[ISN] Virus-carrying IC chips may aid cyberterrorists

[InfoSec News]

http://www.yomiuri.co.jp/dy/features/science/20060418TDY03002.htm

Kyoichi Sasazawa
Yomiuri Shimbun Staff Writer
Apr. 18, 2006

Integrated circuit chips can carry computer viruses, a group of
researchers at Free University Amsterdam has discovered.

The chips, which can be found in a number of items, including some new
passports and Japan Railway Co.'s Suica train passes, send electronic
information, such as numbers and identification data, to a computer
system when passed over an IC reader.

The Dutch group announced their findings last month during a meeting
in Italy of the Institute of Electrical and Electronics Engineers.

For the experiment, the scientists employed a small chip embedded in a
card--about the same size as an IC card--that sent data of up to 1
kilobit, including instructions that could harm a computer, to a
computer system. The system became infected with the virus.

Though there are certain restrictions on which characters can be used
in an IC chip, there is enough leeway to stop a computer from working,
the researchers said.

One member of the group pointed out that this discovery could lead to
cyberterrorism on a world-wide scale, if someone were to forge an IC
passport and use it to infect airport computers.

The scientists warn that countermeasures, such as tightening
cryptographic security, should be put in place as soon as possible.

"I don't know what their conclusion was based on," one JR East
employee said, defending the popular Suica card.

IC passports, first advocated by the United States as they can carry
biometric information, such as fingerprints, are gradually being
introduced in Japan and other countries. Experts have warned, though,
that personal information stored on the chips could be pilfered.

"We've constructed the chips so they can't be altered," a Foreign
Ministry official said. "But we might need to develop a means to deal
with the problem if it becomes possible to manipulate the data stored
on the chips."

Tadao Saito, professor emeritus at Tokyo University, said: "The
infection route for computer viruses has changed from floppy disks to
the Internet. I wouldn't be surprised if we were to see another.  
Although the IC chips can't store much data, we still need to be
cautious."