Missed Connections: Hacking RFID Readers
|
At about the same time I was flying back from Miami Aug. 12, thankful that the flight lasted only 2 hours and 55 minutes (my 4-year-old twins were just about doing summersaults by the end of the flight they were so antsy) about 20,000 international passengers were being detained either on the tarmac in cramped plane cabins or in customs at LAX, for hours on end. With limited food and water. With no possibility of making connecting flights or picking up stranded baggage. And absolutely no options to do anything else except wait - my personal version of hell when traveling with children. The problem at LAX: a malfunctioning U.S. Customs and Border Protection system that prevented customs agents from processing travelers' entry into the country, according to media reports. The Border Protection system maintains a list of people singled out by the Department of Homeland Security who should be subject to more scrutinized searches before entering the U.S. With the list simply unavailable, people had to wait. The week before the detainment at LAX, at the DefCon show in Las Vegas, DN-Systems CTO Lukas Grunwald demonstrated (again) security flaws in RFID-chipped passports that let hackers clone the fingerprint image stored on the passport, and use it to create a chip that attacks electronic passport readers - you know, as the reader attempts to scan the passport, which in turn tells the system (and the customs agent) whether or not a traveler should be detained further. Wired magazine reported on Grimwald's DefCon demo prior to the event. Here's what reporter Kim Zetter wrote: Grunwald says he's succeeded in sabotaging two passport readers made by different vendors by cloning a passport chip, then modifying the JPEG2000 image file containing the passport photo. Reading the modified image crashed the readers, which suggests they could be vulnerable to a code-injection exploit that might, for example, reprogram a reader to approve expired or forged passports. "If you're able to crash something you are most likely able to exploit it," says Grunwald, who's scheduled to discuss the vulnerabilities this weekend at the annual DefCon hacker conference in Las Vegas. My question is this: If it's that easy to disrupt the electronic passport system - not just the RFID chip, but the readers too - what does that mean for travelers who are at the mercy of technology, rather than humans, to read their passports? Should we all be packing extra food, water and bedding before boarding an airplane? I'll think twice about that question before traveling with my kids again. |
For more IT related content on the blogosphere, check out www.ithub.com