Buffer Overflow Found in RFID Passport Readers

epee1221 writes "Wired ran a story describing Lukas Grunwald's Defcon talk on an attack on airport passport readers. After extracting data from the (read-only) chip in a legitimate passport, he placed a version of the data with an altered passport photo (JPEG2000 is used in these chips) into a writable chip. The altered photo created a buffer overflow in two RFID readers he tested, causing both to crash. Grunwald suggests that vendors are typically using off-the-shelf JPEG2000 libraries, which would make the vulnerability common."

Of course they are vulnerable

These passports are full featured CPU's with up to 72KB of data. The "RFID reader" is actually a very bad name for a software system that is going to read out these passports. In most documents it will be referred to as an inspection system. It will not only read out the passport, but it will also test the biometrics, communicate with other systems etc.. This is a complicated process that will most likely take place on a full featured CPU, containing a modern OS, and a modern software stack. This allows for maximum flexibility, but it will also make the systems vulnerable for attack.

The only thing the manufacturers of these systems can do is thoroughly test their software, and make the attack possibilities as small as possible. For instance, they should check the signature under the data before passing the data on to the next layers. Of course, for this you need the certificate of the issuing state. You should also test if the underlying libraries that do this initial check are not vulnerable.

Explain to me how...

Explain to me how this is an "attack" on passport readers?

Passport is scanned
Reader goes casters up
Reader is power cycled
Passport is scanned again
Reader goes casters up
Owner of said passport is hauled off to some secret room where all of their orifices are checked by an ex-prison guard with large hands.

This does show the lack of testing and hardening, but it seems a buffer overflow situation like this would be relatively easy to patch.

Re:Explain to me how...

Because the way it will actually go is like this:

Passport is scanned
Reader goes casters up
Reader is power cycled
Passport is scanned again
Reader goes casters up

Security Goon say "Shit, that's wierd. But the paper passport looks fine. Go on through."

Owner of said passport traipses past security, making the E-passport no better than a regular one.

Re:Explain to me how...

A buffer overflow [wikipedia.org] can do a lot more than just crash systems. Done right they can cause the machine to run ANY code the hacker wants while the computer owner is none the wiser. TFA suggests changing the picture generated, which probably wouldn't be too hard considering it looks like it's the JPEG2000 libraries which are affected anyway.

Re:Explain to me how...

At the moment it crashes. With the right sequence of bytes it looks like:

Hacker crafts jpeg with exploit code
Passport is scanned
Exploit code is injected
Reader silently executes exploit code
Reader continues operation with nobody any the wiser

A compromised reader lets you bypass the biometrics.

Re:Explain to me how...

In a buffer overflow situation, a system may crash because it attempts to run the overflow data as code and fails. However, 99% of the time you can use buffer overflows to inject your own code to run. You just need to know what system it will be running on.

A buffer overflow is a serious vulnerability, in that finding one is the biggest step towards cracking a system open.

Honestly...

...if you pass a cracked RFID chip through a passport reader and then it crashes,

#1: the guard will humanly read your inside cover photo with extra vigilance...the chip is not the only method of ID
#2: you'll probably be detained for a bit while they re-test your passport; if it fails again, they'll tell you to get a new passport
(#2a: or be placed on a no-fly list, because you're a terrorist)

Plus, how exactly would a code-injection exploit work unless it's something like the GDI+ vulnerability that occurred with WMF files? (If a rogue guard is injecting evil code into the machine, the government had waaay more scary problems ahead than with some 'sploiting a passport reader).

All that being said, there are some things (i.e. voting machines) that just should not be electronic-ized, and I feel this is one of them.
Other than "it'll get you through faster!!", what is the point of using chips when, more than likely, the passport clerk has to humanly-read it to verify the info anyway? Especially considering that the particular RFID chip technology used in the passport is going to be obsolete or cracked in 3 years, and most passports don't expire for five or ten years?

"..the Windows-based border-screening computer.."

FTFA: "If a reader could be compromised using Grunwald's technique, it might be reprogrammed to misreport an expired passport as a valid one, or even -- theoretically -- to attempt a compromise of the Windows-based border-screening computer to which it is connected."

That does it. From now on I'm only travelling to countries which use OpenBSD to operate their border gateway protocols.

And: "Additionally, the International Civil Aviation Organization recommends that issuing countries protect biometric data on the e-passport with an optional feature known as Extended Access Control, which protects the biometric data on the chip by making readers obtain a digital certificate from the country that issued the passport before the equipment can access the information."

