As the U.S. prepares to embed all its passports with R.F.I.D. chips, a hacker in Germany has already rendered the new I.D. system obsolete.
"The whole passport design is totally brain damaged," security consultant Lukas Grunwald told Wired News. "From my point of view all of these RFID passports are a huge waste of money. They're not increasing security at all."
In Grunwald's native Germany, they've already begun issuing these new "high tech" passports. It took him all of two weeks to figure out how to clone one.
The new passports have chips in them that store encrypted data that acts as a kind of unique signature for each traveller.
"And of course if you can read the data, you can clone the data and put it in a new tag," Grunwald says.
With the U.S. set to introduce similar passports this fall, the question is "why bother?"
"Either this guy is incredible or this technology is unbelievably stupid," says Gus Hosein, senior fellow at Privacy International, a U.K.-based group opposed to R.F.I.D. passports. "Is this what the best and the brightest of the world could come up with? Or is this what happens when you do policy laundering and you get a bunch of bureaucrats making decisions about technologies they don't understand?"
Grunwald demonstrated for Wired how absurdly easy it is to make a fake E-passport. He placed one atop an official passport-inspection RFID used at border crossings -- anybody can order one. Even if they weren't readily available, Grunwald says you can build one for about $200.
He then used secunet Security Networks' Golden Reader Tool to extract the information on the chip. It took about four seconds. From there it was a simple matter of loading the info onto another chip and installing it into a fake passport.
Grunwald has been warning folks about R.F.I.D. issues for years. In January of 2004 he warned that R.F.I.D. rewriting technology would make it easy for shoplifters to remark inventory or just cause general mayhem.
Not only is the government planning to put R.F.I.D. tags into passports, they also want use them on immigrants, pets, A.I.D.S. patients ... basically anyone that doesn't meet their standards.
The weakness of these new "security" measures comes just a day after a Government Accountability Office testimony said that our border guards already have a bad habit of ignoring fake I.D. cards.
No comments:
Post a Comment