Re: [Full-disclosure] RFID enabled e-passport skimming proof of concept code released (RFIDIOt)

Michael Holstein wrote:
That article focuses on Dutch passports, but in the US it's essentially
the same.

The Passport number

a 10 digit number (I don't know where they start, but it certainly
wasn't 0000000001).

If they're sequential, we only need to know where they start once the
chips are installed, assuming you get a new passport number when you
renew (as you do in th UK).


The Date Of Birth of the holder

about 32,000 possibilities (assuming < 90yrs old)

The Expiry Date of the Passport

Passports are vaild for 10 years (for an adult in the US), and
expiration is just MM/YYYY .. so that's only 120 possibilities.

Currently even less, since, again, it will expire 10 years from the date
chips were first installed, so here in the UK there is only one valid
year so far, so only 12 possibilities.


A very small dictionary for "brute force" indeed, and I'd be happy to
code such a routine.

Thanks for the offer, but I'm already pretty much there... It'll be in
the next release... :)


Does anyone know if the chips in the latest passports (USA issue)
prevent this sort of thing, or can you try keys as fast as the RF
interface will permit?

There is nothing in the standard to require anti-bruteforcing mechanisms
such as timing backoffs etc., and although I haven't done exhaustive
tests on this, trying multiple wrong keys doesn't seem to have any bad
effect on a UK passport.

Using my python library I get about 3 tries per second, but I expect
that speed could be improved...

cheers,
Adam
--
Adam Laurie Tel: +44 (0) 1304 814800
The Bunker Secure Hosting Ltd. Fax: +44 (0) 1304 814899
Ash Radar Station http://www.thebunker.net
Marshborough Road
Sandwich mailto:adam@xxxxxxxxxxxxx
Kent
CT13 0PL
UNITED KINGDOM PGP key on keyservers

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Airline Tests RFID On The Fly
    ... Airline Tests RFID On The Fly ... of controversial new passports equipped with remotely readable chips. ... curb passport fraud and speed up border crossings, according to Frank Moss, ... "We are seriously considering the adoption of basic access control," ...
    (soc.culture.malaysia)
  • Re: new labours fake fakeproof passport.....
    ... The altered chips were then passed as genuine by passport reader ... The chip in the passport does not make you more secure, ... Politicians are dangerously uneducated, and is why they are suckered time ...
    (uk.politics.misc)
  • Re: OT - RFID chips in passports next year
    ... RFID chips, like all other chips, can and do ... > All chips fail; eventually. ... AND for RFID chips to return a signal over any distance,they have to be ... >>AFAIK,one uses a passport when crossing the US BORDER. ...
    (rec.autos.driving)
  • Re: Biometric passports
    ... a digital photograph of the passport holder's face printed on the ... >> data page of the passport will be the acceptable standard. ... >> circuit chip capable of storing the biographic information from the ... How often do you think these chips fail? ...
    (rec.travel.europe)
  • [Full-disclosure] RFID enabled e-passport skimming proof of concept code released (RFIDIOt)
    ... personal data printed in the passport. ... The ICAO standard relies on a 'secret' key to protect the RFID chip from ... Others have also highlighted the possibility of bruteforcing the keys, ...
    (Full-Disclosure)