Australian digital driving licenses can be defaced in minutes
(2022/05/31)
- Reference: 1653953466
- News link: https://www.theregister.co.uk/2022/05/30/nsw_digital_drivers_licenses_hackable/
- Source link:
An Australian digital driver's license (DDL) implementation that officials claimed is more secure than a physical license has been shown to easily defaced, but authorities insist the credential remains secure.
New South Wales, Australia's most populous state, [1]launched its DDL program in 2019, and as of 2021 officials there [2]said that slightly more than half of the state's eight million people use the "Service NSW" app that displays the DDL and offers access to many other government services.
Now, a security researcher at cybersecurity company Dvuln claims he was able to brute force his way into the app with nothing but a Python script and a consumer laptop. Once inside, he found numerous security flaws that made it simple to alter the DDL stored in the app.
[3]
"The DDL is hosted securely on the new Service NSW app, locks with a PIN and can be accessed offline. It will provide additional levels of security and protection against identity fraud, compared to the plastic driver licence," NSW Minister for Customer Service Victor Dominello said in 2019 when the service launched.
[4]
[5]
Noah Farmer, the Dvuln researcher who found the flaw, challenged that assertion.
Insecure by design
Five separate design flaws were discovered in the NSW DDL app. Combining the flaws "presented a favorable scenario that could be exploited by any would-be attacker or fraudster," Farmer said.
First, and most important for efforts at cracking the app, it only uses a four-digit PIN to unlock, and that code is also the decryption key for the license, which is stored in a JSON file. With a Python script and a laptop, Farmer was [6]able to brute force the app in minutes, giving him access to the DDL.
Additionally, the app never validates stored DDL data with NSW government records, fails to "refresh" license data properly, transmits minimal info in its QR code (which is also alterable) and includes license data in device backups, "which means that attackers or anyone wanting to commit fraud can modify their license details without needing to jailbreak their device," Farmer said.
[7]
According to Farmer, all of the security features included in NSW's DDLs, like an animated NSW government logo, refresh rate, QR code, moving hologram and watermark, are retained when making changes to license data, which he said "creates a false sense of trust."
Service NSW, the government agency that runs the app of the same name, told The Register the flaws Noah found are not a threat to users or the integrity of the DDL.
[8]Australian police suggests app to record consent to sexual activity
[9]A bridge too far: Passengers on Sydney's new ferries would get 'their heads knocked off' on upper deck, say politicos
[10]Facebook deliberately took down Australian government pages during pay-for-news negotiations: report
"This issue is known and does not pose a risk to customer information," a spokesperson said. "The blogger [Noah] has manipulated their own Digital Driver Licence (DDL) information on their local device."
"Importantly, if the tampered license was scanned by police, the real time check used by NSW Police would show the correct personal information," the spokesperson added. "Upon scanning the license it would be clear to law enforcement that it has been tampered with."
"The DDL has been independently assessed by cyber specialists and is more secure than the plastic card," the spokesperson added, before pointing out that altering the DDL is against the law and that Service NSW constantly reviews the security of its offerings.
[11]
That leaves the defacement attack a route to creating a fake ID that might fool a human in the context of moments such as proving age to get into the pub, or renting a car. But identity fraud appears not to be possible.
DDLs: Coming soon to a state near you, probably
New South Wales isn't the only place where DDLs are being tested, nor the only places where they're accepted.
The UK government has been testing DDLs [12]since 2016 , and Secretary of State for Transport Grant Shapps said they [13]may arrive before 2024 . Apple Wallet added support for DDLs [14]last year and rolled the service out to Georgia and Arizona, with plans to expand to Connecticut, Iowa, Kentucky, Maryland, Oklahoma, and Utah. Google recently announced that the Wallet is returning with DDL capabilities as well, though didn't say where or when it will be available. In all, more than 20 US states have signaled interest in DDLs, the Washington Post [15]said .
Even NSW [16]adding digital trades and credentials licenses, opening up a whole other realm of fraud possibilities.
Hardening DDLs is relatively simple, Farmer said. Using iOS' built-in SecRandomCopyBytes, which strengthens encryption by generating random bytes, is just one simple way the app could be changed to enhance security, and the addition of just a bit more code would stop the app from allowing iOS to back up sensitive data.
Fisher said that the Dvuln team believes DDLs could be more secure than physical cards, but that the NSW implementation fails to do what it claims - for now. " if the [DDL] was improved by implementing a more secure design … we would agree that [DDLs] would provide additional levels of security against fraud compared to the plastic drivers licence," Fisher wrote.
