Saturday, August 11, 2007

Understanding the news about RFID passports 

The new US passports have chips in them which can be read by a computer at customs. The chips are not too hard to duplicate. Someone willing to forge a passport can put their own data onto one of the chips.

It's a computer that reads the chips, and if a computer is reading something that the attacker controls then security people start worrying.

A curious person named Lukas Grunwald set out to discover whether there was a security issue and found that by putting the right kind of bogus data onto a passport chip he could crash the passport reader.

That's a potential security issue all by itself, but it's more important because of What Happens Next. If you can make a computer run off the rails enough to crash, it's often possible to grab the steering wheel and control where it goes. If you find a crash, you may have found a takeover.

In other words, it may be possible for someone of ill intent to create a passport which will reprogram the passport reader.

This isn't something you can protect against, except that in general you should insist that the government not push "security measures" that security people disagree with.

|

This page is powered by Blogger. Isn't yours?