Hacker reveals how to compromise e-passport systems

claimed to have tested his emulator against each of the steps of the e-passport authentication process, verifying if the equipment reported any problems. VonJeek stressed that a video of the passport reader being fooled into accepting data authenticating Elvis Presley showed only a self-scan machine, which did not properly implement all the checking processes.

The researcher claimed, however, that the emulator could fool any e-passport system, including that used in the United Kingdom, if the system followed ICAO guidelines without modification. According to vonJeek, using th emulator, passport clones could be used on the U.K. system, as the United Kingdom does not use active authentication. VonJeek had not tested an e-passport with altered data on a U.K. system, and could not comment on the full UK authentication process. At present, the code only works with blank JCOP v4.1 72k smartcards, manufactured by various smartcard suppliers including NXP. VonJeek said the code could possibly be modified to work on JCOP v3.1 cards, another type of e-passport system.

The researcher added that, at present, only nine countries were signed up to the ICAO’s PKD, with only five active users, and that other countries had to exchange public keys via secure diplomatic post. This adds complexity and lowers the efficacy of the system, as each of the forty-five participating countries have to recognize each other’s keys. The United Kingdom does not currently participate in the ICAO’s PKD.

The security of the system is further flawed by RFID tags not having to be in close proximity to the readers, according to a commentator on The Hacker’s Choice Web site called The Ministry of Truth. “Thanks to the e-passports it is now possible to build smart-[improvised explosive devices, or IEDs],” wrote the commentator. “A smart-IED waits until a specific person passes by before detonating, or let’s say until there are more than 10 Americans in the room. Boom.”

Being able to read e-passports from a distance also opens up the possibility of a hacker reading a passport remotely (what is called “digital pickpocketing”) and then using a person’s credentials to authenticate himself, wrote the commentator.

The Home Office denied that e-passports would make identity authentication less secure. “Continuing investment in biometric technology and enhanced security measures will help ensure that passport security is maintained now and in the future,” said a Home Office spokesperson. “We take security and privacy very seriously, which is why the British biometric passport meets international standards as set out by the International Civil Aviation Organization.”