Go Back  FlyerTalk Forums > Travel&Dining > Travel Safety/Security > Practical Travel Safety and Security Issues
Reload this Page >

RFID Passports Secretly Copied on a Lovely Sunday Drive

Community
Wiki Posts
Search

RFID Passports Secretly Copied on a Lovely Sunday Drive

Thread Tools
 
Search this Thread
 
Old Feb 3, 2009, 2:37 pm
  #16  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Originally Posted by Paolo01
Wikipedia. I love it. and I refer to it frequently. But as a reference manual on passport security?
Will a US State Department reference satisfy you?

The U.S. Electronic Passport (e-passport) is the same as a regular passport with the addition of a small contactless integrated circuit (computer chip) embedded in the back cover. The chip securely stores the same data visually displayed on the photo page of the passport, and additionally includes a digital photograph.
Originally Posted by Paolo01
The part about the JPEG was discredited a year ago after the article ran.
Really? Because those events and the article are from April of '08. Perhaps you're thinking of a different story?

You claim many things and provide few references. I'd be happy to admit I'm wrong if simply provided with evidence.
sinanju is offline  
Old Feb 3, 2009, 2:45 pm
  #17  
 
Join Date: Apr 2008
Location: USA
Posts: 1,439
Question source for info re: RFID data in passports?

Originally Posted by sinanju
The [RFID] chip [in a U.S. passport] contains all of the info on the ID page, including the picture, not a pointer [to] that info.
I don't doubt this, and I'd like to be able to repeat it with confidence. After a quick Web search, I don't have any confirmation of it. Could you please cite a credible source?
pmocek is offline  
Old Feb 3, 2009, 2:49 pm
  #18  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Originally Posted by pmocek
I don't doubt this, and I'd like to be able to repeat it with confidence. After a quick Web search, I don't have any confirmation of it. Could you please cite a credible source?
I provided a reference at state.gov in posting #16.
sinanju is offline  
Old Feb 3, 2009, 2:54 pm
  #19  
 
Join Date: Apr 2008
Location: USA
Posts: 1,439
U.S. Dept of State re: passport RFID chip content

The U.S. Department of State's U.S. Electronic Passport FAQ states:

An Electronic Passport is the same as a traditional passport with the addition of a small integrated circuit (or “chip”) embedded in the back cover. The chip stores:
  • The same data visually displayed on the data page of the passport;
  • A biometric identifier in the form of a digital image of the passport photograph, which will facilitate the use of face recognition technology at ports-of-entry;
  • The unique chip identification number; and
  • A digital signature to protect the stored data from alteration.
pmocek is offline  
Old Feb 3, 2009, 3:01 pm
  #20  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Originally Posted by pmocek
The U.S. Department of State's U.S. Electronic Passport FAQ states:
One of the functions of a digital signature is the ability to identify the signer. The data on an American passport should not be accepted unless signed by the US State Department. The same would go for other electronic passports issued by other countries.

... so, easy enough to identify nationality based on the signing organization.
sinanju is offline  
Old Feb 3, 2009, 3:06 pm
  #21  
 
Join Date: Apr 2008
Location: USA
Posts: 1,439
security researcher clones & manipulates UK passport RFID chips

see also: "`Fakeproof' e-passport is cloned in minutes", Steve Boggan, The Times (UK), August 6, 2008.

Boggan writes:

The Home Office has always argued that faked chips would be spotted at border checkpoints because they would not match key codes when checked against an international data-base. But only ten of the forty-five countries with e-passports have signed up to the Public Key Directory (PKD) code system, and only five are using it. Britain is a member but will not use the directory before next year. Even then, the system will be fully secure only if every e-passport country has joined.
He continues:

The tests for The Times were conducted by Jeroen van Beek, a security researcher at the University of Amsterdam. Building on research from the UK, Germany and New Zealand, Mr van Beek has developed a method of reading, cloning and altering microchips so that they are accepted as genuine by Golden Reader, the standard software used by the International Civil Aviation Organisation to test them. It is also the software recommended for use at airports.

Using his own software, a publicly available programming code, a £40 card reader and two £10 RFID chips, Mr van Beek took less than an hour to clone and manipulate two passport chips to a level at which they were ready to be planted inside fake or stolen paper passports.