Whether other governments will take DDL security more seriously remains to be seen, though [17]examples of [18]state-designed software [19]doesn't often instill confidence. ®
Get our [20]Tech Resources
[1] https://www.nsw.gov.au/media-releases/nsw-digital-drivers-licence-rolled-out-statewide
[2] https://www.nsw.gov.au/media-releases/half-of-drivers-using-a-digital-driver-licence
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://youtu.be/k89Qub3BVxs
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/03/18/consent_app_idea_nsw/
[9] https://www.theregister.com/2020/08/24/sydney_ferries_too_tall/
[10] https://www.theregister.com/2022/05/06/facebook_australia_influence/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2016/05/20/digital_driving_licence/
[13] https://www.rac.co.uk/drive/news/driving-law/digital-driving-licences-will-arrive-before-2024/
[14] https://www.theregister.com/2021/06/08/apple_2021_wwdc/
[15] https://www.washingtonpost.com/technology/2021/10/11/digital-drivers-license-mdl/
[16] https://www.nsw.gov.au/nsw-government/projects-and-initiatives/digital-trade-licence
[17] https://www.theregister.com/2019/11/14/home_office_brexit_app_hack_claims/
[18] https://www.theregister.com/2022/01/19/olympics_app_vulnerabilities_censorship/
[19] https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144
[20] https://whitepapers.theregister.com/
New South Wales, Australia's most populous state, [1]launched its DDL program in 2019, and as of 2021 officials there [2]said that slightly more than half of the state's eight million people use the "Service NSW" app that displays the DDL and offers access to many other government services.
Now, a security researcher at cybersecurity company Dvuln claims he was able to brute force his way into the app with nothing but a Python script and a consumer laptop. Once inside, he found numerous security flaws that made it simple to alter the DDL stored in the app.
[3]
"The DDL is hosted securely on the new Service NSW app, locks with a PIN and can be accessed offline. It will provide additional levels of security and protection against identity fraud, compared to the plastic driver licence," NSW Minister for Customer Service Victor Dominello said in 2019 when the service launched.
[4]
[5]
Noah Farmer, the Dvuln researcher who found the flaw, challenged that assertion.
Insecure by design
Five separate design flaws were discovered in the NSW DDL app. Combining the flaws "presented a favorable scenario that could be exploited by any would-be attacker or fraudster," Farmer said.
First, and most important for efforts at cracking the app, it only uses a four-digit PIN to unlock, and that code is also the decryption key for the license, which is stored in a JSON file. With a Python script and a laptop, Farmer was [6]able to brute force the app in minutes, giving him access to the DDL.
Additionally, the app never validates stored DDL data with NSW government records, fails to "refresh" license data properly, transmits minimal info in its QR code (which is also alterable) and includes license data in device backups, "which means that attackers or anyone wanting to commit fraud can modify their license details without needing to jailbreak their device," Farmer said.
[7]
According to Farmer, all of the security features included in NSW's DDLs, like an animated NSW government logo, refresh rate, QR code, moving hologram and watermark, are retained when making changes to license data, which he said "creates a false sense of trust."
Service NSW, the government agency that runs the app of the same name, told The Register the flaws Noah found are not a threat to users or the integrity of the DDL.
[8]Australian police suggests app to record consent to sexual activity
[9]A bridge too far: Passengers on Sydney's new ferries would get 'their heads knocked off' on upper deck, say politicos
[10]Facebook deliberately took down Australian government pages during pay-for-news negotiations: report
"This issue is known and does not pose a risk to customer information," a spokesperson said. "The blogger [Noah] has manipulated their own Digital Driver Licence (DDL) information on their local device."
"Importantly, if the tampered license was scanned by police, the real time check used by NSW Police would show the correct personal information," the spokesperson added. "Upon scanning the license it would be clear to law enforcement that it has been tampered with."
"The DDL has been independently assessed by cyber specialists and is more secure than the plastic card," the spokesperson added, before pointing out that altering the DDL is against the law and that Service NSW constantly reviews the security of its offerings.
[11]
That leaves the defacement attack a route to creating a fake ID that might fool a human in the context of moments such as proving age to get into the pub, or renting a car. But identity fraud appears not to be possible.
