Feeds

Industry group defends e-passports

Counter-attack follows cloning demo

Internet Security Threat Report 2014

A demonstration that the chips on upcoming electronic passports can be cloned does not add up to a threat to either border security or citizen privacy, according to an industry group backing the development of the technology. The Smart Card Alliance argues that e-passports planned for the US rely on multiple layers of security.

Lukas Grunwald, CTO of German security consultancy DN-Systems Enterprise Internet Solutions, demonstrated reading and copying the electronic information in his German e-passport at a security conference at the Black Hat conference in Vegas last week. Grunwald said the data held on RFID cards within e-passports can be copied simply, which he reckons undermines claims by governments that e-passports will help stamp out forgeries. He argues the e-passport design will make no contribution to added security and is, in his words, "totally brain damaged". Not so, says the Smart Card Alliance, whose members are heavily involved in developing the technology.

"Even if someone could copy the information on your e-passport chip, it doesn’t achieve anything, because all of the information is locked together in such a way that it can’t be changed. It’s no different than someone stealing your electronic passport and trying to use it. No one else can use it because your photo is on the chip and they’re not you," said Randy Vanderhoof, executive director of the Smart Card Alliance.

The Smart Card Alliance said the standards adopted by the global electronic passport program makes passports "virtually impossible" to counterfeit. Furthermore nobody other than the passport user will ever be able to use them. The Smart Card Alliance details the security measures incorporated into e-passports. The information on the printed page, including the bearer’s photograph, is stored on the chip and displayed on a screen at passport control. By comparing the digital information, the printed passport and the person, customs officers can confirm everything matches. Discrepancies can be spotted if someone is attempting to use someone else’s e-passport chip information, a possibility raised by Grunwald's chip demo.

Data on the chip is not encrypted (at least for now) but it is digitally signed by the issuing country’s passport authority. Any changes to this data would therefore be detected at passport control. Unlike paper passports, where a photo can potentially be replaced, the digital photo and other information on the e-passport chip cannot be changed.

Shielding controls mean that (at least in theory) a passport needs to be handed over and opened before any information stored on the chip is communicated. All information exchanged between the reader and the e-passport chip is encrypted. "Together these capabilities mean that no one could use a lost or stolen passport, or even a copy of one, to illegally enter the country. They also prevent anyone from spying on US e-passports when the passport cover is closed," the Smart Card Alliance argues.

The Alliance makes a good case but some experts, such as security guru Bruce Schneier, question whether these security measures will withstand the test of time, especially considering the longevity of passport use (typically 10 years). Our analysis of Grunwald's demonstration shows how easily it was performed, which does little to assuage concerns that e-passports are not as foolproof as their industry backers would have use believe. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.