Biometric passport cracked and cloned

News that attendees at a US hacking conference have seen a demonstration of how to clone a digital passport has raised fresh concerns about the security of proposed new forms of ID and travel documents.

A hacker called Lukas Grunwald showed attendees at the Las Vegas Black Hat convention how to clone passports, using a German passport for his demonstration. However, standardisation across ePassports means the exploit would work on any other passport which uses RFID chip technology to store details of the individual - such as those now being issued in the UK or US - and was carried out using freely available technology.

According to security guru Bruce Schneier, Grunwald's job was made all the more easy by the publication of standards for ePassports on the website of the International Civil Aviation Organisation.

Simon Perry, VP security strategy at CA and a member of the European Network and Information Security Agency, told silicon.com that if people can crack the security on bank cards then it was inevitable, in time, they would find a way to do the same with passports.

The biggest problem, Schneier wrote on his blog, is that passports will have a shelf-life of 10 years, during which time the technology will not only become antiquated but will almost inevitably be overtaken in sophistication by the methods for cracking it.

Eyeing up ePassports?

Check out this photo story for pictures of the new look UK travel document.

Schneier wrote: "A passport has a 10-year lifetime. It's sheer folly to believe the passport security won't be hacked in that time."

The UK is currently in the process of rolling out ePassports which store biometric data about the holder on a chip.

Because CA's Perry said RFID chips can increasingly be read surreptitiously, often from distances far greater than the six inches which designers originally claimed, he suggested the security conscious might like to consider investing in a metal cigarette or cigar case large enough to hold their passport.