p2pnet - rss feed: US spy chip passports
p2pnet.net News:- If you’re American and you didn’t follow Bruce Schneier’s advice in September to renew your passport, “even if it’s not set to expire anytime soon,” you’re screwed, blued and tattooed.
Because starting January 1, US passports will suddenly become of great interest to hackers, ID thieves, and other crooks with a geeky turn of mind.
That’s the date American passports will be issued with spy chips, aka RFID Radio Frequency IDentification tags and, “you don’t want one of these chips in your passport,” states Schneier.
Not to worry, though. If you’re, “Getting paranoid about strangers slurping up your identity,” Wired’s Jenna Wortham has a few thoughts.
“But be careful,” she warns, “tampering with a passport is punishable by 25 years in prison. Not to mention the ’special’ customs search, with rubber gloves”.
Meanwhile, she points out US spy chip passports, “have a distinctive logo on the front cover” with the tag “embedded in the back”.
But in case you’re thinking about ‘accidentally’ leaving your passport in the jeans you just put in the washer won’t work: “You’re more likely to ruin the passport itself than the chip”.
And, “Forget about nuking it in the microwave - the chip could burst into flames, leaving telltale scorch marks. Besides, have you ever smelled burnt passport?
The best approach, adds Wortham, is he judicious application of a hammer.
“Hitting the chip with a blunt, hard object should disable it, ” and, “A nonworking RFID doesn’t invalidate the passport, so you can still use it.”
Why bother?
“Passports with RFID chips store an electronic copy of the passport information: your name, a digitized picture, etc. And in the future, the chip might store fingerprints or digital visas from various countries,” says Schneier.
“By itself, this is no problem. But RFID chips don’t have to be plugged in to a reader to operate. Like the chips used for automatic toll collection on roads or automatic fare collection on subways, these chips operate via proximity. The risk to you is the possibility of surreptitious access: Your passport information might be read without your knowledge or consent by a government trying to track your movements, a criminal trying to steal your identity or someone just curious about your citizenship.”
Of all objections the state department received when it announced the (at the time) forthcoming Spy Chip Passport, “the overwhelming majority expressed concern over the potential for skimming and/or eavesdropping. Skimming is the act of creating an unauthorized connection with an RFID tag in order to gain access to its data,” said the RFID Journal, explaing, “Eavesdropping is the interception of the electronic communication session between an RFID tag and an authorized reader.”
But, “To prevent skimming, the department will add shielding material to the passport’s front cover and spine. The material is supposed to make the e-passport’s RFID tag unreadable as long as its cover is closed or nearly closed. The department will also implement Basic Access Control (BAC), which functions as a Personal Identification Number (PIN) in the form of characters printed on the passport data page. Before a passport’s tag can be read, this PIN must be inputted into an RFID reader. The BAC also enables the encryption of any communication between the chip and interrogator.”
Phew. That’ll be a relief to everyone with a new US passport ;p
Or not.
Security Focus has already reported a hack.
‘mrpkey.py’ will, “exchange crypto keys with the passport and read and display the contents therein, including the facial image and the personal data printed in the passport,” says the post.
Stay tuned.
If your Net access is blocked by government restrictions, try Psiphon from the Citizen Lab at the University of Toronto’s Munk Centre for International Studies. Go here for the official download, here for the p2pnet download, and here for details. And if you’re Chinese and you’re looking for a way to access independent Internet news sources, try Freegate, the DIT program written to help Chinese citizens circumvent web site blocking outside of China. Download it here.
Also See:
Bruce Schneier’s advice - Renew Your Passport Now!, September 18, 2006
Wired - How To: Disable Your Passport’s RFID Chip , December 23, 2006
RFID Journal - United States Sets Date for E-Passports, October 25, 2006
Security Focus - RFID enabled e-passport skimming proof of concept code released, October 27, 2006
p2pnet newsfeeds for your site | | rss feed: http://p2pnet.net/p2p.rss | | Mobile - http://p2pnet.net/index-wml.php
December 26th, 2006 at 8:10 pm
For some reason I have the feeling that this is gonna end badly. All the gadgets USA are using to protect themselves are gonna back fire at some points. Geeks with more knowledge will take advantage of it and some people will have their identities stolen.
December 26th, 2006 at 9:09 pm
a Hammer!?
WTF?
brute force might be the thing of the US military, but smart people use their old 5 bucks disposable one way camera with built in flash!
https://events.ccc.de/congress/2006/RFID-Zapper
December 26th, 2006 at 9:11 pm
wrong link, sorry
http://events.ccc.de/congress/2005/wiki/RFID-Zapper(EN)
December 26th, 2006 at 9:29 pm
“[…]or someone just curious about your citizenship.”
I already see the headlines:
Insurgents in [enter next US invaded country here] are now using “smart” booby-traps; will only explode when the built in sensor detects an american.
Thats so sick!
December 27th, 2006 at 1:44 am
Now you can claim to be from an nationality you wish as far as vocal communications go to hide the idea you are a potential hostage to be used against the US.
As soon as these come into effect, all you need is a reader that recognizes the RFID is included in a passport. Doesn’t matter if you can read the data, just that data is present in the form of an RFID. Almost immediately you are identified as a US citizen and a target for whatever or whoever happens to be in the market for a hostage. Stand on a street corner of a busy metropolis and go fishing with a reader. Sooner or later you’ll get lucky depending on how wise you are in your choice of location.
Nothing like advertisement provided by our government to assist in the identification, is there?
December 27th, 2006 at 2:15 am
they have these RF ID chips in their Passports too, so …
you are not alone, I’ll be here with you nanana nana. (me humming some Michael Jackson tune now)