Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

9/23/2013
12:18 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Apple iPhone 5s Fooled By Fake Finger

Chaos Computer Club hackers bypass the fingerprint sensor in Apple's iPhone 5s, may qualify for Touch ID hack bounty.

Apple iOS 7: Visual Tour
Apple iOS 7: Visual Tour
(click image for larger view)
Hackers from the Chaos Computer Club have shown that the fingerprint scanner in Apple's iPhone 5s can be fooled by an artificial fingerprint made using readily available materials.

The group has posted a video on YouTube that demonstrates the effectiveness of their technique.

In a statement on the group's website, CCC spokesman Frank Rieger warns that fingerprint biometric technology is insecure and unwise as a means of authentication. "It is plain stupid to use something that you can't change and that you leave everywhere every day as a security token," he said. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access."

[ If Tim Cook says it, does that make it true? Read Apple CEO Cook: We Don't Do Junk. ]

Apple did not respond to a request for comment. Last week, in an apparent attempt to address privacy and security concerns, an Apple spokesman told the Wall Street Journal that the Touch ID system does not store fingerprint images.

Fingerprint scanning systems have a long history of vulnerability to hacking. Working with a German TV show in 2007, the CCC demonstrated that fingerprint authentication technology used by a German supermarket could be duped. The group says that what differentiates Apple's technology from other fingerprint scanners is a higher resolution sensor.

Bypassing Touch ID involves photographing a fingerprint at 2400 dpi resolution, cleaning the image up and then laser printing it at 1200 dpi on a transparent sheet using a heavy toner setting. To the resulting relief pattern, either wood glue or pink latex milk is applied, which hardens to form the surface of the fake fingerprint. The hardened substance is then lifted from the transparent sheet, breathed on for moisture and applied to the iPhone Touch ID scanner to unlock the device.

The CCC posted instructions about how to create a fake fingerprint back in 2004. In the past decade, the risks of fingerprint spoofing have been widely covered in academic research. In 2006, researchers from Washington & Jefferson College reported, "biometric fingerprint scanners can easily be spoofed with Play-doh, gummy bears and other household materials." In 2002, Yokohama National University researchers reported, "artificial fingers that are easily made of cheap and readily available gelatin were accepted by extremely high rates by particular fingerprint devices with optical or capacitive sensors."

Evidently, this is still the case with Apple's technology, though the security community has yet to evaluate the hack. Last week, security researchers Robert Graham and Nick DePedrillo established a crowdsourced bounty program, through the website IsTouchIDHackedYet.com, to reward the first person or group to break Apple's Touch ID system. As of Sunday evening, the website indicated that the CCC's hack may qualify for the bounty, the amount of which remains in question due to conditions placed on a pledge of $10,000 committed by venture capitalist Arturas Rosenbacher.

Learn more about smartphone security and related topics by attending the Interop conference track on Mobility in New York from Sept. 30 to Oct. 4.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
framework4
50%
50%
framework4,
User Rank: Apprentice
9/24/2013 | 10:34:10 AM
re: Apple iPhone 5s Fooled By Fake Finger
Clearly these folks do not understand. The goal is to have usable security that will stop someone accessing the phone if it is lost or stolen by a random thief. I currently use a 4 digit code, my anniversary, easily defeated. For me fingerprints will be a huge step up. It is like those folks who expose "The Club" by showing how easy it is to defeat by cutting the steering wheel. So what? I still use "The Club" on my car because the average thief is not wandering around with a hacksaw. Likewise the average thief is NOT going to have a copy of my fingerprint.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
9/24/2013 | 4:03:01 AM
re: Apple iPhone 5s Fooled By Fake Finger
Forcing someone's hand, so to speak, is a legitimate concern for those who believe they should not have to divulge passwords on demand to authorities.
feskridge
50%
50%
feskridge,
User Rank: Apprentice
9/23/2013 | 9:47:17 PM
re: Apple iPhone 5s Fooled By Fake Finger
According to the movies, another way to spoof fingerprint security is to find an authorized person, kill them, cut off their finger, and then use that. This technique also works with eye scanners. You just need to remove the head and hold it up to the scanner. This stuff is really so simple!
dtkerns
50%
50%
dtkerns,
User Rank: Apprentice
9/23/2013 | 4:49:37 PM
re: Apple iPhone 5s Fooled By Fake Finger
They are absolutely right, what we need is an RFID chip implanted in our right-hand or forehead.
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21273
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key va...
CVE-2021-21274
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to...
CVE-2021-23345
PUBLISHED: 2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
CVE-2021-21297
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default beh...
CVE-2021-21298
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via th...