The University of Washington and EMC's RSA Labs team up on a study showing that new RFID-enabled U.S. Passport Cards used for border crossings are easily cloned and are vulnerable to being disabled. The researchers also showed that the cards could be scanned from as far away as 150 feet.
Researchers at the University of Washington
and EMC's RSA
claim new RFID-enabled border-crossing documents are easily cloned
and are vulnerable to being disabled. The researchers also showed that the
cards could be scanned from as far away as 150 feet.
Produced jointly by the Department of Homeland Security and the Department
of State, the U.S. Passport Cards, also known as PASS (People Access Security Services)
cards, are available to Americans crossing U.S.
land and sea borders. The state of Washington
is also producing EDLs (Enhanced Driver Licenses) using the same radio-frequency
published Oct. 22, tested both PASS cards and Washington
State's EDLs, which are produced
jointly with DHS. Both of the cards have Generation 2 RFID tags, along with a
sleeve that the government says offers protection against unauthorized reads.
Republicans and Democrats alike are criticizing the Bush administration's Read ID program. Click here to read more.
"Our research confirms the vulnerability of Passport Cards and Enhanced
Drivers Licenses to copying attacks of their electronic RFID components,"
the report stated. "It is a technically straightforward matter to copy the
data from a Passport Card's RFID tag into another, off-the-shelf tag."
The report added, "Gen-2 tags are essentially wireless bar codes, with
no specific provisions to meet security and privacy needs. Just as their
optical counterparts are subject to photocopying, Gen-2 EPC
tags are vulnerable to cloning attacks in which their publicly visible data are
scanned by an adversary and then transferred to a clone device, be it another
tag or a more sophisticated emulator."
The authors also noted that the cards did not use unique tag identifier
codes. Instead the cards use generic manufacturer's codes, significantly
increasing cloning opportunities.
According to the report, the cards' vulnerabilities increase the risks of
identity theft, attacks that can destroy the cards and the tracking of
individuals through unauthorized readings.
"Our work suggests that as deployed, Passport Cards and Washington
State EDLs possess security and privacy deficiencies that have the potential to
compromise border security or render it more fragile than necessary and
desirable," the report authors concluded.
A DHS spokesperson said the testing was conducted on
older cards and the results are "outdated."