RF ID chip not secure
#1
Original Poster
Join Date: Apr 2009
Location: FrostByte Falls, Mn
Programs: Holiday Inn Plat NW gold AA gold
Posts: 2,157
RF ID chip in passports not secure
As an experiment, a researcher put together some commercially available equipment and went on a fishing expedition at Fisherman's Wharf for passport numbers. He was successful in obtaining passport numbers from the newer chipped passports from around twenty feet away.
On one hand our government attempts to make us more secure and then on the other hand does something that makes us less secure at the same time. I wish they would think things through and do a what if scenario before fielding this stuff.
LINK
On one hand our government attempts to make us more secure and then on the other hand does something that makes us less secure at the same time. I wish they would think things through and do a what if scenario before fielding this stuff.
LINK
Last edited by AngryMiller; Jul 12, 2009 at 11:06 am
#2
Original Poster
Join Date: Apr 2009
Location: FrostByte Falls, Mn
Programs: Holiday Inn Plat NW gold AA gold
Posts: 2,157
They do make sleeves that attenuate the signals.
Link
And as another feature:
In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.
Flexilis has suggested that the government adopt a dual cover shield and specifically designed RFID tag that would make the e-passport remotely unreadable until it is fully opened.
No changes have been made to the U.S. e-passport in response, according to the State Department.
- Some RFID critics wonder: Could government officials read the microchips in an enhanced driver's license or passport card by scanning people via satellite or through a cell phone tower network?
The short answer is no - because the chips in PASS cards and EDLs are "passive," or batteryless, meaning they rely on the energy of readers to power up. Passive tags are designed to beam information out 30 feet.
However, research is moving forward to make batteries tinier and more powerful, says Ari Juels, director of RSA Laboratories. A "semi-passive" tag that could transmit into the atmosphere when triggered by a reader "may be feasible at some point," he says.
Separately, a system called STAR, that adapts deep-space communications technologies to read passive tags from distances greater than 600 feet, was announced last year by a Los Angeles startup called Mojix, Inc. It uses "smart antennas" and "digital beam forming" to process signals in four dimensions - time, space, frequency and polarization. Mojix, founded by a former NASA scientist, promotes the technology for supply chain management and asset tracking.
Link
And as another feature:
In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.
Flexilis has suggested that the government adopt a dual cover shield and specifically designed RFID tag that would make the e-passport remotely unreadable until it is fully opened.
No changes have been made to the U.S. e-passport in response, according to the State Department.
- Some RFID critics wonder: Could government officials read the microchips in an enhanced driver's license or passport card by scanning people via satellite or through a cell phone tower network?
The short answer is no - because the chips in PASS cards and EDLs are "passive," or batteryless, meaning they rely on the energy of readers to power up. Passive tags are designed to beam information out 30 feet.
However, research is moving forward to make batteries tinier and more powerful, says Ari Juels, director of RSA Laboratories. A "semi-passive" tag that could transmit into the atmosphere when triggered by a reader "may be feasible at some point," he says.
Separately, a system called STAR, that adapts deep-space communications technologies to read passive tags from distances greater than 600 feet, was announced last year by a Los Angeles startup called Mojix, Inc. It uses "smart antennas" and "digital beam forming" to process signals in four dimensions - time, space, frequency and polarization. Mojix, founded by a former NASA scientist, promotes the technology for supply chain management and asset tracking.
#3
Original Poster
Join Date: Apr 2009
Location: FrostByte Falls, Mn
Programs: Holiday Inn Plat NW gold AA gold
Posts: 2,157
#4
A FlyerTalk Posting Legend




Join Date: Apr 2001
Location: PSM
Posts: 69,232
To be precise here, the numbers being collected are not the actual passport numbers but a serial number of the RFID that can be translated to the passport number by the folks with the database. Of course, the number never changes so as long as you can associate it with a particular person you can track them, but you aren't actually reading the passport number.
#6
Join Date: Jul 2008
Location: Florida
Posts: 3,006
#8
Original Poster
Join Date: Apr 2009
Location: FrostByte Falls, Mn
Programs: Holiday Inn Plat NW gold AA gold
Posts: 2,157
The way the first article read, the actual passport serial number, not the RFID serial number was compromised.
#9
FlyerTalk Evangelist
Join Date: Mar 2004
Location: Under an ORD approach path
Programs: DL PM, MM. Coffee isn't a drug, it's a vitamin.
Posts: 12,935
To be precise here, the numbers being collected are not the actual passport numbers but a serial number of the RFID that can be translated to the passport number by the folks with the database. Of course, the number never changes so as long as you can associate it with a particular person you can track them, but you aren't actually reading the passport number.
#10
FlyerTalk Evangelist


Join Date: Mar 2002
Location: An NPR mind living in a Fox News world
Posts: 14,343
Something that is cheap is one of those silvery-grey, translucent bags that electronics get shipped in. Since the passport is activated by a high frequency RF signal you can get one of those bags, and put a radio into it. If the radio stops working then it is a good shield against the theft of information. Wrapping it in foil/putting it into one of those containers meant to screen against x-ray exposure to film might work as well
The way the first article read, the actual passport serial number, not the RFID serial number was compromised.
The way the first article read, the actual passport serial number, not the RFID serial number was compromised.
Yes -- ordinary aluminum foil works very well.
#11
Join Date: May 2007
Location: BDL
Programs: United Platinum
Posts: 86
See, the tin foil hat types aren't wrong after all...
Even if the number can be matched up to the database by nefarious agency employees, they'd have access to your pass # anyhow.
Still, I'd still consider a tinfoil sleeve for my rfid enabled credit cards and passport.
Even if the number can be matched up to the database by nefarious agency employees, they'd have access to your pass # anyhow.
Still, I'd still consider a tinfoil sleeve for my rfid enabled credit cards and passport.
#14
FlyerTalk Evangelist




Join Date: Oct 2006
Location: Marriott or Hilton hot tub with a big drink <glub> Beverage: To-Go Bag DYKWIA:SSSS /rolleyes ☈ Date Night:Costco
Programs: Sea Shell Lounge Platinum, TSA Pre✓ Refusnik Diamond, PWP Gold, FT subset of the subset
Posts: 12,523

