Slashdot Log In
Hackers Clone Elvis' Passport
Posted by
samzenpus
on Thu Oct 02, 2008 04:30 AM
from the don't-mess-with-the-king dept.
from the don't-mess-with-the-king dept.
Barence writes "Hackers have released source code that allows the 'backup' of RFID-protected passports, although the tool can potentially be used to create fake or cloned documents. The Hacker's Choice, a non-commercial group of computer security experts, has released a video showing a cloned passport being approved by a security scanner at a Dutch airport. When the reader scans the passport, it is revealed to belong to one Elvis Aaron Presley, complete with picture. Reports of the hackers serenading security staff with 'Are You Clonesome Tonight' are unconfirmed."
Related Stories
[+]
Your Rights Online: Interpol Pushing World Facial Recognition Database 171 comments
The Register is reporting that according to some reports, Interpol will soon be pushing for a world-wide facial recognition database at the borders of all member nations. "The UK already has airport gates equipped with such technology, intended to remove the need for a human border guard to check that a passenger's face matches the one recorded in his or her passport. According to the Guardian, Interpol database chief Mark Branchflower believes that his organization should set up a database of facial-recognition records to operate alongside its existing photo, fingerprint and DNA files."
[+]
Your Rights Online: Researchers Find Problems With RFID Passport Cards 172 comments
An anonymous reader writes "Researchers at the University of Washington have found that RFID tags used in two new types of border-crossing documents in the US are vulnerable to snooping and copying. The information in these tags could be copied on to another, off-the-shelf tag, which might be used to impersonate the legitimate holder of the card." You can also read the summary of the researchers' report.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Obligatory (Score:5, Funny)
Elvis has left the building
Re:Obligatory (Score:5, Funny)
On a day when we are going to be giving hundreds of billions to dodgy bankers, on a day when suicide bombs have returned to Baghdad, on a day when the most influential vice-presidential nominees for a lifetime will go toe-to-toe, surely there is more important news [bbc.co.uk] for /. to report!
Parent
Re: (Score:2)
Well, none of the above were too surprising, right? So this deserves the headlines just for being damn funny amidst all the other bullshit that's going on.
Re: (Score:3, Informative)
Re: (Score:3)
if slashdot reported everything that was "at some level" technology news, it would just be a news site.
No, it would be a conspiracy theory clearinghouse.
Re:Obligatory (Score:5, Funny)
Parent
Re: (Score:2)
Elvis has left the building
Well, if your a programmer .. you can only conclude that Elvis is re-entrant and thread safe.
He left, re-entered and again left the building while leaving behind a small local mess to clean up.
If only it were (just *) local ....
Re:Obligatory (Score:5, Funny)
Elvis has left the building
Elvis has left the building
And the other Elvis has left the building
There, fixed that for you.
Cheers!
Strat
Parent
Re:Obligatory (Score:5, Funny)
Elvis has left the building
Elvis has left the building
And the other Elvis has left the building
There, fixed that for you.
Cheers!
Strat
Well, sort of .. but where do I find MAX_ELVIS ?
Parent
Re:Obligatory (Score:5, Funny)
#include <rock-n-roll.h>
Parent
Re:Obligatory (Score:5, Funny)
Thank you, Thank you very much.
Elvis
Parent
Re: (Score:2, Funny)
with his blue suede shoe bombs
Re: (Score:3, Funny)
Re:Obligatory (Score:5, Interesting)
Ever since that cracker got me
I found a new place to dwell.
It's down at the end of cloned street
At pwned hotel.
(chorus)
You make me so cloned baby,
I get so cloned,
I get so cloned I could die (again and again).
And although its always crowded,
You still can find some room.
Where broken hearted users
Do cry away their gloom.
(chorus)
Well, the spammer's mail keeps flowin,
And the desk clerks dressed in black.
Well they been so long on cloned street
They ain't ever gonna look back.
(chorus)
Hey now, if a cracker gets you,
And you got a tale to tell,
just take a walk down cloned street
To pwned hotel.
Parent
I can fix that for you... (Score:5, Funny)
That little problem goes right away... just add "Elvis Aaron Presley" to the no-fly list.
We is all secured again, and permanently this time!
He doesn't need to fly (Score:3, Funny)
Won't work. Elvis is everywhere [google.com]
Re:I can fix that for you... (Score:5, Funny)
Parent
Re:I can fix that for you... (Score:5, Funny)
He's coming back for the Olympics? So, he's just be away all this time getting back in shape?
Parent
Re:I can fix that for you... (Score:5, Funny)
Hello,
You have used our copyrighted phrase '2012', thereby destroying the branding of the British Olympics. You owe us 12Bn poonds.
