RFID Hacking Series: E-Passports
I just recently returned from Stockholm, Sweden where I presented on “Assessing the Security Risk of Cloud Computing” at the Sec-T Conference. Amazing conference with a lot of great speaker’s and content. Shortly before I went on I was able to catch Adam Laurie’s presentation on a “Day in the life of a hacker”. Adam’s presentation was great but what really caught my eye was the research he has done on RFID exploitation. I’ve read about RFID hacking and the tradecraft that is required to pull off such a feat. To actually see this in real time was price-less. What made the presentation more interesting is that Adam selected an individual from the crowd that was brave enough to give his E-Passport up for a live demonstration. Within seconds, Adam was able to harvest all of the data off the E-Passport. Additionally, he had the capability to change the picture and even digital sign the passport. Some might chalk this up to a nice bar trick since the E-Passport was open and pressed against the RFID reader.
However, that is not the case with E-Passports as they use ISO 14443 contactless smart card technologies that has a read range of up to a few inches…so the standard claims. After doing some digging, I found someone that was successful at reading contactless smart card at 50M in 2005 (http://www.rfidblog.org.uk/hancke-rfidrelay.pdf). That’s where the cool little bar trick turns into a pretty big issue. Your identity is worth something to someone depending on the context. The following Youtube video takes the context of identity to a much different level…check this out: http://www.youtube.com/watch?v=-XXaqraF7pI&feature=related. I would fast forward to 2 minutes and 40 seconds into the video. The proof of concept is interesting and plausible but not enough to make me second-guess as I walk by a garbage can in another country.
To the greater security community this is nothing new and alarming but seeing it first hand as I mentioned was price-less. However, we shouldn’t just pick on E-Passports, as they are not the only ones using contactless smart card. What about credit cards that use contactless smart cards? Stay tuned for more in the RFID Hacking Series.
For those of you that are not familar with RFID technology, the following is a quick primer:
RFID: radio-frequency identification, RFID can take the form of Passive and Active Tags. Passive tags have no power and rely on the reader to provide power and Active tags actually contain an onboard power supply. RFID’s are made up of 3 parts: RFID tag, Antenna and RFID Reader. Data is stored on the RFID tag, which can consist of Personal Identifiable Information (PII) in the case of E-Passports that can be transmitted freely with the right RFID reader. For further information on RFID technology, check out: http://www.rfid.org/
The above comments are strictly mine and mine only, they in no way reflect the position of my employer, management or any other organization with which I’m associated.
Comments
Leave a Reply
Matthew Pour on 09.26.2009
I’ve converted my tin foil hat into a tin foil wallet.