BRIAN ROSS REPORTS
Bush Signs CNMI Immigration Bill into Law
Embattled Official Defends Pricey Hand Towels
Shock and Awe on M Street
WEWS Cleveland: Natural Gas Boom Has Hidden Danger
Lobbyists Making Even More Money Than Ever
Thanks to You, the Blotter Marks Second Year With More Success
White House Ousts Top Official Accused of Political Favoritism
Second Trial for Boeing Whistleblower
Undercover Investigation: One-Stop Shopping for Steroids
Report: U.S. Anti-Corruption Efforts Looking Good (in Iraq)
CIA Tape Probes, Still Chugging Along
Ex-KBR Workers to Testify on Contract Fraud
McCain Aided Arizona Businessman
Duke Briber Hasn't Made Bail, Judge Says
Rezko out on Bail
Despite Admission, Latest Hill Scandal "Still a Whodunit"
Radical Ties an Issue as Dems Debate
Repaid, Guam Drops Charges Against Abramoff Firm
D.C. Madam Trial: Powerful Men Won't Have to Testify?
Russia Upset Over Arms Dealer's Arrest?
What's Reflected in Cheney's Glasses?
Ex-Prez Clinton: Million Dollar Bill?
TOP BLOTTER CATEGORIES
- Abramoff Lobbying Scandal
- American Al Qaeda
- Avian Flu
- Beirut Hospital Out of Gas
- CIA
- CIA Secret Prisons
- D.C. Madam Affair
- FBI
- Federal Air Marshal Service
- Homeland Security
- Hurricane Katrina
- Mark Foley Internet Scandal
- Millionaire Sex Scandal
- Nigerian E-mail Scams
- Norman Hsu, Clinton Fundraiser
- NSA: Wiretapping
- Osama bin Laden
- Payola
- Pharmacy Investigation
- Speaker of the House Dennis Hastert
- Terror
- U.K. Airline Terror Plot
- U.K. Bombing Attempts
- Wen Ho Lee
- William Jefferson
- Zarqawi
Tech Firm: Our Secrets Are More Important Than Yours
April 18, 2007 10:34 AM
Twenty dollars worth of equipment can steal private information from chips embedded in many passports and "touchless" credit cards, according to security researcher Chris Paget.
But the company who makes the chips has blocked him from explaining the flaw to others, saying it would violate their intellectual property rights.
Paget, the director of research and development for computer security company IOActive, planned on giving a presentation at a conference in February on the dangers of radio frequency identification (RFID) chips. The devices store information and share it wirelessly, allowing data to be collected from a credit card or a passport by simply swiping the item past a reader. The same technology is used for express toll lanes, such as the E-Z Pass system used by several states.
Using about $20 worth of equipment bought on eBay, Paget wanted to show the audience how easy it was to make a handheld reader that could copy RFID signals. "It's not complicated," Paget told ABC News. "If you can understand an off-the-shelf electronics hobby kit...then it's easy."
But HID Global, the company that produces the chips Paget used as an example, sent Paget a letter telling him his presentation infringed on its patents for legitimate RFID card readers. Paget says the company threatened litigation if he would not stop.
Click Here for Full Blotter Coverage.
Unable to afford a legal battle, Paget removed the disputed information from his presentation. He has posted a redacted version of his presentation on the IOActive Web site.
"We've been forced to give up all our RFID research," Paget said, "Using patent law in this way is a horrific blow to the security community, when the big corporations stifle researchers by wielding this big legal axe."
Kathleen Carroll, director of government relations for HID Global, said that it was "absolutely not" the company's intention to stifle researchers. She cited an unwritten code of conduct for hackers who uncover security flaws. "HID appreciates the information hackers bring as long as they act responsibly. They're supposed to come to us first," she said.
Both Paget and Carroll agree that people have known about this particular security flaw for some time. And both say that most devices, including passports, have other security measures to protect personal information. But unauthorized signal reading is the first step in cracking these more complex devices.
"All we were trying to do was raise awareness of the issue," Paget said, "We're disappointed. There are a lot of ways the technology could be improved."
April 18, 2007 | Permalink | User Comments (0)
Post a comment
