Interesting, but required a bit of Mission Impossible trickery to make it work.
The CCC started by photographing a fingerprint with 2400 dpi. Next the image was inverted and laser printed at 1200 dpi. To create the fingerprint mask Starbug finally used, latex milk was poured into the pattern, eventually lifted, breathed on (for moisture), and pushed onto the sensor to unlock the phone. In this sense, it’s hard to definitively state the hackers “broke” the TouchID precautions, because they did not circumvent the security measure without access to the fingerprint.
This does raise a fair question, though. How usable are the fingerprints we regularly leave on our phones? How susceptible is the iPhone 5s to this technique?
Yeah, we get it. You can get through the fingerprint sensor by obtaining the fingerprint. You can also get through the passcode lock by… obtaining the passcode.
Even disregarding the plausibility (or lack thereof) of this “Mission Impossible” scenario, if someone is willing to go through all that work to get inside your phone, you have much bigger things to worry about.
It would be easier to pick off someone’s password by looking over their shoulder. Biometrics and passwords are all susceptible if you try hard enough.
If your data matters to you then the safest thing to do is practice common sense personal security habits.
You’re not going to get a 2400 DPI scan of someone’s fingerprint without their cooperation or without liberating their finger from their person.
While this shows that you can copy someone’s fingerprint, it’s far from being something easy enough that a jaded boyfriend or girlfriend or your kids or even someone trying to steal your paypal money is going to be able to do.
Simply put, that’s a heck of a lot harder than watching someone enter their 4 digit code and then stealing their phone and you won’t get a pristine fingerprint from the phone. You are dragging and swiping and smudging your fingerprints all day on it.
See this discussion here where I propose additions to Touch ID to make it secure for enterprise.
http://www.theverge.com/2013/9/23/4762976/touch-id-security
My proposals include:
1) Configurable timeout for Touch ID (instead of hard-coded 48 hours to require a password)
2) Reducing Touch ID timeout to 30 or 60 minutes if a single unrecognized fingerprint is used (i.e.: thief checks if the phone is even locked)
3) Requiring a password if iPhone goes out of contact with “Find my iPhone” servers for more than 3 hours. So a password is required if the thief has managed to block radio signals from iPhone (Touch ID always requires password if powered down and rebooted). Same can be done if Airplane Mode is toggled on/off for those who must have Control Center on their lock screen.
4) Only allowing Touch ID to function without a password/passcode if the iPhone is within bluetooth range of your iWatch (which of course does not exist yet) — this would be a two-factor authentication.
5) Assuming an iWatch exists, then have the iWatch warn you if the iPhone moves away from you via iBeacon API. And let iWatch give you a quick access to erase the iPhone via “Find my iPhone” service (or put it in lost mode).
Not sure I would call this a hack. Your fingerprint is no more than a key to unlocking your phone. It only stands to reason that if you made a good copy of it that would work. Since it’s possible for someone to make a copy of your house key – with some subterfuge – it doesn’t mean there’s no use locking your house. I don’t see people thus questioning the effectiveness of a deadbolt lock. If it could be easily picked, then that the equivalent of hacking it, and therefore it’s usefulness would be in question. The true test will be if there are real world reports of people having their phones stolen and their fingerprints then copied and used. We’ll know soon enough.
Ask anyone in the police or investigation business. They’ll tell you it’s a rare occasion to get a usable fingerprint, not the rule.
Could be a lot of worried iPhone 5S buyers/intenders are suddenly feeling a lot more important than they were a few days ago. 😀
Apple rightly deserves to take some heat if their sub-epidermal scanning tech is vulnerable to this bypass method. That and an asterisk or two is probably in order for their “highly secure” Touch ID copy.
There’s multiple ways to mitigate the “flawed” scanner as long as it’s possible in HW/SW. Fans of two-factor authentication will probably get their wish, which is a good thing. And Touch ID will continue to get third-party-tested, which is also a good thing.
I expect Apple to do the usual “measure twice, cut once” in investigating/responding to this.
Would be if a chance of this happening to any of them be of any significance.
As it stands, sorry to break this to you 5S owners, you are just as unimportant as you were in pre-5S days 😀
Maybe that’s because they’re in a different business, with an entirely different set of clientele, who might want to go to great lengths to not leave usable fingerprints lying around?
Possibly, but they might also realize there is only so much one can do to make a phone totally safe, and still have a useable device.
Yeah, It wasn’t clear if their “sub-epidermal” scanning technique was just to test the presence of capacitance (i.e. a live finger) or a specific pattern in addition to the scanned surface pattern.
Still, the video raises a few questions.
1. Why wasn’t the fingerprint given to someone else to try.
2. Why didn’t the person demonstrate that his middle finger could NOT unlock the phone without the latex fingerprint. For all we know, he already registered his middle finger, and the scanner scanned through the latex and found his actual fingerprint.
This is not to say I don’t believe them. But I’m not 100% convinced and I’d like to see someone else do the same trick.
Your #2 is the crux. I actually DON’T believe them because of #2.
We also don’t know what was imprinted on the latex.
It’s awfully fishy if you ask me.
As with most semi/advanced fingerprint security systems, “sub-epidermal” scan refers merely to the device’s ability to detect live finger via heat/moisture detection, with Apple’s metal ring substituting for capacitance detector. Those are in no way used for authentication/identification.
