Feeds

Biz travelers howl over US gov RFIDs

Border (in)security

Seven Steps to Software Security

A travel industry group has called on the US government to halt its use of new machinery that remotely reads government issued identification cards at border crossings until the safety of the new system can be better understood.

Monday's call by the Association of Corporate Travel Executives (ACTE) follows similar requests by a chorus of civil liberties and computer researchers. They warn that use of the new long-range radio frequency identification (RFID) scanners could jeopardize the privacy and security of people who pass through US borders.

"ACTE is concerned that unauthorized individuals could either resort to electronic eavesdropping at the border or use similar devices that could extract data from RFID chips at other locations," the group's executive director said in a statement. She asked for the system to be halted pending a comprehensive security review.

In July, researchers with RSA Laboratories and the University of Washington published a paper exposing several risks posed by RFID system used in US passport cards and drivers licenses issued by several states that emit RFID signals. They found the documents were susceptible to cloning, a vulnerability that could allow attackers to assume the identity (at least partially) of others.

The researchers also said it was possible for unauthorized parties to remotely read the RFID information embedded in the documents. Interestingly, drivers licenses issued by Washington state were vulnerable to remote scanning even when placed in protective sleeves, the report found.

The information contained in the documents is at the moment limited to an index number that functions similar to a social security number. But civil liberties groups say it still might be enough to allow the tracking of travelers' whereabouts.

"We think there's a significant risk down the road of people being tracked by these static unique ID numbers," Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, told The Register. "How hard is it to harvest numbers and associate them with people's names?"

According to a recent article in USA Today, the scanning machines are in place at five locations as part of the government's requirement that anyone who crosses the border show government-issued ID. The ID can be read from a distance of 50 feet.

In addition to Washington, New York State is also issuing drivers licenses that embed RFID information that works with the system. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.