Bollox to RFID

Image: 

You most probably know by now of the proposed "ultra-secure passports" that are recently introduced to over 3 million British citizens that contain a small chip with your information (biometrics - finger print, retina scan, etc.), and you most also probably know that the government is to be trusted both to the reasons of having such an invasion of privacy, and that it would be properly dealt with and secured.

Well arn't you up for a surprise then :)

Apparently it is very easy to extract all the data out of it and display it all onto a notebook or computer, even though, and i quote,

For example,

* All it takes to ruin someone's life, smuggle yourself, forge a passport or identity, or even prove the government wrong regarding the millions spent to "tackle terrorism" as they say, is a £174 chip reader, some information of the passport's owner of which is even written on the passport itself, and 4 seconds in order to get a copy of all the data for yourself.

* The key needed to access the data on the chip should be comprised of, in the following order, the passport number, the holder's date of birth and the passport expiry date. All of the information needed can be found on the passport itself. It's like writing your password in front of the keyboard more or less....

So as you can see, even though the government is using 3DES encryption, they're using a very poor method to create the key.

Worst of all, you don't even need to steal the passport from the victim. The government claims the new chips can be read over a distance of just 2 centimeters, however, tests have clearly shown that it's possible to read the information from a distance of up to 30 centimeters. Some claim that with a bluetooth antenna you could increase the distance up to 10 meters. You thought getting your oyster card read was bad enough, imagine a card that has your address, personal information, and even a copy of your facial, retina, and thumb prints.

So what happens now? Here are a few possibilities.

* The attacker now has access to your thumb print and retina scan. I'll leave it to your imagination to what the attacker can do with that... (future bank accounts, border controls, etc..)

* The attacker now can clone his or her own passport that would allow for the attacker to illegaly enter another country.

All I can say is, if you're going to do a job, do it right!. Either stop cutting corners, stop breaching our rights for whatever reasons you claim are justifiable, or don't do it in the first place. If we were talking about a dialysis machine or a pacemaker, i doubt they'd have the same leniency in releasing an embarrassing result, and then spending a few years to fix it.

In other news, if you're opposed to the ID card system and would like it to be scrapped, sign the petition and make a difference!

Read More.

Update: 01/12/06 @08:36pm: Well well, check out this link and read about how a BBC journalist managed to easily obtain 20 forged passports and enter the UK twice with them...