Airport Access IDs Hacked In Germany 102
teqo writes "Hackers belonging to the Chaos Computer Club have allegedly cloned digital security ID cards for some German airports successfully which then allowed them access to all airport areas. According to the Spiegel Online article (transgoogleation here), they used a 200 Euro RFID reader to scan a valid security ID card, and since the scanner was able to pretend to be that card, used it to forge that valid ID. Even the airport authorities say that the involved system from 1992 might be outdated, but I guess it might be deployed elsewhere anyway."
Terrorrism (Score:5, Insightful)
At a time where authorities try to impose ridiculous devices like the body scanner and that waiting lines become so long that trains become a viable option to national flights, it is good to point out that they have so many flaws left.
Clearly, "anti-terrorism" is not handled by competent people who think they will have to stop competent terrorists.
Dual factor authentication (Score:3, Insightful)
They aught to be using more than one factor of authentication if they expect their system to be secure. Facial recognition (by a human guard) and the card, passcode and the card, or some other factor to prevent a stolen or forged card from being a security risk.
Re:Terrorrism (Score:5, Insightful)
Re:guess what! (Score:5, Insightful)
You're right. And I wonder why.
Here we are, creating security theater after security theater, invading flyer's privacy from background checks to real physical intimate invasions, but we don't care that someone could easily access all restricted areas of an airport.
Ever thought that it would, from a terrorist's point of view, be much more interesting to blow up Heathrow, CDG or Kennedy airport than some petty little plane? Can you imagine the possibilities of having access to the airport's fuel tanks (and I'm not even thinking of such unimportant things like simply causing an explosion there. Think big! How about filling planes with fuel that clogs the engines so they come down unexpectedly. 3 planes hitting some towers? How about 300?), or how about access to the catering pool (I think we all saw the catstrophy movies from the 70s where spoiled food knocked out the pilots)?
And that's something I've been thinking up within the 5 minutes of writing this posting, with no intent to actually strike against an airport. Now think of the possibilities of a terrorist with his mind set on something like that and a few months of planning time.
If that whole scenario shows something, then that we are NOT adequately protected. And no, that doesn't mean we need more security theater. It means that the whole shit is worth jack! You cannot secure a system that is inherently insecure. There are way too many ways to attack to secure them all.
I'm also wondering why they're so worried about airports. There are way more much easier ways to execute acts of terror than in such a limited environment. But maybe it's just that we want to protect people rich enough to actually fly. Tells you something 'bout who's important and who's not.
Re:RFID (Score:3, Insightful)
Well, it wasn't designed, even in 1992, for real security... The designed market for this was low-security, cheap, but somewhat scalable access control for doors in schools, supermarkets and such...
The guy that should be fired is the one that selected it for a real security application like an airport.... No doubt because it was cheaper...
Re:guess what! (Score:5, Insightful)
Today the highest life hazard are our cars. How much money is invested in road security?
Re:Terrorrism (Score:5, Insightful)
Unless you have trained guards at every door, it's very hard to promote a culture of badge-checking. Especially if the person you're challenging was just verified by the card-reader.
If you *do* have a guard at every door, what good is the card-reader except to deter the guards from doing their jobs?
I'd really like to know what else you're depending on really, if photo IDs can be forged, and people come and go from all over the world on an hourly basis, and your procedures can't be assumed secret, what's left?
I've never bought into this "layered" model of security. The trouble is that it promotes purchasing crap from vendors which can just be used to add layers. Security is more like a chain, the whole system fails on its weakest link. The more layers you add, the more likely you are to accidentally depend on something you thought the other guy was taking care of...
E.g., go ask the guards if *they* think the card readers are malfunctioning.
Re:guess what! (Score:3, Insightful)
I'm also wondering why they're so worried about airports. There are way more much easier ways to execute acts of terror than in such a limited environment. But maybe it's just that we want to protect people rich enough to actually fly. Tells you something 'bout who's important and who's not.
Its not about securing those people its about having a security theatre that disrupts as few people as possible. If you had similar measures on trains, or subways, etc. it would cause chaos to millions and the people wouldn't put up with it in the long run. For the most part air travel is something people do occasionally so don't really mind a little extra delay for their safety. The only people it hits hard are the rich, or folk who have to travel for work. The general public can sneer at them complaining because they deserve it for being able to fly that often.
Comment removed (Score:5, Insightful)
Re:guess what! (Score:3, Insightful)
I'm also wondering why they're so worried about airports. There are way more much easier ways to execute acts of terror than in such a limited environment. But maybe it's just that we want to protect people rich enough to actually fly.
I think that misses the point. Governments aren't disproportionately obsessed with defending airplanes; it's the *terrorists* who are disproportionately obsessed with bombing/hijacking airplanes (rather than other targets which might cause more public fear or kill more people).
Why are terrorists so obsessed with airplanes? It might just be a failure of imagination. But I think it's because it's all about symbolism. The jet plane symbolises the "jet age"; images of jet planes taking off or touching down used to be the defining iconic images of our civilization from the 60s, especially in movies. It's only recently and for a small (non-terrorist) minority of the world that flying on a jet plane has switched from "defining icon of our civilization" to "boring tedious humdrum routine nuisance".
Germans are so lucky... and so unlucky... (Score:3, Insightful)
The German people are lucky to have the CCC. And to have a press that are happy to spread the word about the CCC's discoveries.
Re:guess what! (Score:5, Insightful)
They x-ray your bags before you can get on a long-distance train in Spain. They don't yet make you walk through a metal detector, though.
The only people it hits hard are the rich, or folk who have to travel for work. The general public can sneer at them complaining because they deserve it for being able to fly that often.
Having to travel for work is often far from a privilege, although I suppose that people who haven't done it may think it's glamorous.
Security cards SHOULD only be one part of a key (Score:2, Insightful)
Security cards SHOULD only be one part of a key and should never be used as a primary means of authentication.
You have your card to initialise the authentication, then you use something else as the second key, like something as simple as a PIN code.
A security card is ALOT simpler to snatch then trying to figure our your PIN code. And together, it's a shit load of work, even for the most experienced intruder.