Victor Roncea Blog

• Share
• Tweet
• Pin
• Email

Researcher gives Elvis and bin Laden fake e-passports
By John Lettice
The ‘fraud-proof’ e-passport can be copied and altered, a Dutch security researcher has demonstrated. In tests conducted for the Times, Jeroen van Beek of the University of Amsterdam changed the chip data in a normal UK e-passport to contain a picture of Osama bin Laden. The paper also reports that van Beek has contrived to have a passport in the name of Elvis Presley accepted by a public e-reader in a Dutch town hall.
Van Beek’s work builds on earlier demonstrations which showed how a passport chip could be cloned, and subsequently how this could be done without even taking it out of the delivery envelope. Such exploits could be of some use to passport fraudsters – for example a copied chip could be palmed at an unattended reader or a complete copy of a passport that hasn’t even been stolen could be used so long as the bearer resembled the original holder.
Being able to write a new picture and new personal data to a chip without detection would however mean that the e-passport had been totally subverted.
This however is not quite what van Beek has done. The integrity of the data in the e-passport is protected by a digital signature, and alteration of the data will result in the passport being rejected by the reader. In addition to changing the data, van Beek appears to have been able to write a new signature to the chip that will pass muster, but only under certain circumstances.
Validation of the signatures on e-passports requires the exchange of PKI certificates between countries’ issuing authorities, or the use of ICAO’s PKD (Public Key Directory) system. Logically the ICAO PKD system ought to be used to provide a standard level of validation for what is intended to be a global, secure document standard. Currently, however, use of the PKD is far from universal, and many countries (the UK included) rely on bilateral exchange of certificates with other countries.
So whether or not a fake van Beek passport will pass muster will depend on a number of factors. If the reader used is an early one, it may not check the signature at all. If the passport’s purported issuing authority hasn’t exchanged certificates with the country operating the reader, then the signature can’t be checked. And if one or both of the countries involved isn’t using the PKD, again the signature can’t be checked.
Which at the moment means that this class of fake would be good enough to get through quite a number of borders. The data used in van Beek’s fake chips (bin Laden, Elvis) was deliberately selected to avoid accusations of forgery, but as e-passport fakery becomes more plausible, it seems only a matter of time before researchers, campaigners or plain old forgers start trying to get them through borders. And in the case of the latter, if they succeed, how will we tell? ®

Related stories
Elvis has left the border: ePassport faking guide unleashed (30 September 2008)
Passport snooping public servant faces year in the can (23 September 2008)
Free passports for WWII generation hit 500,000 (7 August 2008)
Blank robbers swipe 3,000 ‘fraud-proof’ UK passports (29 July 2008)
How to clone a biometric passport while it’s still in the bag (6 March 2007)
Shock, horror, outrage – biometric passport data snooped, again (17 November 2006)
Analysis How to clone the copy-friendly biometric passport (4 August 2006)

Vezi si
Délibération n°2007-368 du 11 décembre 2007 portant avis sur un projet de décret en Conseil d’Etat modifiant le décret n°2005-1726 du 30 décembre 2005 relatif aux passeports électroniques
https://www.cnil.fr/?id=2427
si
EUROPEAN DATA PROTECTION SUPERVISOR
Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the
European Parliament and of the Council amending Council Regulation (EC) No 2252/2004 on
standards for security features and biometrics in passports and travel documents issued by
Member States
https://www.edps.europa.eu/EDPSWEB/webdav/shared/Documents/Consultation/Opinions/2008/08-03-26_Biometrics_passports_EN.pdf

• Share
• Tweet
• Pin
• Email