October 9, 2008

ePassports reloaded
Jeroen van Beek
BlackHat Asia 2008, TokyoOctober 9, 2008

Where will we go today?
• Technology overview• Attacks• Root causes• Solutions• The future(?|!)• Questions

October 9, 2008

Technology overview• An ePassport contains a chip
• The chip contains data about the passport holder– Name, date of birth, passport number, etc.
– Biometrics (picture, finger prints, iris scan)• Chip content is based on a standard by theInternational Civil Aviation Organization (ICAO)– See http://www.csca-si.gov.si/TR-PKI_mrtds_ICC_readonly_access_v1_1.pdf for details• Chip content is accessible using a wireless interface(RFID)• ePassports are enrolled on a global scale• Not widely used for real-life applications (yet)October 9, 2008

Technology overview, ct.
• So what does it looklike? Self scan setup at
Amsterdam Airport, TheNetherlands:

October 9, 2008

Technology overview, ct.
• So what does it look like? Portugal:

October 9, 2008

The ICAO standard: chip content• Chip contains files (“Elementary Files”, EFs):– EF.DG1: personal information (required)– EF.DG2: picture, JPG/JPG2000 (required)– EF.DG[3-14,16]: finger prints, iris scans and otherfiles for future use (optional)– EF.DG15: anti-cloning crypto (optional)– EF.SOD: safeguarding integrity of DGs (required)– EF.COM: index of available files (required)– Demo!

October 9, 2008

The ICAO standard: security•Relevant security mechanisms in current chips:– Passive authentication (PA) (required):• Safeguard integrity of data  detect changes• EF.SOD stores hashes of EF.DG[1-16] and a public key, hashes are
digitally signed with a private key– Basic Access Authentication (BAC) (optional):••••

Safeguard confidentiality of data  prevent eavesdropping
Authentication using key is required before reading files
KEY = DOCUMENT NUMBER + DATE OF BIRTH + DATE OF EXPIRY
After authentication data is encrypted (3DES) and messages contain
MACs (MAC8)– Active Authentication (AA) (optional):• Prevent cloning and  detect copies• EF.DG15 contains a public key. The private key of this key pair is ininaccessible chip memory. Authenticity of the chip can be checked byletting the chip sign a reader’s challenge and verifying the result withthe public key

October 9, 2008

Passive Authentication (PA)==October 9, 2008

Basic Access Control (BAC)

10100001010101010

October 9, 2008

Active Authentication (AA)==October 9, 2008

Finding new flaws, ct.

October 9, 2008

Known attacks• Real life attacks, the past:– Cloning ePassports without Active Authentication• Lukas Grunwald @ BlackHat, USA, 2006
• http://www.wired.com/science/discoveries/news/2006/08/71521• Bit by bit copy of content in a self-written ePassport emulator• Can be prevented by using Active Authentication– Retrieving secret ePassport key data
• Marc Witteman @ What The Hack, The Netherlands, 2005
• http://wiki.whatthehack.org/images/2/28/WTH-slides-Attackson-Digital-Passports-Marc-Witteman.pdf• Using power analysis to retrieve AA private key• Can be prevented by using proper hardware

October 9, 2008

Known attacks, ct.
•Real life attacks, the past:– Read ePassports with predictable document numbers• Adam Laurie reads BAC protected UK ePassport of a Guardian
reporter, UK, 2006
• http://www.computerweekly.com/Articles/2006/11/21/219995/expertcracks-biometric-passport-data.htm• An educated guess (sequential document numbers), also see
Witteman’s slides• Can be prevented by using non-sequential document numbers (thougheffective key length is still only ~72 out of 128 bits)– Fingerprint ePassports without authenticating• Radboud University / Lausitz University team @ NLUUG, The
Netherlands, 2008
• http://www.cs.ru.nl/~erikpoll/papers/nluug.pdf• Characteristics of APDU responses show the origin of the applet• Can be prevented by using standard response codes (“status words”)

October 9, 2008

Verification process•

Two steps seem to be optional:– Scannend image versus chip image– Chip image versus camera image

seen in one setup, usedin non-public software
cameradoors

seen in one
setup
RFID reader andoptical scannerOctober 9, 2008

Verification process, ct.
• Dutch immigration seems to use (test)
software which uses scan↔chip checks– And theminister ofjustice proudly
shares hispassport dataon the net :)October 9, 2008

