Feeds

Passport RFIDs cloned wholesale by $250 eBay auction spree

Video demo shows you how

The Power of One eBook: Top reasons to choose HP BladeSystem

Caught on Video

He plans to release the software's source code during a demonstration at the Shmoocon hacker convention to be held later this month in Washington.

Paget's device has a range of about 30 feet, making it ideal for discretely skimming the EDL and passport card tags of people who pass by his vehicle. With modifications, Paget says his device could read RFID identifiers that are more than a mile away. The antenna was concealed by the vehicle's tinted window, and the PC and RFID reader fit well below the eye line, making it virtually undetectable by passersby.

To be sure, the RFID tags contain no personally identifiable information, but rather what amounts to a record pointer to a secure Department of Homeland Security database. But because the pointer is a unique number, the American Civil Liberties Union and other civil libertarians warn the cards are still susceptible to abuse, especially if their RFID tags can be read and captured in large numbers. Cloning the unique electronic identifier is the first step in creating fraudulent passport cards, they say.

The cards also amount to electronic license plates that could be used to conduct clandestine surveillance. Law enforcement officials could scan them at political rallies and then store them in databases. The tags could also be correlated to other signals, such as electronic toll-booth payment systems or RFID-based credit cards, to track the detailed movements of their holders.

Not that the Feds Care

Officials with the US Customs and Border Protection Department say they have no plans to overhaul the technology used in passport cards. RFID signals allow border agents to process travelers more quickly and bring an added level of security to the process, spokeswoman Kelly Ivahnenko said. The cards come with protective sleeves that prevent the RFID tags from being readable, she added, and even if they are captured, she said there is little anyone can do with the information.

"From our standpoint the privacy issues have been misrepresented and blown out of proportion," she told The Reg. "Anytime that you have a new technology and use it in a new way, there are always going to be far-out ways to use information nefariously. We want travelers to be aware of the technology and to know how it works so that they can be comfortable using it."

A spokesman from the US State Department - which processes applications for passport cards and then issues them - declined to comment.

But critics contend the risks are real, especially if RFID-enable identification becomes universal.

"Just like a social security number, the unique identifier number on this document must be properly safeguarded," said Nicole Ozer, Technology and Civil Liberties policy director of the ACLU of Northern California. "If it falls into the wrong hands, it can be used for tracking, stalking, identity theft, and counterfeiting. If the government continues to stick its head in the sand and ignore the very real privacy and security threats that researchers, civil liberties organizations, and even industry groups have repeatedly brought to its attention, the American people will pay a very high price." ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.