closed to new comments now -

Hardware Newsletter:
Email:



Compare Prices

Motherboards
Abit
ASUS
Gigabyte
MSI
eVGA
Intel
Tyan
More...

Processors
AMD
Intel
More...

Memory
DDR
DDR2
DDR3
More...

Video Cards
ATI
eVGA
XFX
BFG
Sapphire
More...

search for lowest prices
(0.3056/d/nova)