A baby boy’s passport chip was altered to contain an image of Osama bin Laden, and the passport of a 36-year-old woman was changed to feature a picture of Hiba Darghmeh, a Palestinian suicide bomber who killed three people in 2003. The unlikely identities were chosen so that there could be no suggestion that either Mr van Beek or The Times was faking viable travel documents.
pmocek is offline  
Old Feb 3, 2009, 3:11 pm
  #22  
 
Join Date: Jan 2009
Posts: 340
I took a hammer to mine........................
Centurion210 is offline  
Old Feb 3, 2009, 3:11 pm
  #23  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Perhaps it was just a pointer to a picture of Osama.
sinanju is offline  
Old Feb 3, 2009, 3:16 pm
  #24  
FlyerTalk Evangelist
 
Join Date: Jan 2005
Location: BWI
Programs: AA Gold, HH Diamond, National Emerald Executive, TSA Disparager Gold
Posts: 15,180
Originally Posted by Paolo01
Secure Gov't Database = whatever was sold to them by private industry as just that. Roll your eyes at private industry as well for being incompetent.
If you're familiar with government contracting (which it seems you're not), the customer (aka the Government) sets the requirements that need to be met and how much they're willing to spend. In many cases, the requirements are really vague. In others, they don't want to pay for all the security that can be provided.

There are incompetent contractors out there ... I'd never work for them. They often can get the contracts because they bid so cheaply. As is the saying, you get what you pay for.

However, I can only build what they ask me to build. And if it's garbage, unfortunately, my employer is bound to provide them what they contracted us to do. I've brought up stupidity in the requirements before, and I know the engineers that meet with the customers do too. They pretty much shrug their shoulders and say "this is what we're asking you to build ... build it."
Superguy is offline  
Old Feb 3, 2009, 3:21 pm
  #25  
FlyerTalk Evangelist
 
Join Date: Jan 2005
Location: BWI
Programs: AA Gold, HH Diamond, National Emerald Executive, TSA Disparager Gold
Posts: 15,180
Originally Posted by whirledtraveler
How can you tell if your passport has an RFID?
If it has the propaganda pages in it, it has an RFID. If it looks like the old one, very unlikely that it has the chip.

I ordered mine back in 2006 before they were issued so I would't have to worry about this garbage until 2016.
Superguy is offline  
Old Feb 3, 2009, 3:24 pm
  #26  
 
Join Date: Oct 2008
Location: Port Moody, BC
Posts: 484
My replacement NEXUS card came with a "Trusted Traveler Card Condom" to prevent the bad guys from stealing info off the chip...do the RFID passports come with any such "protection?"
FXWizard is offline  
Old Feb 3, 2009, 3:28 pm
  #27  
FlyerTalk Evangelist
 
Join Date: Mar 2002
Location: An NPR mind living in a Fox News world
Posts: 14,165
Wirelessly posted (BlackBerry8830/4.2.2 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/105)

Great post, Superguy...

It would be interesting to read the original RFP which must have been out on FedBizOpps. You could read requirements documents and specs. My guess is that the requirement to store and transmit data was more stringent than security. The RPF, sections L & M, would describe the weighted criteria the government used to evaluate proposals. It would also be interesting to find out which agency did the acquisition - State or DHS.
FliesWay2Much is offline  
Old Feb 3, 2009, 3:32 pm
  #28  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Originally Posted by FXWizard
My replacement NEXUS card came with a "Trusted Traveler Card Condom" to prevent the bad guys from stealing info off the chip...do the RFID passports come with any such "protection?"
The cover is shielded, but it doesn't stay closed and can be read at a distance. Hence my purchase of a DIFRwear cover.

As Yogi Berra said, "In theory, practice is just like theory. In practice, it ain't."
sinanju is offline  
Old Feb 3, 2009, 3:33 pm
  #29  
 
Join Date: Apr 2008
Location: USA
Posts: 1,439
link to coverage by The Identity Project

see also: "Drive-by reader for RFID drivers licenses and passport cards", The Identity Project blog, February 3, 2009
pmocek is offline  
Old Feb 3, 2009, 3:36 pm
  #30  
 
Join Date: Oct 2005
Location: BOS
Programs: Recovering AA flyer, LT PLT 2.6 MM
Posts: 1,543
Originally Posted by pmocek
see also: "Drive-by reader for RFID drivers licenses and passport cards", The Identity Project blog, February 3, 2009
That's a different write-up of the same story referred to by the OP.
sinanju is offline  


Contact Us - Manage Preferences - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.