Feeds

Researcher gives Elvis and bin Laden fake e-passports

Claims they'll fool e-readers. Uh huh huh

Choosing a cloud hosting partner with confidence

The 'fraud-proof' e-passport can be copied and altered, a Dutch security researcher has demonstrated. In tests conducted for the Times, Jeroen van Beek of the University of Amsterdam changed the chip data in a normal UK e-passport to contain a picture of Osama bin Laden. The paper also reports that van Beek has contrived to have a passport in the name of Elvis Presley accepted by a public e-reader in a Dutch town hall.

Van Beek's work builds on earlier demonstrations which showed how a passport chip could be cloned, and subsequently how this could be done without even taking it out of the delivery envelope. Such exploits could be of some use to passport fraudsters - for example a copied chip could be palmed at an unattended reader or a complete copy of a passport that hasn't even been stolen could be used so long as the bearer resembled the original holder.

Being able to write a new picture and new personal data to a chip without detection would however mean that the e-passport had been totally subverted.

This however is not quite what van Beek has done. The integrity of the data in the e-passport is protected by a digital signature, and alteration of the data will result in the passport being rejected by the reader. In addition to changing the data, van Beek appears to have been able to write a new signature to the chip that will pass muster, but only under certain circumstances.

Validation of the signatures on e-passports requires the exchange of PKI certificates between countries' issuing authorities, or the use of ICAO's PKD (Public Key Directory) system. Logically the ICAO PKD system ought to be used to provide a standard level of validation for what is intended to be a global, secure document standard. Currently, however, use of the PKD is far from universal, and many countries (the UK included) rely on bilateral exchange of certificates with other countries.

So whether or not a fake van Beek passport will pass muster will depend on a number of factors. If the reader used is an early one, it may not check the signature at all. If the passport's purported issuing authority hasn't exchanged certificates with the country operating the reader, then the signature can't be checked. And if one or both of the countries involved isn't using the PKD, again the signature can't be checked.

Which at the moment means that this class of fake would be good enough to get through quite a number of borders. The data used in van Beek's fake chips (bin Laden, Elvis) was deliberately selected to avoid accusations of forgery, but as e-passport fakery becomes more plausible, it seems only a matter of time before researchers, campaigners or plain old forgers start trying to get them through borders. And in the case of the latter, if they succeed, how will we tell? ®

Beginner's guide to SSL certificates

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
US government fines Intel's Wind River over crypto exports
New emphasis on encryption as a weapon?
To Russia With Love: Snowden's pole-dancer girlfriend is living with him in Moscow
While the NSA is tapping your PC, he's tapping ... nevermind
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Put down that shotgun: Wi-Fi's the way to beat Zombies
CreepyDOL sensors can pick walkers from humans with MAC snack attack
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.