We look forward to recieving your remittance by return.
- IOC IP enforcement department.
Parent
Re:I can fix that for you... (Score:4, Informative)
How the hell did this get modded "interesting"?? Is there some widely accepted theory about Elvis returning in 2012 I've missed?
Who the hell gets mod points nowadays?
Probably related to the end of the Mayan Long Count calendar, which was really accurate for 5,125 years, but it all of a sudden ends on the Winter Solstice in 2012 [wikipedia.org], nobody knows what's going to happen.
I like to think of it as Peter Venkman said, "Human sacrifice, dogs and cats living together... mass hysteria!" Elvis caused mass hysteria, ergo Elvis comes back.
Parent
Re:I can fix that for you... (Score:4, Informative)
yes we do. Life goes in earth's new cycle of 26,000 years...
Prophecy is bullshit stemming from a religious mind.
from http://www.crawford2000.co.uk/maya.htm [crawford2000.co.uk]
"Over a year's time the Sun transits through the twelve houses of the zodiac. Many of us know this by what "Sun sign" is associated with our birthday. Upping the scale to the Platonic Year - the 26,000 year long cycle - we are shifting, astrologically, from the Age of Pisces to the Age of Aquarius. The Mayan calendar does not really "end" in 2012, but rather, all the cycles turn over and start again, vibrating to a new era. It is as if humanity and the Earth will graduate in the eyes of the Father Sun and Grandmother Milky Way. "
For as long as I have been alive, doom and the end have always been so close but unfortunately it's always a lie.
Parent
Be careful... (Score:3, Insightful)
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Actually, the Dutch don't own a little piece of Cuba, so no need to panic. Also, laws are relatively sane, so I doubt the people who did this are going to get in trouble, especially since the copied passpart is so obviously fake, and merely proof-of-concept instead of something to be used in an evil plot to take over the world.
Re:Be careful... (Score:4, Interesting)
Parent
Re:Be careful... (Score:5, Insightful)
Parent
Re:Be careful... (Score:4, Insightful)
The card they use in the video doesn't appear to be a real passport, only the chip (that may or may not have been removed from a password). Even if what they did is illegal, I would be extremely suprised if anyone involved were to end up in prison, although they may be fined, especially if they got the chip out of a real passport (like you suggested).
Parent
Re:Be careful... (Score:4, Insightful)
Unfortunately the current mob in (sort of ) charge here are right up the illiberal-fuck brigade's arse.
When it was recently demonstrated that the new national travelcard is broken (Mifare [computerworld.com]) the response was a typical mixture of outrage, damming everybody as criminal, and refusing to accept that people with science degrees are a darn sight smarter than the bunch of PR/MBA wankers who fell for the Mifare sales spin.
Parent
Osama Bin Laden (Score:5, Funny)
Re:Osama Bin Laden (Score:5, Funny)
I would suggest a very fat white guy in a flannel shirt : )
Parent
Re:Osama Bin Laden (Score:4, Funny)
Parent
Re: (Score:3, Funny)
Re:Osama Bin Laden (Score:5, Funny)
Parent
Misconfigured scanner (Score:2, Informative)
This "hack" just worked because scanner they used to validate the passport permitted self signed certificates.
Of course, it is good to show that scanners must be properly configured to be any good.
Re:Misconfigured scanner (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
Schneier looks to be wrong about multiple CAs. They don't cause the problem he's talking about.
Without having a global CA:
UKCA can make certs
USCA can make certs
I trust certs from both CAs. I only trust UKCA with certs /C=UK and USCA with /C=US. Both CAs can make certificates for the other country, but that doesn't mean the end user trusts it.
jh
Before passing through security (Score:5, Funny)
Bad title (Score:5, Insightful)
They created a passport with fake details which matched the identity of another person. Nothing was cloned. I bet it wasn't even his passport picture, but a stock photo from the web.
Re:Bad title (Score:5, Insightful)
Which, from the face of it, makes the feat even more impressive. Cloning means "simply" reading the data from one passport, and copying it onto another. It is not necessary to decrypt this data, as long as the chip is tricked into releasing it.
Instead, they created a completely new data set, put this on the chip, and programmed the chip so it correctly answers to the challenge posed by the reader.
Now the idea of having the data encrypted in the passport chip may be wishful thinking of course... I would expect it is encrypted, if not then it's of course one step less for these hackers. At the very least I would expect some cryptographic checksum, based on some secret key or so, to verify that the passport (i.e. the data on the chip) has been government issued.
