E-passport security leaves something to be desired

LAS VEGAS'Two years ago, Lukas Grunwald demonstrated at the Black Hat Briefings how RFID tags could be read and manipulated in a supermarket. The tags have not yet caught on as a replacement for bar codes in the retail sector, but they now are being used in passports.

On Thursday, Grunwald, chief technology officer at DN Systems Enterprise Internet Solutions GmbH of Germany, returned to Black Hat to demonstrate how data on the passports could be accessed, manipulated and copied.

RFID is the use of radio frequency to remotely read and write data to embedded computer chips. The data on the chips can range from a static ID number to personal and biometric data. The United States now is requiring this technology on passports of persons entering the country.

A number of nations have begun issuing the e-Passports, but as Grunwald showed, access controls on many commonly used sophisticated chips leave something to be desired. Default encryption keys for one type of card are available on the Web with a littler clever searching.

'We got a whole lot of keys,' Grunwald said. 'It's publicly available through a Google search.'

He said that a test of a number of cards using the chips showed that 75 percent used the default keys.

During his briefing, Grunwald used his German passport to demonstrate security weaknesses. He was able to read the card using commercially available hardware and software, copy the data to another chip and replace the data on his own passport.

About the Author

William Jackson is a Maryland-based freelance writer.


  • Russia prying into state, local networks

    A Russian state-sponsored advanced persistent threat actor targeting state, local, territorial and tribal government networks exfiltrated data from at least two victims.

  • Marines on patrol (US Marines)

    Using AVs to tell friend from foe

    The Defense Advanced Research Projects Agency is looking for ways autonomous vehicles can make it easier for commanders to detect and track threats among civilians in complex urban environments without escalating tensions.

Stay Connected