Feeds

Researcher gives Elvis and bin Laden fake e-passports

Claims they'll fool e-readers. Uh huh huh

The Essential Guide to IT Transformation

The 'fraud-proof' e-passport can be copied and altered, a Dutch security researcher has demonstrated. In tests conducted for the Times, Jeroen van Beek of the University of Amsterdam changed the chip data in a normal UK e-passport to contain a picture of Osama bin Laden. The paper also reports that van Beek has contrived to have a passport in the name of Elvis Presley accepted by a public e-reader in a Dutch town hall.

Van Beek's work builds on earlier demonstrations which showed how a passport chip could be cloned, and subsequently how this could be done without even taking it out of the delivery envelope. Such exploits could be of some use to passport fraudsters - for example a copied chip could be palmed at an unattended reader or a complete copy of a passport that hasn't even been stolen could be used so long as the bearer resembled the original holder.

Being able to write a new picture and new personal data to a chip without detection would however mean that the e-passport had been totally subverted.

This however is not quite what van Beek has done. The integrity of the data in the e-passport is protected by a digital signature, and alteration of the data will result in the passport being rejected by the reader. In addition to changing the data, van Beek appears to have been able to write a new signature to the chip that will pass muster, but only under certain circumstances.

Validation of the signatures on e-passports requires the exchange of PKI certificates between countries' issuing authorities, or the use of ICAO's PKD (Public Key Directory) system. Logically the ICAO PKD system ought to be used to provide a standard level of validation for what is intended to be a global, secure document standard. Currently, however, use of the PKD is far from universal, and many countries (the UK included) rely on bilateral exchange of certificates with other countries.

So whether or not a fake van Beek passport will pass muster will depend on a number of factors. If the reader used is an early one, it may not check the signature at all. If the passport's purported issuing authority hasn't exchanged certificates with the country operating the reader, then the signature can't be checked. And if one or both of the countries involved isn't using the PKD, again the signature can't be checked.

Which at the moment means that this class of fake would be good enough to get through quite a number of borders. The data used in van Beek's fake chips (bin Laden, Elvis) was deliberately selected to avoid accusations of forgery, but as e-passport fakery becomes more plausible, it seems only a matter of time before researchers, campaigners or plain old forgers start trying to get them through borders. And in the case of the latter, if they succeed, how will we tell? ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.