Researcher details Dutch e-passport hack

The researcher who claims to have created code that can emulate and clone e-passports has given details of the purported hack.

The anonymous hacker, who prefers to be known by the handle 'vonJeek', told ZDNet.co.uk that the cloned chip works by bypassing electronic security checks.

"If we're talking about bypassing, I mean manipulating the system in such a way that the intended process is not (fully) performed," wrote vonJeek in an email exchange.

The researcher explained that e-passport systems use a mechanism called 'passive authentication' to detect unauthorised changes of data on the chip. A document security object, or 'SOD', is stored in the chip, which contains between two and 16 mathematical values (check values), used to check whether the passport data has been altered. The collection of values is signed using a digital signature. The signature and the public key of the signer, used to check if the signature is correct, are also in the SOD file.

To check if e-passport content has not been altered, the e-passport system reads the index to see which files are stored on the chip, then reads the indexed files. It calculates the check value of each file, and verifies whether the check values match those in the SOD file. The system checks if the digital signature in the SOD has been signed using the public key in the SOD, and whether the public key is owned by a bona fide country. To do this, an International Civil Aviation Organization (ICAO) service called the Public Key Directory (PKD) can be used.

A country can also decide to use an additional security mechanism called 'active authentication', which is used by the Dutch e-passport system, to check whether the chip data has been altered or cloned.

VonJeek claimed the emulator program worked by exploiting a vulnerability in how the e-passport system initially reads the index to see which files are stored on the chip. Using this vulnerability bypasses active authentication, along with any additional services such as fingerprints or other biometric checks. The researcher claimed to have tested his emulator against each of the steps of the e-passport authentication process, verifying if the equipment reported any problems. VonJeek stressed that a video of the passport reader being fooled into accepting data authenticating Elvis Presley showed only a self-scan machine, which did not properly implement all the checking processes.

However, the researcher claimed the emulator could fool any e-passport system, including that used in the UK, if the system followed ICAO guidelines without modification. According to vonJeek, using th emulator, passport clones could be used on the UK system, as the UK does not use active authentication. VonJeek had not tested an e-passport with altered data on a UK system, and could not comment on the full UK authentication process.

At present, the code only works with blank JCOP v4.1 72k smartcards, manufactured by various smartcard suppliers including NXP. VonJeek said the code could possibly be modified to work on JCOP v3.1 cards, another type of e-passport system.

The researcher added that, at present, only nine countries were signed up to the ICAO's PKD, with only five active users, and that other countries had to exchange public keys via secure diplomatic post. This adds complexity and lowers the efficacy of the system, as each of the 45 participating countries have to recognise each other's keys. The UK does not currently participate in the ICAO's PKD.

The security of the system is further flawed by RFID tags not having to be in close proximity to the readers, according to a commentator on The Hacker's Choice website called 'The Ministry of Truth'.

"Thanks to the e-passports it is now possible to build smart-[improvised explosive devices, or IEDs]," wrote the commentator. "A smart-IED waits until a specific person passes by before detonating, or let's say until there are more than 10 Americans in the room. Boom."

Being able to read e-passports from a distance also opens up the possibility of a hacker reading a passport remotely and then using a person's credentials to authenticate himself, wrote the commentator.

The Home Office denied that e-passports would make identity authentication less secure.

"Continuing investment in biometric technology and enhanced security measures will help ensure that passport security is maintained now and in the future," said a Home Office spokesperson. "We take security and privacy very seriously, which is why the British biometric passport meets international standards as set out by the International Civil Aviation Organisation."