Just another ComMetrics – social media monitoring, best metrics, marketing metrics weblog

e-passports cracked 2 – German, Dutch and UK citizens beware and take care

November 21st, 2006 · No Comments ·

Previously we posted:

e-passports cracked 1 – safety is non-existant

Today we address the security issue regarding your e-passport in a bit more detail with some interesting links you may want to check out. So fasten your seat belt you won’t like what you will read, at least if you are concerned about your privacy and data security.

Three million Britons have been issued with the new e-passports, so have many Germans, Swiss and Belgian citizens. These passports are designed to help better protect them against terrorists and fraudsters. Belgian citizens are used the identity card that uses an RFID chip. These identity cards are built so well that the RFID chip (click on Login as a guest to get free access) gets separated from the card surprisingly often.

All countries are trying to use an international standard to make it easier to allow the use of e-passports across countries. The standard comes from the ICAO (International Civil Aviation Organization). In the U.S. the Pass card is supposed to allow a Custom’s officer to read them from 20 feet away (just about 6.5 meters!). In the UK, the government claims the new biometric passport chips can be read over a distance of just 2cm, but researchers all over the world claim to have read them from further. The physics governing those in British passports says they could be read over a metre, but no one has yet done that. A Dutch team claims to have contacted chips at 30cm.

Several hacks of German, U.S. and Dutch passports have been accomplished. You can read more about these exploits here:

Research that matters – power analysis of RFID tags – hacking RFID successfully
Moreover, security of RFID technology implemented in MRTDs is questionable as we showed here:

Research that matters – proof of concept – FIRST self-replicating RFID virus

Is your e-passport secure – cracking RFID chips – a list of resources

Lukas Grunwald conducted an attack on a German biometric passport and succeeded in cloning its RFID chip. Naturally, if you can read a chip this information can be used for cloning a passport. In turn, this would allow the individual to enter another country using a false identity.

W32 – Tool – Reading and Disabling RFID Tags on Products – Consumers Fighting for Privacy

In the UK the argument has also been that:

,The full set of information will only be stored on the register itself. Just as with a passport, it will be cancelled immediately [if lost or stolen] and no-one else will be able to use your biometric.’ (James Hall, chief executive of the Identity and Passport Service (IPS) in the UK)

The problem is that when a criminal clones an RFID chip from a e-passport with the necessary digital signatures, however, can we really conclude that the owner is aware of th? Imagine this scenario:

-The pocket thief steals the identified victim’s e-passport in the subway,

– the partner does as follows:
a) using a portable scanner he collects all the information he needs, such as the expiry date as well as the nine-digit or so passport number, birth date etc.
b)his partner may scan and extract the data from the RFID chip, after completion of this task the
– passport is being ‘returned’ to its rightful owner who may now be sitting at Starbucks sipping her coffee.

Naturally, the latter is unlikely to have the faintest clue what happened. So why should she report it to the authorities or even ask for a new passport. Therefore, the ‘victim’s’ e-passport continues working properly for passing border controls and, unfortunately, so does the terrorist’s faked version.

And let us not forget if one extracts data from the RFID chip, the digital bit-stream is also in the attacker’s possession. Hence, the digital signature of the passport checks out.

Also bad is that whilst your bank card giving you access to the cash dispensing machine has a brute-force mechanism, whereby the user has three attempts only before the card is blocked, e-passports seem to lack protection against brute force attacks at least as of today.

Incidentally, the British government has been adviced about these and other issues regarding security, data protection and privacy when using e-passports here:

2006-08-04 Sixth Report Identity Card Technologies: Scientific Advice, Risk and EvidenceHC 1032)

Of course, the British government tried to counter the argument from the above House of Commons Committee Science and Technology Committee by publishing its own report here:

2006-10-20 Identity card technologies: scientific advice, risk and evidence the Government reply to the sixth report from the House of Commons Science and Technology Committee, HC 1032 session 2005-06


Inquiring minds suggest that the ultimate question is whether the ability to clone the electronic data offers a meaningful opportunity to criminals. If it as easy as we have described in the above text, why not. And where there is a market with a demand for passports, there is a supplier as applies to other markets for sex, drugs or alcohol.


Naturally, new information such as your picture cannot be added to a cloned chip. Hence, the criminal has to counterfeit a passport that uses a picture that bore a reasonable resemblance to the subject who is the ‘legal owner’ of the passport.

FOLLOW UP to this story will be:

e-passports cracked 3 – Budapest Declaration raises concerns about e-passports, privacy and citizens rights

e-passports cracked 4 – will more biometrics make a difference?


→ No CommentsTags: chip · false · icao · mrtds · passport · passports · readable · rfid