Senate ID Cards Use A Photo Of A Chip Rather Than An Actual Smart Chip
from the security-by-stupidity dept
Our government isn’t exactly known for its security chops, but in a letter sent recently from Senator Ron Wyden to two of his colleagues who head the Committee on Rules & Administration, it’s noted that (incredibly), the ID cards used by Senate Staffers only appear to have a smart chip in them. Instead of the real thing, some genius just decided to put a photo of a smart chip on each card, rather than an actual smart chip. This isn’t security by obscurity, it’s… bad security through cheap Photoshopping. From our Senate.
Moreover, in contrast to the executive branch’s widespread adoption of PIV cards with a smart chip, most Senate staff ID cards have a photo of a chip printed on them, rather than a real chip. Given the significant investment by the executive branch in smart chip based two-factor authentication, we should strongly consider issuing our staff real chip-based ID cards and then using those chips as a second factor.
We asked the Senate if there was any way we could get a (heavily redacted, obviously) image of a Senate ID with the “photo” smart chip but (not at all surprisingly) that request was rejected. So, instead, we’ve got this artist’s rendering of what something like it might look like, more or less.
Most of the letter (as the last sentence suggests), is about how the Senate barely uses two factor authentication, which is also kind of stunning. These days, two factor authentication is the absolute basic level necessary for anything that you want to keep moderately secure. That the Senate isn’t doing this (and that it’s faking smart chips) is preposterous. It’s great that Senator Wyden is calling out the Senate IT staff for this very basic failing. I don’t know for sure, but a lot about this letter makes me suspect that one Chris Soghoian is behind discovering the lack of a real smart chip and highlighting the lack of true two factor authentication (it’s possible it’s someone else, but it feels like a very Chris Soghoian thing to notice and call out…).
Filed Under: 2fa, chips, ron wyden, senate, smart card, two factor authentication
Comments on “Senate ID Cards Use A Photo Of A Chip Rather Than An Actual Smart Chip”
I’m afraid that artistic depiction of the card is not accurate. For better accuracy I’d go with graphical descriptions of crimes, corruption or our plain old uncle Lucifer (or the equivalent devil in any religion). That would be more fitting.
Though truth be said it wouldn’t be fair towards a few of them like Wyden.
Sorry, access denied!
Maybe I am missing something, but when the scanner that is supposed to read the chip, and there is only a photo of the chip, wouldn’t that cause the ‘system’ to reject the presenter? Some staffers cards work, others don’t, but they all get in? Astonishing.
Re: Sorry, access denied!
What scanner?
Re: Re: Sorry, access denied!
[Sad but True]
Re: Sorry, access denied!
Its all just security theater, they can wave a card when they need to show that they take security seriously, but to actually use it for security would be an imposition, and a waste of their precious time.
Re: Sorry, access denied!
No, see, you have a model of a scanner that reads the photo of a chip. Operated by a guy who plays a security guard on tv.
Re: Sorry, access denied!
You don’t need an ID to enter a Senate office building; they’re open to the public (you do need one to go through the staff line, but that’s just so that staff have a shorter line). For access control to offices, there’s an RFID chip.
Re: Sorry, access denied!
The scanner is actually just a picture of a scanner.
It’s pictures all the way down
Re: Re: Sorry, access denied!
In addition, senators have to make the scanning sound effect with their mouths to complete their security procedures.
Re: Re: Re: Sorry, access denied!
They can’t; they’re only pictures of Senators.
LOL, Wrong card number!
If you’re gonna put regular numbers on that card, why not one that’s easy to remember? 1234 5678 9012 3456!
That’s ok, they only have a photo of the card reader at entrances anyway. That’s the new TSA contractor’s collaboration with the legislative branch: Rapi-Pic. Rapi-Scan actually involved working parts and was too expensive.
It could be something
I don’t know if someone, versed in SecureID card system, inspected the card closely.
It could be that the picture is faking/protecting a contact port, while the NFC/wireless portion would still be working. If I’m not mistaken, contact gives more access than wireless, e.g. writing support.
Just a thought. Or I’m just mistaken, I obviously didn’t see the card either, but that’s something I could come up with in a given situation…
Sad but not surprising. When I asked my Representative about implementing Cyber Security standards for the average citizen, I got a Deer in the Headlight look, followed by a suggestion to ‘hold a seminar’.
