Feeds

Researcher gives Elvis and bin Laden fake e-passports

Claims they'll fool e-readers. Uh huh huh

Combat fraud and increase customer satisfaction

The 'fraud-proof' e-passport can be copied and altered, a Dutch security researcher has demonstrated. In tests conducted for the Times, Jeroen van Beek of the University of Amsterdam changed the chip data in a normal UK e-passport to contain a picture of Osama bin Laden. The paper also reports that van Beek has contrived to have a passport in the name of Elvis Presley accepted by a public e-reader in a Dutch town hall.

Van Beek's work builds on earlier demonstrations which showed how a passport chip could be cloned, and subsequently how this could be done without even taking it out of the delivery envelope. Such exploits could be of some use to passport fraudsters - for example a copied chip could be palmed at an unattended reader or a complete copy of a passport that hasn't even been stolen could be used so long as the bearer resembled the original holder.

Being able to write a new picture and new personal data to a chip without detection would however mean that the e-passport had been totally subverted.

This however is not quite what van Beek has done. The integrity of the data in the e-passport is protected by a digital signature, and alteration of the data will result in the passport being rejected by the reader. In addition to changing the data, van Beek appears to have been able to write a new signature to the chip that will pass muster, but only under certain circumstances.

Validation of the signatures on e-passports requires the exchange of PKI certificates between countries' issuing authorities, or the use of ICAO's PKD (Public Key Directory) system. Logically the ICAO PKD system ought to be used to provide a standard level of validation for what is intended to be a global, secure document standard. Currently, however, use of the PKD is far from universal, and many countries (the UK included) rely on bilateral exchange of certificates with other countries.

So whether or not a fake van Beek passport will pass muster will depend on a number of factors. If the reader used is an early one, it may not check the signature at all. If the passport's purported issuing authority hasn't exchanged certificates with the country operating the reader, then the signature can't be checked. And if one or both of the countries involved isn't using the PKD, again the signature can't be checked.

Which at the moment means that this class of fake would be good enough to get through quite a number of borders. The data used in van Beek's fake chips (bin Laden, Elvis) was deliberately selected to avoid accusations of forgery, but as e-passport fakery becomes more plausible, it seems only a matter of time before researchers, campaigners or plain old forgers start trying to get them through borders. And in the case of the latter, if they succeed, how will we tell? ®

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.