No matter what, a neat hack, and scary that it is possible in the first place.
Parent
Re: (Score:3, Funny)
Never let a computer do a job that can be done by (Score:5, Insightful)
"Never let a computer do a job that can be done by a human."
I just can't agree with this.
People can be fooled easily enough and the more that's automated properly the better. A human(well thousands of them) *could* do all the interest calculations at your bank but it would be stupid to do it that way.
There are loads of jobs out there which are better done by machines.
Hahahahahaha (Score:4, Informative)
Of course we already knew, when U.S. passport encryption was broken in all of 2 hours, that this was inevitable.
And the government did it all in the name of more "security".
But as we know, it is actually less freedom, and LESS security. This is just more proof.
Sorry, proves nothing (Score:3, Interesting)
This isn't a security scanner anymore than the previous scanner he checked out at his local Govt building - in fact it's probably nearly the same damned thing! This is simply a device that is showing the data on the chip - I'm not convinced that it is doing ANY security checks that a "real" security scanner would do. How smart would it be to put a machine out with the same checks as a security portal to allow counterfeiters to practice on? Umm, Duh?? Cloning easy, modifying of data NOT!
Yes, the data has been modified and the signature broken, it remains to be seen what the scanner will do when it sees a broken signature or self signed cert on the passport. As was explained in the talk at BH SOME countries HAVE exchanged PKI information so at least some countries ought to be aware of what the signature SHOULD look like and SHOULD be able to spot fakes. It's also not clear that modifying the security file on the passport to change what security protections it reports isn't going to be spotted either since passing THAT information is also possible. Lastly, passing trusted PKI around need not actually take place - if I see 500 German passports who ALL have the same PKI signature and 1 that doesn't it's a pretty good bet that the *1* has an issue! No secret squirrel passing of certificates required in that case.
Bottom line is - no one knows exactly what the various security stations will actually check for and how closely they really follow the lax security of the Gold Disk standard that much of this presenters testing was based off of. The only way to know any of this is to attempt to USE one of these or get the Govt's to talk - what are the chances of THAT?!
So, interesting demo but I'm not convinced it proves that fake passports with *modified* data can be made. At least some better understanding of how the data is being stored and interacted with has occurred I'd say...
Obvious Fake (Score:4, Informative)
For conspiracy theorists: Elvis' middle name was Aron, not Aaron, right?
Wikipedia says "Presley's genuine birth certificate reads "Elvis Aaron Presley" (as written by a doctor). There is also a souvenir birth certificate that reads "Elvis Aron Presley." When Presley did sign his middle name, he used Aron. It reads 'Aron' on his marriage certificate and on his army duffel bag. Aron was apparently the spelling the Presleys used to make it similar to the middle name of Elvis' stillborn twin, Jesse Garon. Elvis later sought to change the name's spelling to the traditional and biblical Aaron. In the process he learned that "official state records had always listed it as Aaron. Therefore, he always was, officially, Elvis Aaron Presley." Knowing Presley's plans for his middle name, Aaron is the spelling his father chose for Elvis' tombstone, and it is the spelling his estate has designated as the official spelling whenever the middle name is used today. His death certificate says "Elvis Aron Presley." This quirk has helped inflame the "Elvis is not dead" conspiracy theories."
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
how about getting youtube-dl ?
Re:That's not a security console... (Score:5, Insightful)
Ok, so by your words, being able to create a document that contains blatantly false information, and successfully using that document to bypass security doesn't prove that "security in those things is broken". What, pray tell, would be required beyond this to demonstrate that security is broken? Because, you see, in my simple view of things, if you are "Bob" and security is on the lookout for "Bob", and you show them a modified password claiming that you're "Neil", and security lets you through because as far as they can tell you aren't "Bob", security has been compromised. When security is based on human inspection of said passport, clearly it's subject to human error. When security is electronically based, such as the case with RFID, all but the most basic of human interaction should be removed from the "is this a real passport?" equation.
Parent
Even real cloning is an issue (Score:3, Insightful)
Actually, even cloned passports are an issue. They're just one you can't do a lot about very easily.
They're an issue because if you can find someone who looks vaguely like you and clone their passport with or without their cooperation, you can assume their identify. Just alter your features a bit from what is in the picture. If they have medium-long hair, get a buzz cut. If they have no facial hair, grow a bear, mustache. Or vice versa. This is especially effective if you are in a minority in the coun
Re: (Score:3, Insightful)
Because passport data is supposed to be read by foreign authorities. Or would you vote for a big worldwide database containing all humans passport data, and accessible by every gouvernment of the world?