Vietnamese security firm says They've Broken Face ID a Week After iPhone X Release

[matrix07012]

Vietnamese security firm says They've Broken Face ID a Week After iPhone X Release

Quote

On Friday, Vietnamese security firm Bkav released a blog post and video showing that—by all appearances—they'd cracked Face ID with a composite mask of 3-D-printed plastic, silicone, makeup, and simple paper cutouts, which in combination tricked an iPhone X into unlocking. That demonstration, which has yet to be confirmed publicly by other security researchers, could poke a hole in the expensive security of the iPhone X, particularly given that the researchers say their mask cost just $150 to make.

 

They have a Q&A on their website, but it answers nothing.

Quote

Q: How did Bkav develop the mask (for example why you use silicone for the nose, why 3D printing for some areas while special processing for others, etc.)?

A: You are right. Many people in the world have tried different kinds of masks but all failed. It is because we understand how AI of Face ID works and how to bypass it. As stated above, we were the first in the world to show that face recognition was not an effective security measure for laptops.

Personally, I'm a bit skeptical and would like to see this verified, but considering Face ID was already fooled by two brothers, this might be real.

 

Sauce: https://www.wired.com/story/hackers-say-broke-face-id-security/

Sauce 2: http://www.bkav.com/d/top-news/-/view_content/content/103968/face-id-beaten-by-mask-not-an-effective-security-measure

[Sauron]

I suppose it's better than touchID, where they could scrape your fingerprint right off of the device itself. I assume this requires some sort of scan of the owner's face, which is not necessarily easy to obtain.

[Damascus]

Another firm broke the device security on one of the major android phones (pixel 2, I think) so I’m not surprised 

[dizmo]

Did they do it knowing the different points of the persons face? If so, I feel that this is a little out there. Not good, but still not terrible. If you let someone measure your face, you kind of have it coming...

[PCGuy_5960]

IMO, Apple should stick to something that just works, like Touch ID. (In addition to Face ID)

[Guest]

12 minutes ago, matrix07012 said:

Personally, I'm a bit skeptical and would like to see this verified, but considering Face ID was already fooled by two brothers, this might be real.

Ars Technica (and me) would agree  https://arstechnica.com/information-technology/2017/11/hackers-say-they-broke-apples-face-id-heres-why-were-not-convinced/

Edit: To clarify, I'm agreeing with being skeptical and not this being real

Edited November 13, 2017 by Guest
Clarification

[BuckGup]

9 minutes ago, PCGuy_5960 said:

IMO, Apple should stick to something that just works, like Touch ID. (In addition to Face ID)

Nah otherwise new tech wouldn’t be pushed. Watch all new flagships of 2018 will have facial recognition for security 

[laminutederire]

14 minutes ago, dizmo said:

Did they do it knowing the different points of the persons face? If so, I feel that this is a little out there. Not good, but still not terrible. If you let someone measure your face, you kind of have it coming...

The points can be scanned rather easily. With something like less than 100 lines of code, 20 pictures taken appropriately, a bit of preprocessing and a few hours on a good cpu, and you get a freakingly good mesh of any objects including faces

[dizmo]

4 minutes ago, laminutederire said:

The points can be scanned rather easily. With something like less than 100 lines of code, 20 pictures taken appropriately, a bit of preprocessing and a few hours on a good cpu, and you get a freakingly good mesh of any objects including faces

Exactly. That's a lot of work. It's just as easy to fool a fingerprint reader, and yet we're not that worried about that.

I don't think this is a huge issue. So, say someone does that. They have to steal your phone. If your phone goes missing, you should cancel anything that's vital (credit card, for example) anyway. Have sensitive stuff on your phone? Turn on the PIN as well. Solved.

[Lathlaer]

26 minutes ago, dizmo said:

Did they do it knowing the different points of the persons face? If so, I feel that this is a little out there. Not good, but still not terrible. If you let someone measure your face, you kind of have it coming...

 

7 minutes ago, laminutederire said:

The points can be scanned rather easily. With something like less than 100 lines of code, 20 pictures taken appropriately, a bit of preprocessing and a few hours on a good cpu, and you get a freakingly good mesh of any objects including faces

The answer from the article:

 

Quote

The researchers concede, however, that their technique would require a detailed measurement or digital scan of a face of the target iPhone's owner. The researchers say they used a handheld scanner that required about five minutes of manually scanning their test subject's face. That puts their spoofing method in the realm of highly targeted espionage, rather than the sort of run-of-the-mill hacking most iPhone X owners might face. ¹

 

They did say it's more of a method of targeting high priority people like billionaires or CEO's but they also claim that with future upgrades it could be done with a quick smartphone scan of the face.

[Guest]

Some good points I saw from commenters on other sites are:

• Are some settings turned on/off ("Require attention for face ID")
• Why are they not transparent on their process?
• Was this used against an initial face scan or allowed the network some time to map?

I don't doubt its possibly to create something that fools it (Whether its practical or not) but this group (Which spells itself differently through out their own site) succeeding as this seems to be more on the side of attention seeking/non-transparency (And their questionable responses in interviews) than that of a "leading security firm".

[laminutederire]

7 minutes ago, dizmo said:

Exactly. That's a lot of work. It's just as easy to fool a fingerprint reader, and yet we're not that worried about that.

I don't think this is a huge issue. So, say someone does that. They have to steal your phone. If your phone goes missing, you should cancel anything that's vital (credit card, for example) anyway. Have sensitive stuff on your phone? Turn on the PIN as well. Solved.

