Well, that didn't take long!
Well, that lasted a long time: the Chaos Computer Club has already broken Apple's TouchID fingerprint lock, and warns owners against using biometric ID to protect their data. As the group explains here, it seems that the main advance in Cupertino's biometrics was that it uses a high resolution fingerprint scan. The post states …
They confirmed that a well-known way to fool fingerprint scanners fools a particular brand of fingerprint scanner — I don't think anybody was seriously expecting it to take that long.
I guess the best advice is: if you can't be bothered with a password then the fingerprint scanner is better than nothing.
"I guess the best advice is: if you can't be bothered with a password then the fingerprint scanner is better than nothing."
If you can't be bothered with a password, you deserve to lose everything you had on your phone.. Nobody would leave their car unlocked on the street with the ignition key on, yet having a smartphone without password protection is the equivalent of doing just that. Of course, there are things that are worse than no protection at all, like 4-digit PINs and easily-hackable fingerprint scanners.
I'm surprised they didn't go for the Gummi Bear route, though...
Nobody would leave their car unlocked on the street with the ignition key on ....
Nobody you knew before .. then again .. there's me .. i left my keys in the ignition doors unlocked , at my house in the front door lock , the car's trunk ... the keys stay there until morning when i chase them .. so yes there's people distracted enough to do those things
Never assume there ain't a moron that's highly capable of doing the unthinkable :)
Nobody would leave their car unlocked on the street with the ignition key on
Clearly you're not from around here. At least once a week I walk by an unoccupied car with the doors unlocked and the engine running. It's not something I would do, for safety reasons (anyone dumb enough to steal my car is sure to punish himself inadvertently soon enough - to say nothing of the punishment that is driving my car), but clearly many of the drivers in these parts are more sanguine about it.
"Nobody would leave their car unlocked on the street with the ignition key on," A sight frequently seen in Crete even with engine running (and with the hazard lights on, parked in the middle of the road)!
Comment from a Cretan taxi driver when asked why we never saw any police "We don't need police here; we are good people!"
But one assumes the Apple Marketing Department overlooked this inconvenient, yet fairly obvious, little detail. Fingerprint, among possible biometrics, has the advantage of being quite easy to obtain and the disadvantage of being also quite easy to forge. I suspect that some others, like iris or retina scans, are a bit better but also possible to forge. For all its defects, a reasonably constrained password probably is about as good in practice.
Can't these stupid users get anything right?
Agreed. Biometrics are like passwords: you should always use a secret part of your body, and use a different part for each security domain. If you use one of your well-known fingers with a fingerprint reader it's your own damn fault.
"A fingerprint might be on the phone, but how is the thief going to know which is theirs and which is yours?
It sounds like a lot of bother for a thief."
Sounds like you will accept any of sh*te to protect the image of you iFool'd ya!
Pathetic excuse. Apple got it wrong, they tried to redo an existing technology (as they always do, copy) and failed miserably.
The fact is that NO security system is entirely secure. When designing a system, you can only hope to make it unfeasible for a person to access that system. Every system (from the smallest mobile phone to the largest, most powerful military supercomputer) has at least one flaw that can be exploited to break in.
This flaw would require that the thief has access to a 2400dpi scanner, good enough photoshop skills to clean up the image, time to clean up that image and access to the fingerprint itself. This last may well be the most difficult to obtain. Not if you mug the person (after all if you've grabbed the phone, they'll probably grab for it, you can scan the fingerprints then), but if you steal the phone from a bag, pocket or table. Even assuming you can work out which person it belongs to, it would be difficult to get access to their fingerprints without them noticing you.
Now, please tell me: Do you think it would be worth the average thief going through all that just to get access to the users phone numbers, pictures and whatever apps/media they have? Access to bank accounts might make it worth their while, but in my experience, most mobile banking apps don't store user details on the device.
Bullshit, this is a quicker way to unlock your phone that can't be shoulder surfed. That's all, and we always knew that if you have a copy of the fingerprint you could get in.
If you lose your phone - no access.
If your phone is pick pocketed - no access.
Casual fraping at work - no access.
This is the purpose of the fingerprint scanner, not to defeat MI fucking 6.
I'm disappointed, mainly because I was wrong to assume any sanity in the FP reader selection process.
There are various types of FP readers. This problem is a classic, very basic one for the cheaper end of the range of readers you can get - the more expensive arrays use radio technology (basically you grounding a transmitting aerial with a ridge) to stop the use of such tricks. Given that this deficiency is not exactly a secret I find it disappointing Apple decided to choose that anyway instead of the better approach, especially because there is another problem with this cheap sensor:
This sensor cannot tell if finger and owner have parted ways.
@poopypants - "On the other hand, your iPhone is most likely covered with your fingerprints, so the probability of a successful break in is high."
