Chaos Computer Club breaks Apple TouchID


Recommended Posts

Chaos Computer Club breaks Apple TouchID

 

The biometrics hacking team of the Chaos Computer Club (CCC) has successfully bypassed the biometric security of Apple's TouchID using easy everyday means. A fingerprint of the phone user, photographed from a glass surface, was enough to create a fake finger that could unlock an iPhone 5s secured with TouchID. This demonstrates ? again ? that fingerprint biometrics is unsuitable as access control method and should be avoided.

 

Apple had released the new iPhone with a fingerprint sensor that was supposedly much more secure than previous fingerprint technology. A lot of bogus speculation about the marvels of the new technology and how hard to defeat it supposedly is had dominated the international technology press for days.

 

"In reality, Apple's sensor has just a higher resolution compared to the sensors so far. So we only needed to ramp up the resolution of our fake", said the hacker with the nickname Starbug, who performed the critical experiments that led to the successful circumvention of the fingerprint locking. "As we have said now for more than years, fingerprints should not be used to secure anything. You leave them everywhere, and it is far too easy to make fake fingers out of lifted prints." [1]

 

The iPhone TouchID defeat has been documented in a short video.

 

The method follows the steps outlined in this how-to with materials that can be found in almost every household: First, the fingerprint of the enroled user is photographed with 2400 dpi resolution. The resulting image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting. Finally, pink latex milk or white woodglue is smeared into the pattern created by the toner onto the transparent sheet. After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone. This process has been used with minor refinements and variations against the vast majority of fingerprint sensors on the market.

 

"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can't change and that you leave everywhere every day as a security token", said Frank Rieger, spokesperson of the CCC. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access." Fingerprint biometrics in passports has been introduced in many countries despite the fact that by this global roll-out no security gain can be shown.

 

iPhone users should avoid protecting sensitive data with their precious biometric fingerprint not only because it can be easily faked, as demonstrated by the CCC team. Also, you can easily be forced to unlock your phone against your will when being arrested. Forcing you to give up your (hopefully long) passcode is much harder under most jurisdictions than just casually swiping your phone over your handcuffed hands.

 

Many thanks go to the Heise Security team which provided the iPhone 5s for the hack quickly. More details on the hack will be reported there.

 

Source: CCC.de

Link to comment
Share on other sites

All security systems have their weaknesses. However, it requires a lot more effort to bypass a fingerprint scanner than it does to overlook somebody typing in their pincode / pattern. The best security method is of course to prevent other people from accessing your phone.

 

The fingerprint scanners on the iPhone and various Android devices offer a decent level of security for casual use and an improvement upon previous systems.

  • Like 2
Link to comment
Share on other sites

All security systems have their weaknesses. However, it requires a lot more effort to bypass a fingerprint scanner than it does to overlook somebody typing in their pincode / pattern. The best security method is of course to prevent other people from accessing your phone.

 

The fingerprint scanners on the iPhone and various Android devices offer a decent level of security for casual use and an improvement upon previous systems.

 

Keep telling yourself that, but at the end of the day, they're still selling you fairy wings and unicorn horns.

Link to comment
Share on other sites

But tbf

The chances that someone will be able to take a 1200 dpi photograph of your fingerprint without your knowledge, however, is slim.

come over to my place,i'll offer you a drink in a glass cup, then when you leave,ill just lift your prints,photograph them,then do the process to have a copy.

Link to comment
Share on other sites

Almost impossible to do in a real world situation, and if anyone would go to such lengths to get into your phone i would imagine it to be the least of your worries.

 

The article is flame bait.. while a lot of it might be true it's simply irrelevant to the average user.

Link to comment
Share on other sites

So is biometric security in general.

 

I bet you the simplicity of it and the way Apple implemented it will make a lot of people use it.  I wouldn't be surprised if other companies offered the same feature in their future phones. 

Link to comment
Share on other sites

come over to my place,i'll offer you a drink in a glass cup, then when you leave,ill just lift your prints,photograph them,then do the process to have a copy.

OK, now you're being just silly.  Security wise, there is an extremely low probability that you would obtain someone's phone AND obtain their fingerprint at the same point in time.  We're talking about a stranger obtaining your phone or thief; not your friends.

 

Even if you found/stoled the phone, managed to somehow track down the owner to get a fingerprint, enough time would have elapsed for the phone to have been reported stolen and is basically useless.