Yeah it's around the same amount of work to get to both. Those are mostly there to force people who will steal your phone to format it, and to keep away your friends and family away if needed

Fingerprint is easier if someone has access to you, but face id can be fooled even if someone isn't holding you hostage or something. Having pictures of you is enough. So it's better for the cia/fbi/nsa since they can open terrorists' phone easier or whatever.

[Blade of Grass]

5 minutes ago, gabrielcarvfer said:

The fingerprint reader requires contact with the finger, and you can use multiple techniques to guarantee that it is a real finger, of a living person, and it matches the owner fingerprint. I wouldn't say that they're just as easy to fool as face scan, that relies solely in pattern/depth scanning.

Except researches have been able to defeat the fingerprint readers on all the smartphones which have them?

 

 

Regardless, this article sums up the discussion nicely. 

https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/

 

 

[laminutederire]

16 minutes ago, Lathlaer said:

 

The answer from the article:

 

 

They did say it's more of a method of targeting high priority people like billionaires or CEO's but they also claim that with future upgrades it could be done with a quick smartphone scan of the face.

There are a lot of techniques nowadays to capture really high fidelity meshes of faces, at a fidelity which isn' needed at all to fool face id.

That's with some maths and a regular camera and some precise measure made on other people to build the prior model.

[dizmo]

20 minutes ago, Lathlaer said:

 

The answer from the article:

 

 

They did say it's more of a method of targeting high priority people like billionaires or CEO's but they also claim that with future upgrades it could be done with a quick smartphone scan of the face.

I wonder what a scan requires though. If you're a higher up, you should be more sensitive with such things, and honestly, have your device more secure than one level of security.

7 minutes ago, laminutederire said:

Yeah it's around the same amount of work to get to both. Those are mostly there to force people who will steal your phone to format it, and to keep away your friends and family away if needed

Fingerprint is easier if someone has access to you, but face id can be fooled even if someone isn't holding you hostage or something. Having pictures of you is enough. So it's better for the cia/fbi/nsa since they can open terrorists' phone easier or whatever.

It'd be interesting to know how many pictures are needed, from what angles, and what quality. Naturally I understand why they don't want to release such information, but still.

7 minutes ago, gabrielcarvfer said:

The fingerprint reader requires contact with the finger, and you can use multiple techniques to guarantee that it is a real finger, of a living person, and it matches the owner fingerprint. I wouldn't say that they're just as easy to fool as face scan, that relies solely in pattern/depth scanning.

With what? If you made a silicone mold of the fingerprint you could just put it on your finger and against the reader, no?

Or a copy, paste it over your finger. I'm assuming the method of "living person" is simply a temperature sensor.

[Belgarathian]

I'm not overly surprised, but that said... That looks like way more effort than lifting a finger print or fooling Touch ID with Play-Doh. 

 

http://www.dailymail.co.uk/sciencetech/article-3471718/Can-iPhone-s-fingerprint-sensor-hacked-using-PLAY-DOH-Researchers-claim-toy-bypass-Apple-s-security.html

[laminutederire]

1 minute ago, dizmo said:

 

Well I implemented the dumbest method possible to compute the visual hull of a statue from 17 pictures. With a not at all efficient way to do it, it amounts to basically 15 min of coding, 2 hours of compute on my 6600k and I have a somewhat high res model of it. Like on the video from my other post , with a webcam and prior knowledge acquired with scan of other people's faces, you can do it in real time

[DocSwag]

Just wanted to point out... yes you can do this. With a mask, probably after taking multiple scans of a face.

 

With a fingerprint you could just scan the fingerprint and probably create a fake fingerprint. I would imagine it's much easier to fool touchID than faceID.

[suicidalfranco]

but apple said holywood mask artists couldn't fool it. iCall BS on this, obviously just a knock-off iPhone, doesn't even have a wallpaper, couldn't make it more fake than this 

[Bensemus]

They scanned the target face for 5 minutes so not super easy to do. 

 

They claim they didn’t train the phone on the mask or weaken it by training it on a partly obscured face but that hasn’t been verified. They also seem to have turned off the setting that makes sure the person is looking at the phone so their 2D static eyes would work. 

[Bananasplit_00]

1 hour ago, BuckGup said:

Watch all new flagships of 2018 will have facial recognition for security 

can we just not please?

[Drak3]

1 hour ago, BuckGup said:

Nah otherwise new tech wouldn’t be pushed. Watch all new flagships of 2018 will have facial recognition for security 

All flagships in 2017 have facial recognition. Apple was the last to the face recognition party.

[captain_to_fire]

It’s also possible that the Vietnamese hackers initially enrolled the mask to Face ID and not a face of a real person. The only way to prove this is if it’s reproduced by others.  

[rawrdaysgoby]

25 minutes ago, hey_yo_ said:

It’s also possible that the Vietnamese hackers initially enrolled the mask to Face ID and not a face of a real person. The only way to prove this is if it’s reproduced by others.  

ughhh he did it to the mask first then to himself.... soo..... yea....

 

it is much harder to make a facial mask then a thumb print I guess

[dizmo]

7 minutes ago, gabrielcarvfer said:

 

Silicone fingers only work for basic fingerprint sensors. The living person stuff is based on blood flow, how the finger moves or the skin stretches, plus temperature, others use infrared images plus fingers capacitance, and the list goes on depending on the implementation.

Are any of these implemented in phones?