Feeds

Passport RFIDs cloned wholesale by $250 eBay auction spree

Video demo shows you how

Internet Security Threat Report 2014

Caught on Video

He plans to release the software's source code during a demonstration at the Shmoocon hacker convention to be held later this month in Washington.

Paget's device has a range of about 30 feet, making it ideal for discretely skimming the EDL and passport card tags of people who pass by his vehicle. With modifications, Paget says his device could read RFID identifiers that are more than a mile away. The antenna was concealed by the vehicle's tinted window, and the PC and RFID reader fit well below the eye line, making it virtually undetectable by passersby.

To be sure, the RFID tags contain no personally identifiable information, but rather what amounts to a record pointer to a secure Department of Homeland Security database. But because the pointer is a unique number, the American Civil Liberties Union and other civil libertarians warn the cards are still susceptible to abuse, especially if their RFID tags can be read and captured in large numbers. Cloning the unique electronic identifier is the first step in creating fraudulent passport cards, they say.

The cards also amount to electronic license plates that could be used to conduct clandestine surveillance. Law enforcement officials could scan them at political rallies and then store them in databases. The tags could also be correlated to other signals, such as electronic toll-booth payment systems or RFID-based credit cards, to track the detailed movements of their holders.

Not that the Feds Care

Officials with the US Customs and Border Protection Department say they have no plans to overhaul the technology used in passport cards. RFID signals allow border agents to process travelers more quickly and bring an added level of security to the process, spokeswoman Kelly Ivahnenko said. The cards come with protective sleeves that prevent the RFID tags from being readable, she added, and even if they are captured, she said there is little anyone can do with the information.

"From our standpoint the privacy issues have been misrepresented and blown out of proportion," she told The Reg. "Anytime that you have a new technology and use it in a new way, there are always going to be far-out ways to use information nefariously. We want travelers to be aware of the technology and to know how it works so that they can be comfortable using it."

A spokesman from the US State Department - which processes applications for passport cards and then issues them - declined to comment.

But critics contend the risks are real, especially if RFID-enable identification becomes universal.

"Just like a social security number, the unique identifier number on this document must be properly safeguarded," said Nicole Ozer, Technology and Civil Liberties policy director of the ACLU of Northern California. "If it falls into the wrong hands, it can be used for tracking, stalking, identity theft, and counterfeiting. If the government continues to stick its head in the sand and ignore the very real privacy and security threats that researchers, civil liberties organizations, and even industry groups have repeatedly brought to its attention, the American people will pay a very high price." ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.