Link to comment
Share on other sites

Keep telling yourself that, but at the end of the day, they're still selling you fairy wings and unicorn horns.

They're selling a system that is more secure than other current methods. It won't prevent anyone dedicated to accessing your device but it will stop casual thieves, strangers and friends from accessing your device without permission. Anything that improves security should be welcomed, as long as people aren't complacent about its limitations.

Link to comment
Share on other sites

They're selling a system that is more secure than other current methods. It won't prevent anyone dedicated to accessing your device but it will stop casual thieves, strangers and friends from accessing your device without permission. Anything that improves security should be welcomed, as long as people aren't complacent about its limitations.

 

Rubbish.  A decent passcode is far more secure than a fingerprint ever will be.  It's just not quite as convenient.

Link to comment
Share on other sites

OK, now you're being just silly.  Security wise, there is an extremely low probability that you would obtain someone's phone AND obtain their fingerprint at the same point in time.  We're talking about a stranger obtaining your phone or thief; not your friends.

 

Even if you found/stoled the phone, managed to somehow track down the owner to get a fingerprint, enough time would have elapsed for the phone to have been reported stolen and is basically useless.

 

i dont disagree that its an extra hurdle to someone getting in your phone, but having physical access to the phone is the biggest hurdle,not the fingerprint,and not the passcode. actually,cloning the print might be even easier than getting the passcode in certain cases.

 

i was under the impression that the discussion is about the security of the fingerprint scanner,which apple is touting as more secure,which has been proven to be not secure at all,and can easily be broken. making your phone physically available to other parties is something totally different. unfortunately, no phone manufacturer has a feature that prevents stupidity.

Link to comment
Share on other sites

come over to my place,i'll offer you a drink in a glass cup, then when you leave,ill just lift your prints,photograph them,then do the process to have a copy.

 

But yet you still need physical access to my phone, which you will never have.

Link to comment
Share on other sites

Rubbish.  A decent passcode is far more secure than a fingerprint ever will be.  It's just not quite as convenient.

So it's harder to overlook somebody entering their passcode than it is to watch somebody leave a clean fingerprint (with the appropriate finger), take a 2400DPI photo of it, clean-up and invert the image, print it using thick toner onto a transparent material, apply latex milk and moisten after it has dried? If you can't see how ridiculous you're being then I have nothing else to say to you.

Link to comment
Share on other sites

You guys who seem to be under the impression that one single layer of security is somehow a good thing. That to me is the biggest joke here. The suggestion that this method should be avoided is by far ridiculous. If you're going to run with that theory, then you might as well not bother using wireless since someone could potentially drive by your house to tap into your "secured" WiFi.

 

Nothing is really secure; passwords, pins, pattern locks, and biometrics are simply a means of inconveniencing intruders, just like the locks on your doors and windows in your home.

Link to comment
Share on other sites

So it's harder to overlook somebody entering their passcode than it is to watch somebody leave a clean fingerprint (with the appropriate finger), take a 2400DPI photo of it, clean-up and invert the image, print it using thick toner onto a transparent material, apply latex milk and moisten after it has dried? If you can't see how ridiculous you're being then I have nothing else to say to you.

 

Dude, leave the hyperbole out; that waffle has nothing at all to do with my comment and you know it.

 

I said, and I quote: "A decent passcode is far more secure than a fingerprint ever will be.  It's just not quite as convenient."

 

For usage purposes, scanning a fingerprint might be slightly easier (if annoying after you've touched the damned sensor 3 or 4 times); but hacking... They might be able to lift a fingerprint from the screen given time (which they'll have if they've stolen it), but they aren't going to lift a passcode from it.

Link to comment
Share on other sites

i dont disagree, but adding a fingerprint scanner may in fact weaken the security of the device.

 

Not true. You need physical access and my fingerprint with the sensor. Without the sensor, you only need physical access (and time).

Link to comment
Share on other sites

But yet you still need physical access to my phone, which you will never have.

 

Which makes the difference between biometric and passcode security moot anyways.

 

I always thought having a passcode on a personal device was nonsense anyways.  You shouldn't really have anything that important behind just your 4-digit passcode and not another password anyways.  At that point, if your phone gets stolen, you go online and lock it down/reset it (you can do that with Windows Phone anyways, pretty sure you can do with the others).  Makes this whole discussion pointless.

Link to comment
Share on other sites

This topic is now closed to further replies.