Scan This Guy's E-Passport and Watch Your System Crash

[Ian David]

A German security researcher who demonstrated last year that he could clone the computer chip in an electronic passport has revealed additional vulnerabilities in the design of the new documents and the inspection systems used to read them.

Lukas Grunwald, an RFID expert who has served as an e-passport consultant to the German parliament, says the security flaws allow someone to seize and clone the fingerprint image stored on the biometric e-passport, and to create a specially coded chip that attacks e-passport readers that attempt to scan it.

Grunwald says he's succeeded in sabotaging two passport readers made by different vendors by cloning a passport chip, then modifying the JPEG2000 image file containing the passport photo. Reading the modified image crashed the readers, which suggests they could be vulnerable to a code-injection exploit that might, for example, reprogram a reader to approve expired or forged passports.

"If you're able to crash something you are most likely able to exploit it," says Grunwald, who's scheduled to discuss the vulnerabilities this weekend at the annual DefCon hacker conference in Las Vegas.


RFID expert Lukas Grunwald says e-passport readers are vulnerable to sabotage.
photo: Courtesy of Kim Zetter

More:
http://www.wired.com/politics/security/news/2007/08/epassport

[lapfog_1]

1. Ah yes, jpeg images stored on your passport.

Easy to create a "jpeg" that expands to overflow picture buffers (especially when they likely allocate only enough to contain the stated size and resolution of the image, encoded in the preamble to the jpeg). Once you overflow the buffer, you can pretty much do what you want.

My very first "hack" was a similar attack to an old operating system that didn't protect against a buffer overflow. Overflow enough and you can find a call stack or dynamic code chunk, load your own floatable assembly code and you are off to the races...

Silly programmers!

[vgt888]

2. interesting!

How can one accomplish this, in hopes to protect their own systems from such an attack? Feel free to send me a PM if you like. Thanks!