Cloning e-passports: An old trick that can still work
- By William Jackson
- Aug 08, 2008
LAS VEGAS'Dutch security researcher Jeroen van Beek demonstrated once again this year at the Black Hat Briefings how to clone an electronic passport, a trick that many say is old news since it dates back to 2006.
'This is not a new or unknown vulnerability of the first generation e-passport,' said Brook Hamilton, a spokeswoman for Entrust, a company that provides security for electronic documents. 'But it is na've to think a clone passport won't get caught at the border crossing of a country using e-passport technology,' because digital signatures on the cloned passport would not match the originals.
Maybe not, according to van Beek. All data on an e-passport is hashed and digitally signed. Once cloned and altered, either the hash or the digital signature won't match the original. But real time validation of digital signatures is not done by most countries, he said. When it is done, an invalid signature is classed as a non-critical error under the reference implementation for the international standard for the documents. The error is ignored if the rest of the information on the passport checks out.
If the original signature is copied and retained on the cloned passport, it will not validate the data that has been altered. But that error is classed only as a warning, and again as long as the passport looks valid, it will be passed.
'If the reference implementation is not that strict, what about real world set-ups?' van Beek asked.
Advanced authentication technology used to protect e-passports can be circumvented by just removing it from the cloned document. Because it is an optional feature, its absence does not create an error when the passport is authenticated.
Optional security features are the problem with the international electronic passport scheme, van Beek said. The standard is good, but the implementation is too weak. Optional security controls lower the security for the entire global system to the lowest common denominator. Cloned e-passports can be detected, but they often are not.
Van Beek's suggestions for improving the system are:
- Require security features in the documents by default.
- Require security features to be implemented in authentication systems.
- Provide a global Public Key Infrastructure to authenticate digital signatures at all authentication points.
- Create standards for approved hardware and software, with a specified lifespan./li>
William Jackson is a Maryland-based freelance writer.