Schneier on Security

Bret McDanel • March 17, 2005 1:57 PM

The article states:
The electronic chip will carry the information on the data page of
the passport plus a biometric identifier to enhance the ability to
identify the bearer. The biometric chosen for the initial version of
the U.S. electronic passport is the facial image, one of three
biometrics currently identified by the International Civil Aviation
Organization (ICAO) as suitable for inclusion in international travel
documents, although the facial image was mandatory. Under the proposed
rule, border inspectors would compare the passport bearer with the
digital facial image stored on the electronic chip. ICAO also
recognizes fingerprints and iris scans as acceptable biometrics. ,,,

Facial recognition can be defeated, however for passport controls you can force people to take off hats, glasses and pull hair back. What bothers me is that facial recognition is the easiest way to profile people from a distance. By creating a database of facial images, that could then be compared as the test done at one superbowl not too long ago, what is to say they wont start tapping into muni cameras and feeding it the data from the passports?

If they go to fingerprints, those can eaisly be forged, and if it is like the DMV in california there is no physical inspection of the fingers to ensure they are accurate. The print data is read optically so its easier to fool than some scanners.

The chip also needs to be physically secure, and I do not believe this will be true. Its only a matter of time when people start ripping it apart to see how it works. Will this be like the ‘secure’ RFID chips used in Ford auto keys and at some gas stations?

Bret McDanel • March 17, 2005 4:05 PM

Well it is easy with basically hollywood techniques to create a face that would be different. Foam latex can be cast in a mold (I bought stuff at ‘cinema secrets’ in Burbank which sells everything needed). Foam latex is not the same as liquid latex, its lighter, and can be painted (airbrushed) easily, and there is a special powder you apply on foam latex to make it look more realistic.

Using computers a mold can be formed from pictures alone with no ‘art’ skill to sculpt a face from someone else.

Since facial recognition systems are based on proportions (to compensate for distance from camera, zoom level, and of course weight gain/loss within reason over time) it wouldnt matter if the face was a little larger or smaller than real, as long as proportions are kept the same. This would be similar to what was done in mission impossible (both the 80s tv series maybe the original tv series, and certainly the first movie). Although removing the foam latex would be different than depicted. It could allow for someone to easily cross lines without as easily being caught.

Now this data is on the passport, the ethics groups on this issue is a match and forget system, however there has never been a single database in America, and most likely other countries, where the initial purposes were not expanded to do more. By haaving the facial data on the passport there is no need for a repository of stored info, other than as a master for generation of the passport data.

One problem with foam latex is that thermal imaging would show heat oddities, especially stuff that is sensitive enough to detect blood vessels, which even identical twins do not share. You would not sweat through the foam latex either, so in a hot country that may look odd that you have totally dry skin (mist bottle may fix that though).

Foreign countries most likely will not have the ability to read this, and there is still the ability to travel in various parts of the world without a passport. In europe for example, as long as you dont get on a plane (travel by car, ferry, train, etc) you dont need a passport so long as you have an EU drivers license. In the UK due to common law ‘right’ to call yourself anything you want (unless for fraud) you can, or at least a couple years ago used to, get a drivers license in any name you choose (California is the same way oddly, or was).

I do not think that the CIA has a problem doing infiltration or exfiltration. In the 70s they did an exfiltration using Canadian passports (and got Canada to change some laws to allow for govt issued passports to non citizens to get a specific group out of Iran). The CIA also has a group whose job it is to travel and get visa documents from various countries so they can continually forge such documents. Either a rubber stamp visa or seperate papers which are copied.

Bret McDanel • March 17, 2005 6:21 PM

The other thing is that with contactless they can read without cameras. And reading the data from RFID or similar is far easier than doing an actual compare of facial data due to computer cycles required.

Contact based systems are a little harder, contacts wear out, the card surface can wear, etc. So in high volume processing its a little quicker, at the cost of the privacy of the information, to do.

There are CF based RFID readers (although I have only found one company selling them in Germany). Now that everyone is pretty much using the same 13.65MHz standard instead of 125kHz or 400kHz … My guess is that the next device in personal protection is going to be a RFID reader detector (since they do emit a signal that can be detected easily enough).

There are devices that claim to basically make a faraday cage to encase your RFID so it cant be read from remote (some unmodified readers can read 30 feet away …) I do not know how well they work as they arent grounded, but they should attenuate the signal at least a little, making it harder but not impossible to read.

A friend would always carry an old prox card in his wallet next to his real one so both cards would emit at the same time and garble the signal, this is ok for casual reading (the type done by street urchins) but wouldnt stop someone with a good radio and some clever DSP algorithms to process the signal.

If you have 1 old meaningless card and one that is attenuated odds are most scanners that are for casual use would just read the old one and not notice the new one.

