{"id":768,"date":"2015-11-08T13:07:46","date_gmt":"2015-11-08T13:07:46","guid":{"rendered":"http:\/\/nethemba.com\/sk\/o-nas\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/"},"modified":"2019-08-05T13:12:20","modified_gmt":"2019-08-05T12:12:20","slug":"public-security-analysis-of-slovak-biometric-passports","status":"publish","type":"page","link":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/","title":{"rendered":"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu"},"content":{"rendered":"<h3 lang=\"en-GB\">(st\u00e1le prebieha &#8211; v pr\u00edpade, \u017ee n\u00e1m viete pom\u00f4c\u0165, <a href=\"https:\/\/nethemba.com\/sk\/kontakt\/\">nev\u00e1hajte n\u00e1s kontaktova\u0165<\/a>)<\/h3>\n<p lang=\"en-GB\">Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Pas je mo\u017en\u00e9 na\u010d\u00edtat \u013eubovo\u013enou ISO14443A RFID \u010d\u00edta\u010dkou (pre n\u00e1\u0161 experiment sme pou\u017eili lacn\u00fa <a href=\"http:\/\/www.touchatag.com\/\">touchatag \u010d\u00edta\u010dku<\/a>, ktor\u00fa je mo\u017en\u00e9 <a href=\"http:\/\/www.touchatag.com\/e-store\">zak\u00fapi\u0165<\/a> za 30 \u20ac).<\/p>\n<p lang=\"en-GB\">Na pre\u010d\u00edtanie je potrebn\u00fd <a href=\"http:\/\/en.wikipedia.org\/wiki\/Machine-readable_passport\">MRZ k\u00f3d<\/a>, ktor\u00fd je uveden\u00fd na predposlednej strane pasu. MRZ sa sklad\u00e1 prim\u00e1rne z \u010d\u00edsla pasu, d\u00e1tumu narodenia a d\u00e1tumu expir\u00e1cie pasu. Na z\u00e1klade osobn\u00fdch \u00fadajov sa MRZ <a href=\"http:\/\/www.highprogrammer.com\/cgi-bin\/uniqueid\/mrzp\">d\u00e1 aj vypo\u010d\u00edta\u0165<\/a>. So znalos\u0165ou MRZ k\u00f3du je mo\u017en\u00e9 z pasu pre\u010d\u00edta\u0165:<\/p>\n<ul>\n<li>v\u0161etky osobn\u00e9 data uveden\u00e9 v pase (EF.DG1)<\/li>\n<li>fotografiu vlastn\u00edka (ulo\u017een\u00fa v\u00a0JPEG) (EF.DG2)<\/li>\n<\/ul>\n<p lang=\"en-GB\">\u00a0MRZ k\u00f3d ale nesta\u010d\u00ed na na\u010d\u00edtanie:<\/p>\n<ul>\n<li>odtla\u010dku prstu vlastn\u00edka pasu (EF.DG3)<\/li>\n<li>&#8222;Active Authentication Public\u00a0Key Info&#8220; (EF.DG15)<\/li>\n<\/ul>\n<p lang=\"en-GB\">Pas nebol nijako chr\u00e1neny <a href=\"http:\/\/www.rfid-shield.com\/\">\u0161peci\u00e1lnym puzdrom<\/a>, tak\u017ee ho bolo mo\u017en\u00e9 pre\u010d\u00edta\u0165 v zatvorenom stave zo vzdialenosti 5 cm. V pr\u00edpade pou\u017eitia silnej ant\u00e9ny t\u00e1to vzdialenos\u0165 m\u00f4\u017ee by\u0165 podstatne v\u00e4\u010d\u0161ia (a\u017e 10 metrov a bude na\u010falej r\u00e1s\u0165).<\/p>\n<p lang=\"en-GB\">Pas vracia n\u00e1hodny unik\u00e1tny identifik\u00e1tor (UID), tak\u017ee ho nie je mo\u017en\u00e9 na dia\u013eku &#8222;fingerprintn\u00fa\u0165&#8220; a teda odhadn\u00fa\u0165 v\u00fdrobcu\u00a0(toto spr\u00e1vanie je mo\u017en\u00e9 emulova\u0165 \u010dipovou kartou NXP JCOP 41 v2.2.1 72KRANDOM_UID).<\/p>\n<p lang=\"en-GB\">\u00a0Bez znalosti &#8222;Active Authentication Public Key Info&#8220; pas nie je mo\u017en\u00e9 jednoducho vyklonova\u0165.<\/p>\n<p lang=\"en-GB\">\u00a0Potrebn\u00e9 overi\u0165:<\/p>\n<ul>\n<li>ako sa spr\u00e1vaj\u00fa dostupn\u00e9 \u010d\u00edta\u010dky biometrick\u00fdch pasov na Slovensku pri chybnom hashi, digit\u00e1lnom podpise, absencii AA inform\u00e1cie (je mo\u017en\u00e9, \u017ee akceptuj\u00fa aj nedokonal\u00fd klon)<\/li>\n<li>je mo\u017en\u00e9 vytvori\u0165 nedokonal\u00e9ho klona na emul\u00e1tor NXP\u00a0JCOP 41 v2.2.1 72k RANDOM_UID, kedy sa EF.DG3 a EF.DG15 vyhod\u00ed z passport.indexu &#8211; bude tento klon akceptovan\u00fd slovensk\u00fdmi \u010d\u00edta\u010dkami biometrick\u00fdch pasov?<\/li>\n<li>overi\u0165 mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. <a href=\"http:\/\/wiki.whatthehack.org\/images\/2\/28\/WTH-slides-Attacks-on-Digital-Passports-Marc-Witteman.pdf\">anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase<\/a>)<\/li>\n<li>analyzova\u0165 entropiu MRZ:<br \/>\nd\u00e1tum expir\u00e1cie pasu pri 10\u00a0rokoch = 3650\u00a0hodn\u00f4t<br \/>\nd\u00e1tum narodenia (pri odhade +\/- 5 rokov) = 3650\u00a0hodn\u00f4t<br \/>\n\u010d\u00edslo pasu (2\u00a0alfaznaky + 7 \u010d\u00edslic) = 25 * 25 * (10\u00a0^ 7) = 6250000000 hodn\u00f4t<\/li>\n<li>je mo\u017en\u00e9 determinova\u0165 \u010d\u00edslo pasu (ak\u00fdm sp\u00f4sobom sa pride\u013euje?)<\/li>\n<\/ul>\n<p lang=\"en-GB\">\u00a0<strong>M\u00e1te pr\u00e1vo by\u0165 informovan\u00fd o bezpe\u010dnosti technol\u00f3gi\u00ed, ktor\u00e9 sa t\u00fdkaj\u00fa va\u0161ich osobn\u00fdch \u00fadajov!