All of Your Passports are Belong to Us

David Heath
Wednesday, 29 October 2008 04:35

Your IT - Home IT

For some time now, it has been common knowledge that the RFID chips in Electronic Passports were insecure.  The announcement by hacking group “The Hackers Choice” of a tool to allow ‘cloning’ of any ePassport confirms the problem.

There have been many stories on the web (here for instance) where hackers with access to an Electronic Passport were able to read the contents and learn useful things about the owner.  Initially this required close access to the password (within perhaps 10cm).  Recent ‘advances’ have meant that the same process can be accomplished from a distance of over 3 metres.

Indeed, there is speculation that the range may exceed 10m as techniques are improved.

But, it gets worse. 

The Hackers Choice has recently published information describing how to clone a passport RFID chip and even to modify the contents without being detected.  The ‘contents’ being pretty-much everything you’d find printed on the passport – full name, nationality, date of birth, digital photo etc.  As an aside – did you realise that the reason all photos must be taken without smiling and with the subject looking directly at the camera is that face-recognition software is applied to every image in order to detect people applying for multiple passports.

Now, this doesn’t get around the fact that the information is also stored on central computers in the issuing country, but then again, other countries have no access to this information (yet).  So it’s likely that an issuing country might detect such a modified passport at their border, but unlikely that it will be found at a foreign border.

So, you might ask, haven’t fake passports been around forever?

Well, yes they have.  But in order to clone a non-electronic passport, you actually needed to have the passport in your possession, without the knowledge of the owner, for a period of time.  This is no longer necessary – electronic passports are essentially shouting their contents to the world and anyone with the nous and equipment to listen to the shouting can have their pick of the passports close-by.

Imagine you pack this equipment into a very normal-looking briefcase for your next overseas trip.