In fact, since the phone is carrying your prints, a thief with a decent scanner and a sheet of latex would probably find it easier to break into this biometric lock than to crack a password or pass-pattern.
It's like writing your password on an adhesive label, and sticking it to the back of your phone.
I wear non-latex gloves when in public for hygiene reasons (surely you know places like the tube are covered in germs?).. But I am not a thief...
Although I expect thieves would wear gloves if they plan on stealing iPhones or anything else for that matter, thieves know finger prints are the easiest bit of evidence to link them to a crime...
"I wear non-latex gloves when in public for hygiene reasons (surely you know places like the tube are covered in germs?).. But I am not a thief..."
Uh, news flash, everything everywhere is covered in germs, and it's good for your immune system to get exposure to them.
I knew it would be hacked eventually, but only practical by commercial/government clients against high-value targets.
I can't believe it happened this soon and this easily.
Will wait out the next few days for official confirmation. If so, they have bricked a major Apple next-big-thing system almost as soon as it's released, which has never happened in history.
Why are the Apple-haters getting on this so quickly? To be honest, I'd want to use Touch-ID WITH a pass-code. That way, you stump hackers and thieves with 2-factor authentication. I don't think that's possible yet, but I can see that happening in an update.
For the consumer = result!
By the way, this was never going to be a military grade fingerprint scanner. Not even for millions of units sold and for all the money Apple has. It's the execution of the fingerprint tech where most other companies have failed to make it quick and easy to use. Convenience will win over security sometimes in consumer devices; that's life. Even for luxury brands.
I did read that 50% of iPhone users don't even lock their phone. If this encourages it, then all for the better for offering a basic protection mechanism that's simple to use.
And the media claiming this is a hack (being claimed on other sites)... hardly. Let's see them hack the firmware/software to get the fingerprint data first and then reproduce the fingerprint from that data.
Like some of the other comments, it's been done before, and has long since proved to be rather insecure. Besides, the Mythbusters team demonstrated this same fingerprint duplication technique in 2006. Not only that, it's been shown elsewhere, that a good (albeit short and very useable) regular password, offers more combinations than biometric fingerprints anyway.
Like I've said before, it's just not funny anymore...
Scamming biometric ID was practically institutionalized in Brazil and they got caught just this year. If people can cheat a piece of installed hardware at the hospital, where you, presumably, can't fiddle around with it for hours, doing it to a device in you tote around in your pocket should come as no surprise. Especially after all the hubbub in the media about how advanced it was.
I don't see how this is different to some devices that uses a image of your face to allow you into the system.
I think I would like to see a hack where they copied the fingerprint from any place other then the users finger itself to unlock the device. However, I fail to see why this is news worthy. This has been done in the way past
and will be done in future.
But we also have to think about the usecase, this is not to open a bank or your safe. THis is to unlock a phone! If you have more secure stuff on this, simply use the complicated passcode lock, the one that asks more then 4 digits and you are good, well better at least!
You really think a thief is going to cut off a finger? Given a choice between cutting off someone's finger and just holding the knife in front of them and saying "unlock your phone for me or I'll stab you" I think most thieves will choose the latter since it would be a much shorter sentence if you're caught.
"You really think a thief is going to cut off a finger? Given a choice between cutting off someone's finger and just holding the knife in front of them and saying "unlock your phone for me or I'll stab you" I think most thieves will choose the latter since it would be a much shorter sentence if you're caught."
The chinese are selling body parts to join the folly. We don't like in fairies and unicorns land! Just wait till you hear it on the news!
"Isn't the video just showing the reader's ability to see through the latex (or glue, or whatever it is) copy of the finger print into the real one? If they used a second person with the latex, that would be fair play."
No, not really. If the video was supposed to be a good demonstrator, the guy should have placed his middle finger on the sensor several times to indicate a negative; then apply the fake print and show that it is indicated positively. Not sure why anyone would miss such an obvious test. As it is, I wouldn't be at all surprised if a thin film applied to an already-registered finger was recognised.
The idea that a modern phone is a perfect fingerprint retrieval surface seems to make sense, but is it really? Maybe when your phone is new and clean, but what about after you've been touching it dozens of times a day? Won't the prints all be overlapping and smudged?
While I do agree... I don't know about you, but I tend to wipe my screen off rather frequently to keep it from being all smudged simply so I can actually see the thing. The rest of the thing is rather not-smooth thanks to the bumper case I've got.
"The idea that a modern phone is a perfect fingerprint retrieval surface seems to make sense, but is it really? Maybe when your phone is new and clean, but what about after you've been touching it dozens of times a day? Won't the prints all be overlapping and smudged?"
Would this be the only means? No!
Its a major secuirity fail. Once again Apple prove they just copy another idea and try to implement it in a way the feeble minded think is cool. Huge increase in their bank balanace. Worked a treat so far.
