09/30/2008
E-passports can be falsified without any alerts going off, make your own
"THC/vonJeek proudly presents an ePassport emulator. This emulator applet
allows you to create a backup of your own passport chip(s).
A video demonstrating the weakness is availabe at
http://freeworld.thc.org/thc-epassport/
The government plans to use ePassports at Immigration and Border Control.
The information is electronically read from the Passport and displayed to a Border
Control Officer or used by an automated setup.
THC has discovered weaknesses in the system to (by)pass the security checks.
The detection of fake passport chips is no longer working.
Test setups do not raise alerts when a modified chip is used.
This enables an attacker to create a Passport with an altered
Picture, Name, DoB, Nationality and other credentials.
This manipulated information is displayed without any alarms going off.
The exploitation of this loophole is trivial and can be verified using thc-epassport."
comment
We knew this would happen.
The research to discover vulnerabilities - which obviously wasn't done
during the production phase has turned into research to manipulate these vulnerabilities.
There is only one efficient control and that is human control and this is why border controls
should be human in the first place,
before entering (appliant case) during (control) and afterwards (analysis travels)
14:47 | Permalink | Comments (0) | Email this
|
|
del.icio.us
|
|
Digg |
Facebook




Post a comment