It’s a hack. Unwarranted access to the device is a hack. Kind of the same as saying you hacked someone’s pin, if you didn’t just guess it but used tech to attain it.
I never use a case for my iPhone, but I would guess that having a leather case would make it harder to lift a print from the phone. When I looked at my iPhone 5, it did have some finger smudges on the back of the phone, but nothing that I could see on the screen.
I’m sure that this “hack” will get a lot of press attention, but it doesn’t seem like a big deal to me. If a thief does get ahold of my phone, I would hope that I could remote wipe it before they would have time to go through all this anyway.
Next, is it possible to draw your own fingerprint in Photoshop or Illustator and use this technique to create your own, custom fingerprint. Probably any patern with lines will work, like a Spirograph.
If someone acquired the copy of your house key, or better yet a phone passcode, and then used that to break in, you wouldn’t call that “hacking” would you? Hacking usually refers to gaining unauthorized access to something via recoding or reprogramming (e.g. software means). This is more of a break in.
Using subterfuge to learn someone’s pin is different than hacking into a system and stealing their pin, or bypassing the pin security altogether. Making a copy of someone’s fingerprint isn’t hacking the system at all.
Not everyone who commits a crime is a “professional” criminal, with ninja-like stealth tactics, regardless of what Hollywood would have you believe.
Real life police investigations are much more tedious, with less sherlock eureka moments and much more groping in the dark, unlike what they love to show on CSI.
Exactly.
Go through your day paying attention to everything you touch; you’ll leave fewer prints than you’d imagine, and most of them will be horrible or almost immediately obliterated.
Short of intentionally trying to leave a perfect print behind, you’ll be hard-pressed to find a single whole, clear print at the end of the day. (And even if you try, it’s trickier than entertainment media would have you believe.)
Nevertheless, I would love to see the Touch ID Sensor build into MacBooks (combination of power button and fingerprint).
You don’t leave your pin passcode on everything you touch, this shouldn’t make everyone wear gloves all the time but this is still disconcerting.
“You don’t leave your pin passcode on everything you touch..”
Nor does one leave a pristine 2400dpi fingerprint scan on everything one touches.
By sheer number of odds you could get a “pristine 2400dpi fingerprint” if you really wanted to. You don’t leave pin codes on a toilet handle, glass cups, keyboard, and on the actual phone its self.
Whenever you have to use tech to circumvent a system, it’s a hack.
^ my opinion
It isn’t just as simple as making a copy with two-sided tape. There is some tech work involved.
So then, if I stole the key to your house and used the technology available to create a copy of the key, is that a hack?
Clarity: computer. A key doesn’t need anything sophisticated other than a kiosk machine at Wal-mart.
They didn’t “circumvent the system” by electronic means, which is what a hack is. They merely made a physical silicon imitation mold of previously “acquired” fingerprint – akin to making a door key copy.
Ask yourself the following:
If someone “acquires” your passcode pin by looking over your shoulder and then uses it to unlock your device, would you consider that a hack?
If someone holds you at gun point and forces you to unlock the device by putting your finger on the scanner, would you consider that a hack?
If your answer is “yes” to both of the above, then we have a different notion of what a “hack” is, and we’ll just have to agree to disagree. If your answer is “no” to one of them, then some serious contradiction is going on with your own definition of the term.
It’s borderline, I agree.
Definition I use:
“use a computer to gain unauthorized access to data in a system.”
I would be more impressed if someone not the owned, after showing that he/she could not access the phone lifted a print created by handling the device, and showed us in real time using common household items that this can be successfully done within the 48 hour period.
For all we know this worked because the edge pattern on the owners finger was just enough like his index to read as a match.
I’ve been staying out of this argument, but that’s a pretty weak definition. 🙂 By that definition, a key duplicated by a digital key cutter that protects a filing cabinet would also be a hack.
I don’t write the definitions. lol. Peep Webster if you don’t like Google’s definition: http://www.merriam-webster.com/dictionary/hack.
If I take a photograph of your house key and use a 3D printer to recreate the key and then use that key to gain entry to your house, is that a hack?
Not sure a 3D printer is considered a computer system.
Not really. This isn’t TV. Getting a good fingerprint is very rare. And this also assumes someone is targeting you. They aren’t.
But a computer drives the printer and the printer has a logic board etc. Also, lets assume the key turns a lock on a panel which shuts down your home security. Hacking yet?
Theoretically do you have a better chance of guessing a pincode out of 10,000 possibilities or finding a finger print of one the thousands of things we touch daily. They both are insecure for their reasons but on the surface it seems like a finger print is easier to obtain.
All this goes out the window if you rob someone for their phone, then you clearly don’t have their fingerprint, but if you really wanted to break into your neighbor’s house and steal their iPhone 5s you “theoretically’ could bypass the finger sensor if you wanted to.
Getting a good enough fingerprint and having the skills to make one? Pretty rare.
https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/
Looking over a guy’s shoulder as he types his passcode? Much easier.
And if you are breaking into the house, the guy has bigger problems than his phone.
Can’t wait for all this to blow over. Played with a display iPhone 5S yesterday, and Touch ID demo app was great. Fast, convenient, and fun to use.
Remember “Face Unlock” for Android phones? Could be tricked with a photograph or something. And probably a pain to use. Presence check: blink now. “Didn’t catch your blink- enter passcode”.
You’re stretching it way too hard to try to fit the definition.
I’m not stretching anything. I think this is a perfectly valid comparison.