.

RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon Dec 22, 2008 12:04 pm

RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Nice read in MIT's Technology Review by Erica Naone:


Are U.S. passport cards and new state driver's licenses with RFID truly secure?

Starting this summer, Americans will need passports to travel to Canada, Mexico, Bermuda, and the Caribbean--unless they have passport cards or one of the enhanced driver's licenses that the states of Washington and New York have begun to issue.

Valid only for trips by land and sea, these new forms of identification are a convenient, inexpensive option for people who don't need to travel by plane. U.S. passport cards, which were introduced in July, cost about half as much as a full passport, and the extra cost of getting an enhanced driver's license rather than a regular one is even lower. Enhanced licenses have been available in Washington since January 2008 and in New York since September; other border states, including Michi­gan, Vermont, and Arizona, intend to offer them as well.

But not everyone is convinced that the new IDs are a good idea. The passport card and the enhanced licenses contain radio frequency identification (RFID) tags, which are microchips fitted with antennas. An RFID reader can radio a query to the tag, causing it to return the data it contains--in this case, an identification number that lets customs agents retrieve information about the cardholder from a government database. The idea is that instant access to biographical data, a photo, and the results of terrorist and criminal background checks will help agents move people through the border efficiently. RFID technology, however, has been raising privacy concerns since it was introduced in product labels in the early 2000s.

Meanwhile, although experts say that some RFID technologies are quite secure, a University of Virginia security researcher's analysis of the NXP Mifare Classic (see Hack, November/December 2008), an RFID chip used in fare cards for the public-­transit systems of ­Boston, London, and other cities, has shown that the security of smart cards can't be taken for granted. "I think we are in the growing-pains phase," says Johns Hopkins University computer science professor Avi Rubin, a security and privacy researcher. "This happens with a lot of technologies when they are first developed."

Borderline Security

The first of the new ID cards to be introduced, the federal passport cards and the Washington driver's licenses use similar technology, which has been reviewed and approved by the U.S. Department of Homeland Security. The cards' RFID devices, called electronic product code (EPC) tags, are much like bar codes. The tags are inexpensive and can, in ideal conditions, be read from about 150 feet away--an unusually long range for RFID, says Ari Juels, director and chief scientist at RSA Laboratories in Bedford, MA, which collaborated with researchers from the University of Washington to evaluate both cards.



For complete article:
http://www.technologyreview.com/computing/21842/?a=f

Don
CISSP, MCSE, CSTA, Security+ SME
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Mon Dec 22, 2008 11:08 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Two seconds in the microwave = problem solved. This tends to leave the tiniest of burn marks in some cases, but nothing visible without very close inspection.
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Fri Dec 26, 2008 9:32 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Or you could do the anti-RFID wallet:

Buy one http://www.thinkgeek.com/gadgets/security/8cdd/

or build your own http://www.rpi-polymath.com/ducttape/RFIDWallet.php

I'm personally dreading arrival of the IED tuned to American passports.
<<

elcapitan

User avatar

Newbie
Newbie

Posts: 28

Joined: Mon Apr 28, 2008 10:16 am

Post Fri Dec 26, 2008 11:24 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

I would be careful with using a microwave to disable the RFID. Wired had a good article on this, recommending "blunt force" to disable the chip:

http://www.wired.com/wired/archive/15.0 ... .html?pg=9
CISSP, Security+, CEH, OPP, et alii
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Fri Dec 26, 2008 11:27 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

One of my co-workers just did the microwave bit. He said it made a huge spark and left the tiniest of pinhole burns in the cover. Nothing noticeable without very close inspection.
<<

timmedin

User avatar

Sr. Member
Sr. Member

Posts: 469

Joined: Thu Feb 05, 2009 11:18 pm

Post Sat Feb 14, 2009 3:46 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

twitter.com/timmedin | http://blog.securitywhole.com
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Sat Feb 14, 2009 8:34 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Yup, not even particularly hard. Scary. The relevant link:

http://freeworld.thc.org/thc-epassport/
<<

Thegmandrive

Newbie
Newbie

Posts: 43

Joined: Tue Feb 17, 2009 8:34 pm

Post Tue Feb 17, 2009 8:48 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

I would think that it would be frowned upon to disable the chip. Does anyone know if it is illegal? Has anyone gone through Airport Security with there passport chip disabled?

Here's a couple cool ways

http://blog.makezine.com/archive/2008/0 ... _tags.html
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Tue Feb 17, 2009 10:36 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Not even remotely legal. Passport tampering will get you up to 25 years. One of my co-workers microwaved his to kill the chip, then came back into the country with it disabled with no problems.

I imagine that this becomes an issue when there are obvious signs of tampering or if you're stupid enough to mouth off about disabling it.
<<

Thegmandrive

Newbie
Newbie

Posts: 43

Joined: Tue Feb 17, 2009 8:34 pm

Post Tue Feb 17, 2009 11:33 pm

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

Good to know, and good point Thanks!
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Wed Feb 18, 2009 9:41 am

Re: RFID's Security Problem - Are New Passports and Drivers Licenses Secure?

I have heard of others not having such great luck using the microwave method (burn marks) so you might want to be cautious if you go that way.

Return to Hardware

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software