Clone Chip: Electronic pickpocketing

source: http://www.cbs12.com/news/top-stories/stories/vid_413.shtml (for full video interview)

MIAMI — Last November, CBS 12 showed you how crooks are stealing credit card information electronically without you even knowing it. Tonight CBS 12 uncovers a potential new target of identity thieves, your passport.

One expert says thieves are stealing and then cloning travel documents, but what’s worse…who they may be passing the pilfered passports to.

Like every passenger trying to make a flight, trying to dodge all the other travelers at the airport, and hoping to avoid all those carry-on fees, now there’s something new at the airport for Renita Daniels to worry about.

RENITA DANIELS/TRAVELER: To work that hard, go to work every day, pay bills, just to have someone take my identity and do God knows what with it, it’s pretty scary.

She’s not talking about someone stealing her credit card information. Instead, she’s alarmed at a new potential crime at airports: Thieves electronically pickpocketing passports.

DR. FAISAL KALEEM/FIU PROFESSOR: They can read it off their pockets.

That’s how easy FIU Professor of Electronic Engineering Dr. Faisal Kaleem says it’s to steal someone’s passport information.

Since 2006, the Department of State began issuing passports with small RFID (or radio frequency identification) chips. They contain the name, nationality, gender, date of birth, and place of birth of the passport holder, as well as a digitized photo of that person.

DR. FAISAL KALEEM/FIU PROFESSOR: If we save that passport in a digital file, that file can be sent to terrorist people, malicious people who can regenerate an identical passport for malicious purposes.

Kaleem, who teaches a course in ethical hacking at FIU, showed us how easy it’s to hi-jack your passport.

Using a cheap RFID reader– similar to credit card scanners– and software readily available from the internet that can break the chip’s encryption, we sat the professor down at busy Miami International Airport to see if this worked. Our first willing victim, Renita.

It took about 7 seconds– with Renita anxiously waiting– until her passport picture and information popped up on a perfect stranger’s computer.

RENITA: That’s really scary.

Our next victim, David Salinas heading to Houston. Once again just a few seconds, and utter shock.

DAVID: Oh wow.

JUAN CARLOS FANJUL: That’s you?

DAVID: Yes that’s me. Yep.

All of the passengers we talked to had no idea their passport had an electronic chip, and if they did, they assumed the RFID was in the front where this logo is. As it turns out, the chip is hidden the back page somewhere.

DR. FAISAL KALEEM/FIU: After this information has been lifted, someone could clone your passport.

It used to be identity thieves would manipulate the pictures.

DR. FAISAL KALEEM/FIU PROFESSOR: But now they have something called PIP, Person in Picture. Where they put make-up on you, so the person looks like the picture.

The state department maintains their passports are encrypted and that you would need special codes found in the passport to be able to scan the information.

We needed the codes to do our experiment, but it’s certainly not a problem, if your passport is stolen unbeknownst to you and then returned.

DAVID SALINAS: It makes you concerned for your security. Someone can steal your passport information and use that information to do whatever with it.

There’s no indication terrorists have used this method successfully, at least none that have been reported.

JUAN CARLOS FANJUL: What is the lesson learned in all of this for you?

RENITA: Just to make sure I know where my things are at all times.

Besides keeping an eye on your passport, there are also RFID Blocking Passport Covers for about $15 online. Money well spent to keep your passport information safe.

A state department spokeswoman would not reveal if there are any documented cases of cloned passports and stressed that the RFID chip also contains a unique electronic signature which makes it, “nearly impossible for the average person to counterfeit or alter a passport convincingly.”

Leave a Reply