E-passport security leaves something to be desired

LAS VEGAS'Two years ago, Lukas Grunwald demonstrated at the Black Hat Briefings how RFID tags could be read and manipulated in a supermarket. The tags have not yet caught on as a replacement for bar codes in the retail sector, but they now are being used in passports.

On Thursday, Grunwald, chief technology officer at DN Systems Enterprise Internet Solutions GmbH of Germany, returned to Black Hat to demonstrate how data on the passports could be accessed, manipulated and copied.

RFID is the use of radio frequency to remotely read and write data to embedded computer chips. The data on the chips can range from a static ID number to personal and biometric data. The United States now is requiring this technology on passports of persons entering the country.

A number of nations have begun issuing the e-Passports, but as Grunwald showed, access controls on many commonly used sophisticated chips leave something to be desired. Default encryption keys for one type of card are available on the Web with a littler clever searching.

'We got a whole lot of keys,' Grunwald said. 'It's publicly available through a Google search.'

He said that a test of a number of cards using the chips showed that 75 percent used the default keys.

During his briefing, Grunwald used his German passport to demonstrate security weaknesses. He was able to read the card using commercially available hardware and software, copy the data to another chip and replace the data on his own passport.

About the Author

William Jackson is a Maryland-based freelance writer.


  • Records management: Look beyond the NARA mandates

    Pandemic tests electronic records management

    Between the rush enable more virtual collaboration, stalled digitization of archived records and managing records that reside in datasets, records management executives are sorting through new challenges.

  • boy learning at home (Travelpixs/Shutterstock.com)

    Tucson’s community wireless bridges the digital divide

    The city built cell sites at government-owned facilities such as fire departments and libraries that were already connected to Tucson’s existing fiber backbone.

Stay Connected