I do have to ask though why dont rfid makers put a switch on the units so it takes a positive action of the holder to make it work? Basically there is a coil inside that receives EM from the reader which powers the device, which is a simple radio that transmits via a small antenna. If that coil had a switch (there would be some loss and other issues to deal with though) then the card wouldnt be succeptable to most casual passive reading, although depending on device it may be better to remove power to the IC that is in the RFID.

Bret McDanel • March 18, 2005 2:51 PM

A couple of things, iso 14443 type A&B defines contactless smartcards (alternate is iso 15693, and iso 14443 type c,d,e & f havent yet been approved afaik), it uses a RF signal to transmit the data. This can be read from a distance. I should have the standard on my webpage somewhere (I know I have it however I do not know if its up, I will verify later today and put it up if it isnt). The difference between an RFID and a iso14443 smartcard is the same. They are called RFIDs but iso14443 clearly states in section 6.1 it operates at 13.56MHz +/- 7kHz. Which I said before. This is the same frequency the devices mentioned at http://www.rfidanalysis.org talk about (ford keys and mobile speedpass). Rather than bicker about how its one thing and not the other, it may be more productive to just assume that in todays market place they are the same thing. BTW the CF proxcard reader that I found works on this same frequency as well. CF reader http://tinyurl.com/5ngkr

A faraday cage (as I briefly talked about earlier) is normally a grounded metal box. Grounding is critical to prevent the metal from acting like an antenna and still passing signal through. It would act more like a parasitic antenna than a driven antenna, but still. A metal box in your pocket is not grounded, and while it might attenuate the signal it wont prevent it from traveling out. If it attenuates enough it would prevent the card from getting enough power to transmit, or weaken the power it gets so it doesnt transmit as much. This is most likely how the devices work, however I have never had one so I do not know specifically. The faraday cage blocks signals upto a specific frequency. The lowest frequency allowed out or in is based on the largest hole in the cage using the following:
wavelength = C/f * sqrt(E)
C is speed of light (300,000,000m/s)
f is frequency
E is the dielectric constant of the propagation medium. 1.00 in a vaccuum 1.06 in dry air.

To simplify, sqrt(1)==1 so we can for the most part omit sqrt(E) becuase its close enough to 1. if frequency is expressed in MHz we can shorten C to just 300 meters/sec. This is really not an issue for 13.56 MHz but would be for higher frequencies including harmonics, although that starts to go beyond standard readers.

If the device isnt grounded though I am unsure how well it would work. The only way to find out is to get a reader and actually test.

The data on the chip is said to have facial patterns as well as bio data on the person. the bio data is already known, however the database would have to be extended to store the facial data as well. Facial data is a requirement for biometric passports according to ICAO. Other information can be fingerprints (easily forged going to be documenting my now 5 year old project on this on my webpage) and retina scans (schipol airport in Amsterdam has done this for years on an opt-in basis for EU citizens that travel frequently, they can read retinas upto 30 feet away).

The fact that the bio data is available that would allow someone to know that you have a US passport. That in itself is a security risk in some places in hte world (and has been for many many years). In the 70s people were seized in Iran becuase they were americans, and the exfiltration that was done was in part with Canadian officals help to give them Canadian passports to sneak them out.

Bret McDanel • March 20, 2005 3:30 PM

Anony Mouse I think you miss an overall fact. Even without this data being on the passport hostile countries can already implement their own facial recognition systems (or gait or retina or …) and subject individuals coming in to those checks. This would be a system and database they own and totally control. They could then quite easily match the data. They dont need to rely on biometric data from a US issued passport to do this. To think that anyone who distrusts the US would rely on data provided by the US as authoritative is silly and absurd.

Bret McDanel • March 21, 2005 2:41 PM

Thanks for the update David. I had not played with ungrounded shields, so I left that open.

As for related stories CNET has one.
http://news.com.com/5208-1012-0.html?forumID=1&threadID=2830&messageID=16211&start=-1
The guy claims inside knowledge in the title, and while there are electronic fields and magnetic fields, at certain frequency ranges they tend to be closely coupled and thus you can refer to them as electromagnetic fields. This is not the case at really low frequencies (below normal radio) so it would be more accurate there to say that you have 2 distinct fields.

An electric field is present when a device has electricity (even if off, if its plugged in there is an electric field). A magnetic field is caused by current flowing through a device. At 13.56 MHz (well into the radio spectrum) odds are high that there would be a EM field that could be decoded. I have not played with this specific device but my guess is that with appropriate radio receivers and DSP algorithms you could read the devices transmission data from greater distances. Of course you still have to supply power to the device, which the readers all have built in.

I would be more concerned with someone reading it and identifying me as American than with them getting my name (which I use freely both here and on my website), date of birth (which even the government messed up on and is incorrect there, didnt catch it until the credentials were issued), etc. If they are close enough to read the facial data off my passport they are close enough to take a picture and generate their own facial biometric data.