DDLs: Coming soon to a state near you, probably
New South Wales isn't the only place where DDLs are being tested, nor the only places where they're accepted.
The UK government has been testing DDLs [12]since 2016 , and Secretary of State for Transport Grant Shapps said they [13]may arrive before 2024 . Apple Wallet added support for DDLs [14]last year and rolled the service out to Georgia and Arizona, with plans to expand to Connecticut, Iowa, Kentucky, Maryland, Oklahoma, and Utah. Google recently announced that the Wallet is returning with DDL capabilities as well, though didn't say where or when it will be available. In all, more than 20 US states have signaled interest in DDLs, the Washington Post [15]said .
Even NSW [16]adding digital trades and credentials licenses, opening up a whole other realm of fraud possibilities.
Hardening DDLs is relatively simple, Farmer said. Using iOS' built-in SecRandomCopyBytes, which strengthens encryption by generating random bytes, is just one simple way the app could be changed to enhance security, and the addition of just a bit more code would stop the app from allowing iOS to back up sensitive data.
Fisher said that the Dvuln team believes DDLs could be more secure than physical cards, but that the NSW implementation fails to do what it claims - for now. " if the [DDL] was improved by implementing a more secure design … we would agree that [DDLs] would provide additional levels of security against fraud compared to the plastic drivers licence," Fisher wrote.
Whether other governments will take DDL security more seriously remains to be seen, though [17]examples of [18]state-designed software [19]doesn't often instill confidence. ®
Get our [20]Tech Resources
[1] https://www.nsw.gov.au/media-releases/nsw-digital-drivers-licence-rolled-out-statewide
[2] https://www.nsw.gov.au/media-releases/half-of-drivers-using-a-digital-driver-licence
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://youtu.be/k89Qub3BVxs
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/03/18/consent_app_idea_nsw/
[9] https://www.theregister.com/2020/08/24/sydney_ferries_too_tall/
[10] https://www.theregister.com/2022/05/06/facebook_australia_influence/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YpWS4syOWaikJLsG2uorzAAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2016/05/20/digital_driving_licence/
[13] https://www.rac.co.uk/drive/news/driving-law/digital-driving-licences-will-arrive-before-2024/
[14] https://www.theregister.com/2021/06/08/apple_2021_wwdc/
[15] https://www.washingtonpost.com/technology/2021/10/11/digital-drivers-license-mdl/
[16] https://www.nsw.gov.au/nsw-government/projects-and-initiatives/digital-trade-licence
[17] https://www.theregister.com/2019/11/14/home_office_brexit_app_hack_claims/
[18] https://www.theregister.com/2022/01/19/olympics_app_vulnerabilities_censorship/
[19] https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144
[20] https://whitepapers.theregister.com/
deevee
NSW government in denial again. Its not only police who use the license for identification...
Just another poor (agile) implementation rushed out to meet a deadline and get some pollie or bureaucrat a big bonus.
sanmigueelbeer
Service NSW, the government agency that runs the app of the same name, told The Register the flaws Noah found are not a threat to users or the integrity of the DDL.
Run, Noah. Run.
Service NSW will be contacting the NSW Police and charge you for "hacking".
I'll have your ID, then...
NapTime ForTruth
When stopped for a traffic violation or ID check - or random, heavily-armed citizenship test for you Americans - does "I'm sorry Constable, my phone battery is dead" get you through or get you jailed?
Same for airports? Alcohol? Cigarettes?
Can I use a screenshot of yours?
Diogenes
before pointing out that altering the DDL is against the law
Just like there are no murders, thefts, frauds, assaults, and people don't run red lights or speed because they are also against the law.
Why carry a licence at all then?
James Ashton
"Importantly, if the tampered license was scanned by police, the real time check used by NSW Police would show the correct personal information,"
So why do we need to carry a licence at all? If the police need to identify you then obviously they can pull up your details given your name and address. Commercial entities can't do that but, right now, nobody can trust the electronic licence without access to the government database.
Which brings to mind another limitation of electronic licences: physical licences are useful for identifying dead and unconscious people.
what lese would be expected ?
An authorisation of easily damaged, lost and mostly insecure devices which are difficult to migrate data to and from without using a data snoop service. Whats not to dislike ? Yes ElReg readers will use adb etc to backup but thats not Joe and Joelene User And yes, I use multiple phones for activity reasons. Fifteen year old ZTEs tradies phones were the only ones I could move details off and on freely. with a PC.for backups and contract transfers.