Feeds

Researcher gives Elvis and bin Laden fake e-passports

Claims they'll fool e-readers. Uh huh huh

Boost IT visibility and business value

The 'fraud-proof' e-passport can be copied and altered, a Dutch security researcher has demonstrated. In tests conducted for the Times, Jeroen van Beek of the University of Amsterdam changed the chip data in a normal UK e-passport to contain a picture of Osama bin Laden. The paper also reports that van Beek has contrived to have a passport in the name of Elvis Presley accepted by a public e-reader in a Dutch town hall.

Van Beek's work builds on earlier demonstrations which showed how a passport chip could be cloned, and subsequently how this could be done without even taking it out of the delivery envelope. Such exploits could be of some use to passport fraudsters - for example a copied chip could be palmed at an unattended reader or a complete copy of a passport that hasn't even been stolen could be used so long as the bearer resembled the original holder.

Being able to write a new picture and new personal data to a chip without detection would however mean that the e-passport had been totally subverted.

This however is not quite what van Beek has done. The integrity of the data in the e-passport is protected by a digital signature, and alteration of the data will result in the passport being rejected by the reader. In addition to changing the data, van Beek appears to have been able to write a new signature to the chip that will pass muster, but only under certain circumstances.

Validation of the signatures on e-passports requires the exchange of PKI certificates between countries' issuing authorities, or the use of ICAO's PKD (Public Key Directory) system. Logically the ICAO PKD system ought to be used to provide a standard level of validation for what is intended to be a global, secure document standard. Currently, however, use of the PKD is far from universal, and many countries (the UK included) rely on bilateral exchange of certificates with other countries.

So whether or not a fake van Beek passport will pass muster will depend on a number of factors. If the reader used is an early one, it may not check the signature at all. If the passport's purported issuing authority hasn't exchanged certificates with the country operating the reader, then the signature can't be checked. And if one or both of the countries involved isn't using the PKD, again the signature can't be checked.

Which at the moment means that this class of fake would be good enough to get through quite a number of borders. The data used in van Beek's fake chips (bin Laden, Elvis) was deliberately selected to avoid accusations of forgery, but as e-passport fakery becomes more plausible, it seems only a matter of time before researchers, campaigners or plain old forgers start trying to get them through borders. And in the case of the latter, if they succeed, how will we tell? ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?