<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(st\u00e1le prebieha &#8211; v pr\u00edpade, \u017ee n\u00e1m viete pom\u00f4c\u0165, nev\u00e1hajte n\u00e1s kontaktova\u0165) Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Pas je mo\u017en\u00e9 na\u010d\u00edtat \u013eubovo\u013enou ISO14443A RFID \u010d\u00edta\u010dkou (pre n\u00e1\u0161 experiment sme pou\u017eili lacn\u00fa touchatag \u010d\u00edta\u010dku, ktor\u00fa je mo\u017en\u00e9 zak\u00fapi\u0165 za 30 \u20ac). Na pre\u010d\u00edtanie je potrebn\u00fd MRZ k\u00f3d, ktor\u00fd je uveden\u00fd na predposlednej [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":522,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-768","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba<\/title>\n<meta name=\"description\" content=\"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/\" \/>\n<meta property=\"og:locale\" content=\"sk_SK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba\" \/>\n<meta property=\"og:description\" content=\"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/\" \/>\n<meta property=\"og:site_name\" content=\"Nethemba\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/nethemba\" \/>\n<meta property=\"article:modified_time\" content=\"2019-08-05T12:12:20+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@nethemba\" \/>\n<meta name=\"twitter:label1\" content=\"Predpokladan\u00fd \u010das \u010d\u00edtania\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 min\u00faty\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/public-security-analysis-of-slovak-biometric-passports\\\/\",\"url\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/public-security-analysis-of-slovak-biometric-passports\\\/\",\"name\":\"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#website\"},\"datePublished\":\"2015-11-08T13:07:46+00:00\",\"dateModified\":\"2019-08-05T12:12:20+00:00\",\"description\":\"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/public-security-analysis-of-slovak-biometric-passports\\\/#breadcrumb\"},\"inLanguage\":\"sk-SK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/public-security-analysis-of-slovak-biometric-passports\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/public-security-analysis-of-slovak-biometric-passports\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/domov\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"O n\u00e1s\",\"item\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"V\u00fdskum\",\"item\":\"https:\\\/\\\/nethemba.com\\\/sk\\\/o-nas-old\\\/vyskum\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/nethemba.com\\\/de\\\/\",\"name\":\"Nethemba\",\"description\":\"We care about your security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nethemba.com\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sk-SK\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba","description":"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/","og_locale":"sk_SK","og_type":"article","og_title":"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba","og_description":"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...","og_url":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/","og_site_name":"Nethemba","article_publisher":"https:\/\/www.facebook.com\/nethemba","article_modified_time":"2019-08-05T12:12:20+00:00","twitter_card":"summary_large_image","twitter_site":"@nethemba","twitter_misc":{"Predpokladan\u00fd \u010das \u010d\u00edtania":"2 min\u00faty"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/","url":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/","name":"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu - Nethemba","isPartOf":{"@id":"https:\/\/nethemba.com\/de\/#website"},"datePublished":"2015-11-08T13:07:46+00:00","dateModified":"2019-08-05T12:12:20+00:00","description":"Prakticky sme demon\u0161trovali na\u010d\u00edtanie nov\u00e9ho slovensk\u00e9ho biometrick\u00e9ho RFID pasu. Overujeme mo\u017enos\u0165 \u00fatoku cez postrann\u00e9 kan\u00e1ly (napr. anal\u00fdza nap\u00e4\u0165ovej stopy RSA v \u010dase)...","breadcrumb":{"@id":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/#breadcrumb"},"inLanguage":"sk-SK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/public-security-analysis-of-slovak-biometric-passports\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nethemba.com\/sk\/domov\/"},{"@type":"ListItem","position":2,"name":"O n\u00e1s","item":"https:\/\/nethemba.com\/sk\/o-nas-old\/"},{"@type":"ListItem","position":3,"name":"V\u00fdskum","item":"https:\/\/nethemba.com\/sk\/o-nas-old\/vyskum\/"},{"@type":"ListItem","position":4,"name":"Bezpe\u010dnostn\u00e1 anal\u00fdza slovensk\u00e9ho biometrick\u00e9ho pasu"}]},{"@type":"WebSite","@id":"https:\/\/nethemba.com\/de\/#website","url":"https:\/\/nethemba.com\/de\/","name":"Nethemba","description":"We care about your security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nethemba.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sk-SK"}]}},"_links":{"self":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/pages\/768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/comments?post=768"}],"version-history":[{"count":0,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/pages\/768\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/pages\/522"}],"wp:attachment":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/media?parent=768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}