Sounds like in the future, the only people who'll be able to traveler with any degree of success will be those who can forge their passports...

Lost faith on RFID security long ago?

Remember this /. story about RFID Passports Cloned Without Opening the Package [slashdot.org]? I'm not sure if RFID and security will ever get along at a satisfying level or if will be similar to the systematic breaking of DRM locks. Amongst other RFID stories [slashgeo.org], this "Security analysis report" paper [91 pages pdf, 967k] [bridge-project.eu] is most informative (via this blog [vector1.eu]).

Great!

Something else to make the experience of flying all that much more unpleasant for the rest of us!

the usual

The problem is, as usual, the use of inherently unsafe and dangerous programming languages like C and C++.

There is no reason why any modern programming language should permit accidental buffer overflows; they are easily preventable without pushing the burden onto the programmer even in programming languages with the same power as C and C++.

Re:the usual

Don't do much embedded programming, do you? Garbage collection, automatic bounds checking, and the vast majority of features that you think of as "modern" were available in quite a number of programming languages from the 1960s -- lisp, for example. While they were extremely popular in academic circles, and were without a doubt extremely powerful and capable, most development continued to be done in assembly, and then later C. Why was this, do you think? Because in those days, computer resources were so expensive that it was foolish to waste them. Here's a hint: garbage collection is a bad idea if you have so little memory that you're actually likely to run out of it. Automatic bounds checking on arrays is expensive if your processor is slow enough.

Now if you're saying that there's no need to develop the vast majority of today's computer software in assembly, C, or C++, then I agree with you wholeheartedly -- but we're not talking about a computer, we're talking about an RFID reader. You know, a small device that doesn't have the latest gaming processor from AMD and Intel and 2 gigs of RAM. It has enough memory for what it needs to do and that's it; and, to be low power, it has a small, simple embedded processor.

You can't run a JVM on this thing, and even if you wanted to, it would be a bad idea.

Security Through Obscurity

``Grunwald suggests that vendors are typically using off-the-shelf JPEG2000 libraries, which would make the vulnerability common.''

Because everybody knows that, had they written their own code, it would have been much more secure. Just like magic.

Why use silly RFID toys?

I for one look forward to the superior alternative of Definitive Biometric Real ID for air travel.

Undressing in front of the uniformed agent, undergoing endoscopy with low-bid lubricant, then going through the rotating-brushes Lockheed Martin AlloScrub body wash to remove all possible caches and residues of others' DNA before having the blood draw, is the highlight of any ordinary business trip. The $635 airport security fee is a bit of a burden, though, as are the 12 hour fast and prep. enema.

Waiting 24 hours for DNA sequencing results, in the departure hall with monopoly $3.75 bottled water, $9 greenish-ham sandwiches, Soviet-grade customer service, and incessantly repeated shrieky PA announcements, always makes me feel good because I am doing my part for national security.

Eventually however, I might have to face the question of efficiency, and be compelled to move to some other country where I can inch through massive traffic congestion, then pay a fixer to have me waved into the squalid and grimy departure hall for a mere 2 hours, while watching the unsmiling gentlemen with the submachine guns make their frequent rounds. This followed by very close scrutiny of the rubber stamps on incomprehensible forms stamped only 45 seconds earlier by the person one floor below, as my luggage was being X-rayed to make certain that I was not trying to dodge both the stiff export tax on livestock and poultry, and the consequent opportunity to make a "facilitating payment".

Re:Are borders are open!

You should start with studying English. Your skills our lacking.

Re:Are borders are open!

"The question is : should I study Arabic or Spanish to welcome our new overlords."

Yes. :)

JPEG2000

Why am I not surprised?

Re:This is the reason closed source is good

There is no architecture that is secure from a passionate developer armed with time, IDA Pro and an oscilloscope (if needed).

That's interesting...

It's just that they keep hiring complete morons that have no idea what they're doing to work on the systems.

I see that where I work all the time! Must be the new trend...

Re:Are borders are open!

Chinese could probably be the most useful - you can get earworms for that, and those other two languages, from http://www.earwormslearning.com/intro.html [earwormslearning.com]

Re:Are borders are open!

Mandarin Chinese. Follow the money. (There's no monopoly on stupidity, after gutting the US manufacturing sector, Japan has also sold Japan, Inc. to the Chinese).

RFID passports were a stupid idea in the first place. I do not want the id in my pocket broadcasting to the world "I'm an American Passport! Kidnap the holder!" (and kidnapping is an issue in places of the world I need to go, like where my in-laws and children are).