Also, of the two factor methods mentioned, the ID card with a WORKING smart chip as Something you Have is the best. A high percentage of smartphones have malware/spyware installed and a USB device means you have to allow USB devices to be plugged into your secured computer. And USB is a known attack vector.
Re: Re:
“I got a Deer in the Headlight look”
I have to incorporate that in my daily vocabulary.
Re: Re:
Is USB still a weak point if you disable USB Mass Storage? I know that non-storage USB devices can still work even if you disable the ability to use thumbdrives and the like.
Re: Re: Re:
Mass storage is not the security risk with USB, so long as auto play is disabled, it is the ability to emulate a keyboard and a NIC that really open up security holes.
Re: Re: Re: Re:
Well it is not that hard to lock down a usb port to a single device. You shouldn’t leave the USB port physically available either. There are secure USB devices too.
The first 2 things can be accomplished by anyone with pretty basic knowledge and the final one just costs a bit more.
Re: Re: Re: Re:
Mass storage can be a security risk if you’re bringing personal files in that have viruses and then opening them on government machines.
Don't laugh! This shows just what can be done if you 'Hack Harder'.
The card uses the same technology as does the unbreakable, magic back doors that law enforcement wants deployed for encryption.
Re: Don't laugh! This shows just what can be done if you 'Hack Harder'.
So it’s a magic chip (TM). Gotcha.
Puts on a Deer in the Headlight look
Re: Re: Don't laugh! This shows just what can be done if you 'Hack Harder'.
It’s “deer in the headlights”. Or do you think we all operate mopeds??
Re: Re: Re: Don't laugh! This shows just what can be done if you 'Hack Harder'.
In Wisconsin, we go shining for deer on our Harleys.
Just business as usual
This is what you get when you buy security devices from the lowest bidder. They knew they didn’t need to actually spend the money on real chip cards – just print it on, and PROFIT.
Re: Just business as usual
“This is what you get when you buy security devices from the highest briber, er highest paying lobbyist. They knew they didn’t need to actually spend the money on real chip cards – just print it on, and PROFIT.”
#fakewho's
Rumor is that they were issued cards with smart chips, but sold them to the Russians.
Re: #fakewho's
After discovering they had been made in China.
I'm calling bullshit...
I’ve worked with SmartCard cards for login authentication. There is a picture of a chip on the card but its just a picture. The actual hardware is inside the card between two layers of plastic. Look at any RFID access card, this is how they work.
Re: I'm calling bullshit...
For contactless cards, sure, but many are still contact-based chip cards. The DoD uses contact-based SmartCards. Also, aren’t contactless cards inherently less secure due to the fact that you don’t actually need to make physical contact with the card?
Re: Re: I'm calling bullshit...
Actually, I am a little puzzled by the whole thing. When did chips become secure and well-implemented in the first place? I think i missed that day of class in the last 10 years or so when “smart chips” actually kinda sorta started living up to the theory behind them.
Re: I'm calling bullshit...
I don’t work with smartcards, so you might know better than me, but looking at this generic smartcard cutaway diagram here…
https://en.wikipedia.org/wiki/File:Smartcard_chip_structure_and_packaging_EN.svg
…it looks like the visible part of the chip on the surface of the smartcard (i.e., what you’d see if it were just a sticker), is not just a sticker but a "metal contact" connected to the embedded chip. From that, I’d say that if it were just a sticker (and not the metal contact component actually connected to the chip), it wouldn’t work.
So that, and the fact that Wyden has formally brought up the issue in the first place makes me think that this is probably not a case of, "bullshit".
Re: I'm calling bullshit...
These cards aren’t used for logging into computers; the executive branch often uses smartcards for login (e.g. the CAC), but the Senate just has username/password. There is an RFID chip inside, but so does my college ID card.
(My guess is that the picture is there because some staff do have actual smartcards for logging into computers, most staff don’t need it so don’t have it, but they get the picture printed so all the IDs look the same).
You got the correct picture
Trump thought this was a picture taken up his asshole, they weren’t allowed to use anything else.
What scares me is, my company is not a place where security is needed to keep things safe. I mean, some, but we make very large engine parts. (Think cruise ship engines and the like) its not like someone could walk off with something that weighs a ton. Computers and such sure, but most people bring them home with them. Network? That is pretty secure. And yet, to get into the building you need not only an ID to get into the main building but anywhere other than the main lobby takes a security code.
Re: Re:
My guess would be industrial espionage. They’re less concerned about employees stealing anything than someone walking in off the street and stealing data/designs/process/etc.
