Operations

1/31/2018
02:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Passwords: 4 Biometric Tokens and How They Can Be Beaten

Authentication security methods are getting better all the time, but they are still not infallible.

Passwords present many security concerns. Users still choose short and obvious passwords or use the same ones across all their accounts. Meanwhile, the organizations we trust to safeguard our data often suffer breaches and end up losing millions of customer credentials. All this results in an authentication standard we can't trust.

But don't fret yet! Passwords aren't the only possible factor for authentication. You can use many other factors to identify yourself, including digital certificates, hardware tokens, and biometrics. Right now, biometrics are in vogue, primarily because they're more convenient. Rather than having to remember a hundred different, long passwords, isn't it great to just push your finger against a sensor, or look at your computer or phone to log in? As you've probably noticed, this seems to be the future of authentication, with new examples like Microsoft's Hello and Apple's FaceID.

But do biometrics really solve all our authentication security problems?

I would say no. While biometrics are fairly accurate, they're not infallible. Over the years, hackers and researchers have beaten biometric solutions many times. Let's look at the top four biometric hacks from the past.

1. Gummy Bears Beat Up Fingerprint Readers
When you think biometrics, you probably think fingerprints. Fingerprint readers were one of the first forms of biometrics used in computing, and they're pretty ubiquitous today. However, they were also one of the first biometrics that researchers figured out how to defeat on the cheap.

In 2002, a researcher named Tsutomu Matsumoto shared how to defeat fingerprint readers with plain old gummy bears. Matsumoto pulled prints from a glass using the same techniques as law enforcement, and then used the prints to make a finger out of the gummy materials. With a little work, many of these crafty creations tricked the fingerprint sensors.

Of course, over time biometrics have become more advanced. Modern sensors read at higher resolutions or look for new factors such as heat or heartbeat. However, the techniques researchers use to defeat them have also evolved. In 2013, the Chaos Computer Club defeated the iPhone's TouchID reader shortly after its release. Even more recently, researchers hacked fingerprint readers with paper and glue.

While I love that fingerprint readers have made accessing our smartphones easier, we can't totally trust them yet.

2. Faking Out Iris Scanners
We've all seen fancy iris scanners in the movies, but these eye-based biometrics don't just exist in fiction.

Unfortunately, they're no more foolproof than fingerprint readers. In 2012, researchers shared how they could bypass iris readers with replica images of irises. The most interesting aspect of this research was how they replicated the fake irises based on the iris data stored in the biometric system's database. In the same way that password database leaks result in hacked passwords, an iris database breach could result in fooled eye scanners.

3. Paper Faces Fool Facial Scanners
The latest hot trend in biometrics is facial scanning. With features like Microsoft's Hello, you can unlock your computer or phone by looking at it. This sounds like a usability dream, but it's still trivial to beat.

Back in 2011, a blogger and researcher quickly learned that you could easily fool Android facial scanners with a still picture. You take a still picture of yourself, show it to the phone, and voila, you're in. To vendors' credit, they updated their facial scanner technology to perform "liveness" checks, looking for some sort of motion to make sure the face looking at the camera was a real person. Unfortunately, a Photoshopped blink could bypass that new check. Just by editing your eyes closed and then switching between two still photos, you could get past those early liveness checks. The good news is that facial recognition is still evolving.

4. 3-D Printers Crack 3-D Facial Scanners
In 2017, Apple released a new facial scanning feature called FaceID. On the surface, the user's experience is like any other facial reader. However, underneath the phone's glass is technology that should make facial recognition much more accurate and hard to beat. Essentially, the phone includes a sensor (TrueDepth) that sends out thousands of infrared beams of light, which accurately map your face. This allows the phone to store a kind of 3-D digital representation of your face, which it can recognize from many angles. Apple reinforces this feature with machine learning, which can recognize you even when you wear hats, glasses, or other accessories that might confuse classic facial scanners.

All this should make facial biometrics pretty bulletproof, and it does make it stronger. However, about a week after Apple released FaceID, a Vietnamese security group claimed to have cracked it. The hack required a 3-D printer, 2-D infrared images of eyes, stone powder, and lots of handcrafting to create a mask that could fool FaceID. To be fair, no other research group (to my knowledge) has independently verified this attack yet.

I suspect we might see updates that make it harder to fool, but so far both 2-D and 3-D facial scanning are not perfect.

It may seem I'm painting a bleak picture for the future of biometrics, but that's not true. Biometric vendors are learning from these mistakes and will add new features that make their systems more robust. Meanwhile, new biometrics options continue to emerge, such as heartbeat, typing cadence, and even brain waves.

History has shown us that motivated attackers can find a way to copy, steal, or bypass the factors they need. If we rely on biometrics alone, we'll likely suffer the same types of issues passwords have experienced. Only now, when a hacker replicates your fingerprint or face, you can no longer use it for authentication.

Biometrics will play an important role in the future of authentication. However, no authentication token is infallible. Rather than depending entirely on some new form of advanced biometrics, the safest course of action is to implement multifactor authentication — using more than one factor — for anything you want to secure.

Related Content:

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.