Tool to backup, modify and clone ePassport released

[Ian Batten]

On 01 Oct 08, at 1102, Charles Lindsey wrote:

>
> In a sensibly designed chip, there would be data that could be  
> altered after manufacture and data that could not, with a fusible  
> link to be destroyed after the unalterable data had been loaded.  
> That data might also be unreadable externally, but available for the  
> internal electronics of the chip to access as part of its  
> verification procedures.
>
> If the Bad Guys want to clone chips by altering stuff in an already- 
> existing passport, then they could not do it. With the hidden stuff  
> not even readable, they might not be able to do it even if they  
> could lay their hands on virgn chips.

I suspect they'd be able to extract the `unreadable' data given enough  
money and expertise.  For example, given the resources of a national  
laboratory (a reasonable threat model for the high-quality forging of  
passports) they would perhaps be able to extract the data either by re- 
making the fusible link or by suitably spooky analysis of the memory  
behind it.

>>
>> In the case of (a) the answer is clearly `no', because the data  
>> isn't read anyway: the passport's serial number is extracted and  
>> the photograph is retrieved from the UKPA database.
>
> I would not necessarily expect such readers to be online to the UKPA  
> database.

They are.  My passport is not an RFID one, and my photograph has been  
displayed on the screen of passport terminals as I've gone through  
LGW, LHR and LCY lately.  And I _think_ BHX: can't remember.  Either  
they're online, or they cache the data locally (hardly a huge amount  
of storage).

> They would verify the chip on the consistency of tha data contained  
> within it, using their knowledge of the Public Key with which it  
> should be secured. Just as current Chip'n'Pin cards are usually  
> verified offline.
>
> The problem with the Dutch (?) readers is that they apparently do  
> not have even the Dutch Public Key loaded into them.

I'm losing track of the claims here.  Is someone claiming to have  
analysed a real, live, in use by Dutch border police, RFID reader, and  
confirmed that it will accept random biometrics over a self-signed  
certificate?  What I've read are claims about `reference  
implementations', which aren't at all the same thing.

ian