Finding new flaws• First we need a test platform

RFID reader, ~ $75

Eclipse & JCOP plug-in, ~ $0

laptop computer, ~ $750

All-in-one printer, ~$75

JCOP41 smartcard, ~$20

October 9, 2008

Finding new flaws, ct.
• Then we need code that emulates the ePassport– Just follow the specs, check ICAO’s “worked example”– Add function to write data to the emulator• Your emulator can be tested quite easily– Perform a read-out of a real chip with Adam Laurie’s excellent
RFIDIOt tools http://rfidiot.org/ and store it (= <chip>)– Change both mrpkey’s and your emulator’s code to make
Debian style random number generators– Copy the original chip content to your emulator– Perform a read-out of the emulator with RFIDIOt (= <emulator>)– diff <chip> <emulator>– Fix bugs :)– Code snippets!

October 9, 2008

Finding new flaws, ct.
• If the emulator is up and running we need to:– Get reference implementations:• Golden Reader Tool, referenced in ICAO documentation• Real-life test setups– Successfully attack optical scanners– Successfully attack PA– Successfully attack AA(enabled on e.g. Dutch documents)

October 9, 2008

Attacking optical scanners• Get OCR-B fonts for MRZ (= BAC key)
• Copy / paste the picture and MRZ in the rightplace• Advanced equipment ison the market– IR scans– UV scans– Systems are as strong as
the weakest link

• Demo included later on!

October 9, 2008

Finding new flaws, ct.

October 9, 2008

Attacking PA: warning or error?

October 9, 2008

Attacking PA: warning or error?

October 9, 2008

Attacking PA: warning or error?

October 9, 2008

Attacking PA: warning or error?

October 9, 2008

Attacking PA: warning or error?
• The signature value is incorrect– A) Do nothing– B) Warning– C) Non-critical error– D) Critical error
read-out continues and
successfully finishes after
detection of invalid SOD

October 9, 2008

Attacking PA: warning or error?
• A hash value is incorrect– A) Do nothing– B) Warning– C) Non-critical error– D) Critical error
find thedifferenceOctober 9, 2008

Attacking Passive Authentication• This is all very strange… If the reference
implementation is not that strict, what about
real test setups?
– Let’s try some publicly
accessible test equipment– Demo!

October 9, 2008

Finding new flaws, ct.

+

October 9, 2008

Attacking Passive Authentication, ct.
• Hashes of all data groups are stored• Hashes are signed using a digital signature– Public key is in EF.SOD to check signature– Public key should be checked to see if it can be trusted– ICAO Public Key Directory (PKD) facilitates online check• Chips enrolled in 45(+) countries• ICAO, April 2006: PKD membership should be “necessary...and notoptional”.
• ICAO, May 2008: “The ICAO PKD has grown to nine participants”• Fall-back mechanism: “distributed by strictly secure diplomatic means”– Manual process: store all public keys in inspection systems– What about e.g. key exchange Israel ↔ Iran?

• Create self-signed certificate and sign altered data
– Create your own country!
– Thanks to Peter Gutmann http://www.cs.auckland.ac.nz/~pgut001/

October 9, 2008

October 9, 2008

Attacking Active Authentication• Not writing the file (DG15) doesn’t work
• But what about manipulating EF.COM?
– If a file is not there you cannot check it…

• Demo!
• This attack is also applicable to all otheroptional security features!

October 9, 2008

Attacking Active Authentication, ct.
• Removing AA from the index:

October 9, 2008

European Union• Passport-freetravel zone EU• Are allimplementations
100% secure?

Police and judicial cooperation only 
Set to implement later Expressed interestOctober 9, 2008

Finding new flaws: summary
Test

Design okImpl. ok/Images scan =Image chip check

Risk
Illegally entering / leaving a country
using low-tech scan and cloned chip

* Identity theft / identity creation

Incorrect hashvaluesSelf-signed
document

Identity theft / identity creation(okay if PKD is checked real-time)

ActiveAuthentication/ **cannot be prevented (use* Cloningthe weakest link)

Index
manipulation***Cloning cannot be prevented (usethe weakest link)

Non-critical error in GRT, check not implemented(!) in examined test setups* “Whena MRTD with the OPTIONAL Data Group 15 is offered to the inspection system, the** Active Authentication mechanism MAY be performed…”*** Issue documented in supplement 6, conclusion “rejected”

October 9, 2008

Root causes• Design (ICAO standard):– Some key security features are optional: if one
party doesn’t use a feature the security level of theentire system (globally!) depends oncompensating measures– PA does not protect against index manipulation• Tested implementations:– Do not follow the ICAO standard!
– Every country is reinventing the wheel• Reinventing the applet (fingerprinting nationalities)• Reinventing reader bugs (Elvis lives!)• Reintroducing hardware problems (DPA attacks etc.)

