Operations

1/31/2018
02:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Passwords: 4 Biometric Tokens and How They Can Be Beaten

Authentication security methods are getting better all the time, but they are still not infallible.

Passwords present many security concerns. Users still choose short and obvious passwords or use the same ones across all their accounts. Meanwhile, the organizations we trust to safeguard our data often suffer breaches and end up losing millions of customer credentials. All this results in an authentication standard we can't trust.

But don't fret yet! Passwords aren't the only possible factor for authentication. You can use many other factors to identify yourself, including digital certificates, hardware tokens, and biometrics. Right now, biometrics are in vogue, primarily because they're more convenient. Rather than having to remember a hundred different, long passwords, isn't it great to just push your finger against a sensor, or look at your computer or phone to log in? As you've probably noticed, this seems to be the future of authentication, with new examples like Microsoft's Hello and Apple's FaceID.

But do biometrics really solve all our authentication security problems?

I would say no. While biometrics are fairly accurate, they're not infallible. Over the years, hackers and researchers have beaten biometric solutions many times. Let's look at the top four biometric hacks from the past.

1. Gummy Bears Beat Up Fingerprint Readers
When you think biometrics, you probably think fingerprints. Fingerprint readers were one of the first forms of biometrics used in computing, and they're pretty ubiquitous today. However, they were also one of the first biometrics that researchers figured out how to defeat on the cheap.

In 2002, a researcher named Tsutomu Matsumoto shared how to defeat fingerprint readers with plain old gummy bears. Matsumoto pulled prints from a glass using the same techniques as law enforcement, and then used the prints to make a finger out of the gummy materials. With a little work, many of these crafty creations tricked the fingerprint sensors.

Of course, over time biometrics have become more advanced. Modern sensors read at higher resolutions or look for new factors such as heat or heartbeat. However, the techniques researchers use to defeat them have also evolved. In 2013, the Chaos Computer Club defeated the iPhone's TouchID reader shortly after its release. Even more recently, researchers hacked fingerprint readers with paper and glue.

While I love that fingerprint readers have made accessing our smartphones easier, we can't totally trust them yet.

2. Faking Out Iris Scanners
We've all seen fancy iris scanners in the movies, but these eye-based biometrics don't just exist in fiction.

Unfortunately, they're no more foolproof than fingerprint readers. In 2012, researchers shared how they could bypass iris readers with replica images of irises. The most interesting aspect of this research was how they replicated the fake irises based on the iris data stored in the biometric system's database. In the same way that password database leaks result in hacked passwords, an iris database breach could result in fooled eye scanners.

3. Paper Faces Fool Facial Scanners
The latest hot trend in biometrics is facial scanning. With features like Microsoft's Hello, you can unlock your computer or phone by looking at it. This sounds like a usability dream, but it's still trivial to beat.

Back in 2011, a blogger and researcher quickly learned that you could easily fool Android facial scanners with a still picture. You take a still picture of yourself, show it to the phone, and voila, you're in. To vendors' credit, they updated their facial scanner technology to perform "liveness" checks, looking for some sort of motion to make sure the face looking at the camera was a real person. Unfortunately, a Photoshopped blink could bypass that new check. Just by editing your eyes closed and then switching between two still photos, you could get past those early liveness checks. The good news is that facial recognition is still evolving.

4. 3-D Printers Crack 3-D Facial Scanners
In 2017, Apple released a new facial scanning feature called FaceID. On the surface, the user's experience is like any other facial reader. However, underneath the phone's glass is technology that should make facial recognition much more accurate and hard to beat. Essentially, the phone includes a sensor (TrueDepth) that sends out thousands of infrared beams of light, which accurately map your face. This allows the phone to store a kind of 3-D digital representation of your face, which it can recognize from many angles. Apple reinforces this feature with machine learning, which can recognize you even when you wear hats, glasses, or other accessories that might confuse classic facial scanners.

All this should make facial biometrics pretty bulletproof, and it does make it stronger. However, about a week after Apple released FaceID, a Vietnamese security group claimed to have cracked it. The hack required a 3-D printer, 2-D infrared images of eyes, stone powder, and lots of handcrafting to create a mask that could fool FaceID. To be fair, no other research group (to my knowledge) has independently verified this attack yet.

I suspect we might see updates that make it harder to fool, but so far both 2-D and 3-D facial scanning are not perfect.

It may seem I'm painting a bleak picture for the future of biometrics, but that's not true. Biometric vendors are learning from these mistakes and will add new features that make their systems more robust. Meanwhile, new biometrics options continue to emerge, such as heartbeat, typing cadence, and even brain waves.

History has shown us that motivated attackers can find a way to copy, steal, or bypass the factors they need. If we rely on biometrics alone, we'll likely suffer the same types of issues passwords have experienced. Only now, when a hacker replicates your fingerprint or face, you can no longer use it for authentication.

Biometrics will play an important role in the future of authentication. However, no authentication token is infallible. Rather than depending entirely on some new form of advanced biometrics, the safest course of action is to implement multifactor authentication — using more than one factor — for anything you want to secure.

Related Content:

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
13 Russians Indicted for Massive Operation to Sway US Election
Kelly Sheridan, Associate Editor, Dark Reading,  2/16/2018
From DevOps to DevSecOps: Structuring Communication for Better Security
Robert Hawk, Privacy & Security Lead at xMatters,  2/15/2018
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.