Re: Re:
Senate office buildings are open to the public. You need an ID to get in the staff entrance, but the staff entrance exists mostly so that staff don’t have to wait in a huge line to get to work. Everyone goes through security (I’m not sure if Members themselves do, but Capitol Police officers know who is and who isn’t a Member). In offices, you have to go by the front desk or use an RFID chip in the card to get in, and the people in a Senate office know who else works in their office.
This is genius!
I bet they saved a bunch on the paper mache card readers too! The only remaining question is which congressman got the kickbacks from the security contractor?
Or these are actually just RFID cards, and they printed the fake contacts so people would stop asking why there were no contacts. Most places use RFID only for access. The contacts would only be used for verification when logging on to a computer. If they don’t use that feature (though they should) then having the contacts/chip would be pointless.
Re: This is genius!
Every congressman and staffer may be carrying an RFID chip identifying them as such?
(Imagines the devices one could create – connected to an RFID reader – that activate when one of them walks past.)
Re: Re: This is genius!
A RFID card just provides a number, not actual identifiable information. They also have very short range, they need to be almost flush with the reader to work. So you may have to rethink your evil plans!
Re: Re: Re: This is genius!
RFID tags in smartcards are powered by the RFID reader’s radio waves. By cranking up the power you can increase the distance to at least a meter.
And that number won’t be random. Only some of the bits are a unique serial number. The rest identify the manufacturer and product ID, the organization that manages the data for the tag and whatnot. Even if that information isn’t published, you can probably analyse the data emanating from the pants of a few known congressmen and use that to identify others.
Re: This is genius!
Most staff don’t use them for logging in to computers, although for all I know some might. If I had to guess, I’d say that it’s probably a few who have actual login smartcards, and the rest have the picture of a chip so that all the IDs look the same.
So the chip on the card is a genuine as the person carrying it.
uMM aH???
To all that are reading this..
HOW MUCH DID/DO we pay for these cards??
The Standard is that If Citizens pay %6, the Gov pays $60-600..
Re: uMM aH???
Let us assume $600 per.
100 Senators.
Say 5 staff each
500x$600=$300,000
or 12% of 1 Mar-a-Lago trip (low balling, 2.5 million a trip)
Re: Re: uMM aH???
Whoops. Forgot to keep the Senators inclusive.
$360,000 for the cards. 14.4% of a Mar-a-Lago trip.
That chip is the mark of the beast. Those people know it and are hoping that after they command the rest of the nation to accept that chip, they will still have a chance to be saved. Imagine.
Re: Re:
IKR? The UPC is so old-hat now.
I whish my Credic Card came whith a photo of a Smart Chip
Because then I wouldn’t have to ram a screwdriver though it.
I know this story is about ID cards, but chips are also used in credit cards and I’ve never understood how they’re supposed to make the card holder’s information safer.
If someone with a chipped card uses it at a store and an unscrupulous employees makes a copy of that information and uses it to order stuff online or over the phone, what good does the chip do? Sure it makes the card harder to duplicate, but you don’t need the physical card to order stuff online.
Re: Re:
A huge portion of credit card theft involves stealing info for card-present transactions. This is pretty easy to do, because you can slap a skimmer on a credit card slot (including unattended card slots). You can’t copy the info on a chip, so it protects against that.
It doesn’t provide perfect security against all forms of attack. It improves security against one of the most common forms of attack. Most attacks do not involve a clerk reading your card number; those are also easier to trace because you can trace lots of fraud back to the store where the clerk works. If you put a skimmer on someone else’s card reader, tracing it back to the reader doesn’t lead authorities to you.
Mostly, I’m astonished that Senators would need an ID card at all.
Re: Re:
Senators don’t need them so much; the Capitol Police can recognize them (and they have lapel pins to identify them, so the police know to think “is this a Senator”). Staff are another story.
Do we know it's not a contactless smart card?
A bazillion years ago I worked on the security for the CAC card (the spiritual ancestor of the PIV card.) One thing we wrestled with was the security differences between a contactless smart card and a contacted smart card. If the card is to be used exclusively for “badging” applications (like opening doors) then a contactless card is not out of the question.
Photo of a badge
There’s a photo of a badge online here:
https://drpence.wordpress.com/2013/01/28/credentials/
(by Dr. Laura Pence, Professor of Chemistry at the University of Hartford, currently spending a sabbatical year as a Congressional Fellow in Washington)