Feeds

Industry group defends e-passports

Counter-attack follows cloning demo

SANS - Survey on application security programs

A demonstration that the chips on upcoming electronic passports can be cloned does not add up to a threat to either border security or citizen privacy, according to an industry group backing the development of the technology. The Smart Card Alliance argues that e-passports planned for the US rely on multiple layers of security.

Lukas Grunwald, CTO of German security consultancy DN-Systems Enterprise Internet Solutions, demonstrated reading and copying the electronic information in his German e-passport at a security conference at the Black Hat conference in Vegas last week. Grunwald said the data held on RFID cards within e-passports can be copied simply, which he reckons undermines claims by governments that e-passports will help stamp out forgeries. He argues the e-passport design will make no contribution to added security and is, in his words, "totally brain damaged". Not so, says the Smart Card Alliance, whose members are heavily involved in developing the technology.

"Even if someone could copy the information on your e-passport chip, it doesn’t achieve anything, because all of the information is locked together in such a way that it can’t be changed. It’s no different than someone stealing your electronic passport and trying to use it. No one else can use it because your photo is on the chip and they’re not you," said Randy Vanderhoof, executive director of the Smart Card Alliance.

The Smart Card Alliance said the standards adopted by the global electronic passport program makes passports "virtually impossible" to counterfeit. Furthermore nobody other than the passport user will ever be able to use them. The Smart Card Alliance details the security measures incorporated into e-passports. The information on the printed page, including the bearer’s photograph, is stored on the chip and displayed on a screen at passport control. By comparing the digital information, the printed passport and the person, customs officers can confirm everything matches. Discrepancies can be spotted if someone is attempting to use someone else’s e-passport chip information, a possibility raised by Grunwald's chip demo.

Data on the chip is not encrypted (at least for now) but it is digitally signed by the issuing country’s passport authority. Any changes to this data would therefore be detected at passport control. Unlike paper passports, where a photo can potentially be replaced, the digital photo and other information on the e-passport chip cannot be changed.

Shielding controls mean that (at least in theory) a passport needs to be handed over and opened before any information stored on the chip is communicated. All information exchanged between the reader and the e-passport chip is encrypted. "Together these capabilities mean that no one could use a lost or stolen passport, or even a copy of one, to illegally enter the country. They also prevent anyone from spying on US e-passports when the passport cover is closed," the Smart Card Alliance argues.

The Alliance makes a good case but some experts, such as security guru Bruce Schneier, question whether these security measures will withstand the test of time, especially considering the longevity of passport use (typically 10 years). Our analysis of Grunwald's demonstration shows how easily it was performed, which does little to assuage concerns that e-passports are not as foolproof as their industry backers would have use believe. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.