October 9, 2008

Solutions•

Design (ICAO standard):– Require all security features including PKD by default– Protect the integrity of all files•Implementation:– Implement all security features by default– Use automated border control for chips with all
security features enabled only•

Global coordination (e.g. ICAO or other UN body):– Provide standard implementation for ePassport applets and inspection systems• The more (black box) implementations, the higher the risk of a serious problem• Open standards and implementations, no security by obscurity!

– Provide countries with a list of authorized hardware and hardware lifetimes• Think about the Mifare Classic chip family• History might repeat itself with ePassports: e.g. German ePassports are valid for 10years. In 10 years the hardware is most probably outdated (DPA attacks etc.)– Enforce the use of a trusted PKI environment (PKD)• Automated real-time certificate & CRL checks

October 9, 2008

The future(?|!)•More biometrics will be added:– June 2009: EU adds fingerprints– Later: Iris? DNA? Footprints?

•If implemented correctly (…), thesystem heavily relies on PKI– Let’s take a job at customs!
– Let’s check their network security!
– In my professional ‘ethical hacker’
career we’ve got a 100% hit rate on p0wning networks– I guess unethical hackers got a similar hit rate…

•In the end it’s just another software product– Same bugs, same exploits. Exploit terminals to hop on to the backend systems– E.g. GRT uses CxImage for JPGs, spl0it writers, please contact me…

•Happy traveling :)October 9, 2008

“Just trust us!”The Dutch government responded to the findings (Dutch) and said that systems will be enrolled
in 2009 that do perform Active Authentication and certificate checks. Though there is no
standard available (yet?) documenting security features of the new system. So a system isbeing built now and will be enrolled in 2009 but there is no documented design available atthis time. This is not a good idea. No safeguards. No independent third party reviews
possible by e.g. universities and security researchers. And we are talking about a criticalapplication called border control...
Entrust, which handles PKI security for ePassports, says that we should trust them.
"Governments’ security experts aren’t dummies and they aren’t going to make thosemistakes". No word about a safe design. Just trust the professionals. Yeah right :) Trust butverify:
••
•
•
•
•
•
•

"3,000 passports and visas stolen""Grandmother flies to Canary Islands on her husband’s passport""MI5 computer stolen in burglary""5,000 secret computer files on prison governors and staff vanish""USB Stick Containing Classified NATO Info Lost in Sweden""Passport applicant finds massive privacy breach""Trojan horse captured data on 2,300 Oregon taxpayers"
To be continued…

October 9, 2008

QuestionsOctober 9, 2008

Thank you!

October 9, 2008

Further reading•

http://www.theregister.co.uk/2008/09/30/epassport_hack_description/•

http://www.timesonline.co.uk/tol/news/uk/crime/article4467106.ece•

http://www.timesonline.co.uk/tol/news/uk/crime/article4467098.ece•

http://blog.wired.com/27bstroke6/2008/08/e-passports-cra.html•

https://www.os3.nl/2008-2009/epassport_eng•

http://www2.icao.int/en/MRTD/Pages/icaoPKD.aspx•

http://www.icao.int/icao/en/atb/meetings/2008/TagMRTD18/TagMrtd18_ip04.pdf•

http://www2.icao.int/en/MRTD/Downloads/Supplements%20to%20Doc%209303/
Supplement_to_ICAO_Doc_9303_-_Release_6.pdf•

http://www.csca-si.gov.si/TR-PKI_mrtds_ICC_read-only_access_v1_1.pdf•

http://news.bbc.co.uk/2/hi/uk_news/7530180.stm•

http://www.telegraph.co.uk/news/newstopics/howaboutthat/2456084/Grandmother-flies-toCanary-Islands-on-her-husbands-passport.html