THC-ePassports – THC Clones Biometric ePassport – Elvis Presley Passport

The New Acunetix V12 Engine


I guess most people have been led to believe this new generation of ePassports or biometric passports are more secure, will help us keep our privacy intact and help us mitigate against identity theft.

Well how wrong the propaganda is! THC (famous for their tools and research in security) has just released some technical information, tools and a video which shows their cloned passport being read and verified by a passport reader.

The government plans to use ePassports at Immigration and Border Control. The information is electronically read from the Passport and displayed to a Border Control Officer or used by an automated setup. THC has discovered weaknesses in the system to (by)pass the security checks. The detection of fake passport chips does not work. Test setups do not raise alerts when a modified chip is used. This enables an attacker to create a Passport with an altered Picture, Name, DoB, Nationality and other credentials.

The manipulated information is displayed without any alarms going off. The exploitation of this loophole is trivial and can be verified using thc-epassport. Regardless how good the intention of the government might have been, the facts are that tested implementations of the ePassports Inspection System are not secure.

The passport reader appears to be in the Netherlands from my guise, but all the passports in use are the same just the templates slightly different.

Nice to see you again Mr Presley…imagine what could be done with this flaw in the sytem? I wonder if anything will be done about this or it’ll just be brushed under the carpet and remain knowledge of the security community.

Source: freeworld.thc

Posted in: Cryptography, Hardware Hacking, Privacy

,


Latest Posts:


BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.


8 Responses to THC-ePassports – THC Clones Biometric ePassport – Elvis Presley Passport

  1. d347hm4n October 3, 2008 at 8:51 am #

    These e-Passports have made it EASIER for criminals to cross international borders.

  2. Pantagruel October 3, 2008 at 11:01 am #

    Yep it’s Schiphol Airport (NL).

    After reading through the thc website article, it all seems rather easy to prep a fake id. :(

  3. SpikyHead October 3, 2008 at 11:51 am #

    These people can not even make secure identification systems and irony is that they are supposed to secure our countries…
    I wish they start using good security professionals to assess these systems.

  4. Orsigno October 3, 2008 at 7:15 pm #

    Have you ever heard the saying, “Closer to danger, further from trouble.”

    You’d think they would take something like this seriously, and create a secure scanner.

  5. Morgan Storey October 6, 2008 at 3:37 am #

    The problem here is bad implementation. I heard there is actually a PKI but only like 10 countries signed on and of those only 5 are using it, of course the most valued passports like NZ and the Netherlands aren’t using it. They are just using a self-signed key, and that can be broken or not used at all and still pass in other countries.

  6. Cor-Paul October 6, 2008 at 8:18 am #

    I don’t know what you guys make of this, but it’s clear to me: Elvis lives!

  7. Goodpeople October 9, 2008 at 9:18 am #

    Being from the Netherlands, I feel the urge to rectify this..

    The system involed in this is still in it’s test phase. Only a handfull of people are using it and that is monitored pretty closely.

  8. Morgan Storey October 9, 2008 at 10:48 pm #

    @Goodpeople: Have a listen to the interview with Peter Guttman, an expert in this field here (good podcast btw, and I am not associated with it): http://itradio.com.au/security/?p=88 he clearly points out it has gone to far. The USA demanded all passports have the RFID tags in them a little while ago, so most now do. E-Passports are already implemented in most countries, and implemented wrongly, and of those that are left they are going to implement it to the existing standard (see wrongly).
    The game is already over, the only solution is to laughibly scrap the lot and get someone who knows what they are doing to redesign it.