Guardian cracks high-security UK passport in 48 hrs

[Bob Crabtree]

The Guardian newspaper reports that it took a tame security advisor just 48 hours to write software that can pull off information remotely from the latest 'ultra-secure" UK passports.

The newspaper also points out that the problems it has identified with RFID chips in passports raise a lot of worrying questions about the use of such chips in the UK's proposed ID card scheme.

Find out more in this HEXUS.lifestyle.headline - and be sure to share your thoughts here on this very worrying issue.

[IBM]

Oh god...

[Thorburn]

Pffff, I could of done it in 5 minutes by opening the handily attached physical passport which contains all the same information

The real worry is if they can clone or alter the contents of it.

[GoNz0]

either way its going to make it harder to copy a passport if they have to include a chip.
it should help push the costs of a fake passport up so much that the average immigrant cant afford one on top of his banana boat trip to the UK ?

[iranu]

either way its going to make it harder to copy a passport if they have to include a chip.
it should help push the costs of a fake passport up so much that the average immigrant cant afford one on top of his banana boat trip to the UK ?

Not really. The way to obtain one of these so called super duper passports is to fake all the other items of identification that are required to obtain one. Drivers licence, utility bills, bank accounts etc etc. Then once you have the passport you are legit and can use it for anything. Not rocket science really and btw it's gonna cost £18 billion or 6p off the rate of income tax.

[djwhizzkidd]

David Icke wont like these new passports.

[vicar]

It was an open secet that it can be cloned if you have the knowledge. It was a very naive to stupid idea in the first place.

[awm]

OK governments, take a deep breath, RFID may seem cool but its really a bad idea. The privacy concerns are bad and I don't want a beacon that can broadcast my personal details and other information that some passports can broadcast.

[chrestomanci]

either way its going to make it harder to copy a passport if they have to include a chip.
it should help push the costs of a fake passport up so much that the average immigrant cant afford one on top of his banana boat trip to the UK ?

You mean instead of a banana boat trip to the UK.

The average illegal imigrant pays upwards of £10k for their dangerous one way trip to the UK. If they had a convincing fake or cloned UK passport they could just hop on a scheduled flight instead.

This means that even if it is quite hard to make fakes they may still be cost effective for illegal imigrants (let alone smugglers or international criminals). If someone in Shanghi or Lagos starts selling convincing fakes for £5k a pop they will probably have a ready market. Because of this the security on new passports needs to be strong enough that it is much more expensive than that to make fakes.

[Bob Crabtree]

either way its going to make it harder to copy a passport if they have to include a chip.
it should help push the costs of a fake passport up so much that the average immigrant cant afford one on top of his banana boat trip to the UK ?

Why should the average immigrant require a banana boat? The average immigrant is a legal entrant.

[CrazyMonkey]

... We always muck up, immigration, iraq, passports.. What next.
The person responsible for cracking it could have posted more complex information than just the terms "brute force" and where to obtain the information that is key to the crack

[nichomach]

OK governments, take a deep breath, RFID may seem cool but its really a bad idea. The privacy concerns are bad and I don't want a beacon that can broadcast my personal details and other information that some passports can broadcast.

Quite so; if biometric data and personal information HAD to be included, then it would have been easier, cheaper and safer to use a chip read by a contact reader.

[5lab]

i'm pretty sure the rfid tags on these only have a range of 2-3" (can't remember where i read that) - so yeah, they're not secure, but you can't get someone sitting at the side of the road getting you in your car..

there's not actually much information on your passport.. passport number, photo (don't think that's going to be stored digitally yet), date of birth.. that's about it.. there's not a huge amount someone can do with your name and date of birth, and its not like they can't get those details from elsewhere!

[chrestomanci]

i'm pretty sure the rfid tags on these only have a range of 2-3" (can't remember where i read that) - so yeah, they're not secure, but you can't get someone sitting at the side of the road getting you in your car..

The quoted range is based on a normal reader with a simple antena and running at low power.

If a hacker has a highy directonal antena, and runs it at increased power, you could probably multiply the range by at least 100.

Similar hacks have been done with bluetooth. It is only supposed to have a range of 5-10m, but by hooking up 50cm long Yagi antena to a laptop bluetooth card, hackers have been able to crack phones at 2-300m.

there's not actually much information on your passport.. passport number, photo (don't think that's going to be stored digitally yet), date of birth.. that's about it.. there's not a huge amount someone can do with your name and date of birth, and its not like they can't get those details from elsewhere!

That depends what information the bad guys are after.

There are plenty of fanatics in the middle east who chant "Death to all Americans" Imagine them building a smart bomb that detects a passing american from their RFID passport. A still smarter one could even target a specific individual.

[chuckskull]

So basically the put really high end encryption on it, but makes the key public to allow decryption? Very smart

Nothing is 100% secure though and 48 hours is pretty good for something you have physical access too. They don't mention whether it would take 28 hours for each passport, though. I'm guessing not, but unless they can get it to less than a few seconds they'll be pretty secure, so long as you keep hold of it.

[GeorgeTuk]

Not suprised the government have no clue what they're doing with IT. I don't blame them per se, just the people they take advice from. You know at the top of all these project is some bod who just hears something nice and decides to go with it.

I have witnessed it happen in the MoD so imagine it to be pretty similar elsewhere. And the technology, Wiki, and they forged ahead despite no expertise on board so it cost them alot more to get in the extra skills and pay the original engineers.