Fingerprinting doesn't work like in the movies. You almost never get a whole, clean, unsmudged print. If you've ever been arrested you know how hard it is for the police to print you successfully.
Fingerprint recognition works by matching a number of individual points, not the entire print; you don't need an entire print.
But it's not like kids old enough to pull off a trick like this aren't interested in abusing mummy and daddys iTunes account.
Another interesting question is - does the iTunes section of iOS show the full card number of the card you use to buy things - including CSV - and have they allowed this to be accessible with single factor fingerprint?
I don't have a device here to confirm whether those details are present in plaintext or if it's hashed out to the last four numbers (as I'd expect) - can anyone have a deek at their iDevice and confirm/deny whether it shows the whole number once entered? Google Images is showing me nothing, natch...
Devil is in the detail.
Can they do this from a lifted print, or only from a high res cropped scan of the correct digit.
Also, lets get 3rd party verification. For all we know, the hacker had already enrolled their second digit into TouchID. When he placed the fake on the second digit it would have worked either way if that digit was already enrolled.
Time for public commuters to start wearing gloves lest they fall asleep and get the fingers secretly scanned...
What is every tea leaf on the road today a CSI agent, yeah because everyone has latex and and high res scanner going around in the hope they can mug an iPhone user for their phone.
People need to get a grip , you snatch the phone, high chance you will smear any useful finger prints on it, so unlee you grab it without smearing, you've wasted your time.
"What is every tea leaf on the road today a CSI agent, yeah because everyone has latex and and high res scanner going around in the hope they can mug an iPhone user for their phone.
People need to get a grip , you snatch the phone, high chance you will smear any useful finger prints on it, so unlee you grab it without smearing, you've wasted your time."
Your point is moot. You use a pin and expect a level of security which works a treat. Pins are used by the banking industry daily. The level of risk is acceptable.
As mentioned by many appletards, on expects a finger print scan to offer enhanced security above the use of a PIN. This has been proved wrong in record time.
Everyone who isn't an Applebitch knew this from the start.
This is a HUGE FAILURE and yet another cause of embarrasment for Apple (and it's kin).
It is incredibly easy - follow these simple steps:
1. I steal your phone
2. I take it home, take off my coat, make a coffee and sit down at my PC
3. I lift the lid on my very cheap Canon 3-in-1 (budget model) which has a 2400 DPI scanner
4. I place your iphone on the glass, close the lid and scan the phone
5. I open the scanned image in GIMP or any other half decent graphic editing app
6. I find a complete print and crop the image around it
7. I save the image at 2400 dpi
8. I print it onto plastic (I presume OHP transparency for inkjet will do?)
9. I wait for it to dry and then paint a thin film of liquid latex over it (very easy to purchase on the high street or online)
10. Lift the print, unlock the phone.
I don't understand why so many people are saying "Yeah but who has a 2400 dpi scanner laying around?" - actually most of us probably do - even budget level 3-in-1s have 2400 DPI capabilities nowadays and many have 4800+ DPI capabilities if you are willing to spend a little more.
Apple screwed up - their main USP (which isn't even a USP given the Aria) is compromised within a couple of days of launch and no amount of "How will you get my fingerprint?" "Who has a 2400 dpi scanner?" or other attempts to mitigate this will change that fact.
'Does the "lock & wipe" work when the SIM is removed?'
Lock & wipe works on a particular phone. The SIM that is currently in the phone has no bearing on that.
If the phone is quickly put into 'Airplane' mode, it won't receive the lock command from Apple Central. But a phone in such a state isn't really much of a smartphone and will be worth very little to a thief.
OK, lets have a race...
You do all that , and I will do:
1. Discover phone is missing -- one day
2. Fire up Find My iPhone -- five minutes
3. Lock and wipe -- doesn't happen since the phone is no longer on the web.
So pretty much the other guy will finish first due to the length of time step 1 takes.
Most of the "Time taken" comments make the assumption that the fingerprints have not been prepared before the theft.
Consider who could get a good fingerprint of yours in any one week.
Lad walks into a bar "Any glass collecting jobs?"
"oh no not another one!"
this works provided:
1: the print you got is indeed the one I use to unlock the phone with
2: your scanner lamp will not deflect off the shiny surface off my phone into your scanner camera and destroy your image
3: you are within 48 hours of me touching/unlocking it for the last time
4: you're done before the battery runs out
5: you are actually interested in my personal data and didn't nick it to be used by yourself
6: you are faster then me wiping it via find-my-iphone (yes tinfoil will help I know until you have to remove that to place it under your scanner unless you tinfoil wrap your entire room).
Yes the sensor can be "fooled" but the real screw-up would be if they actually can obtain the data from the SecureZone within the A7.
Essentially that would really break the TouchID system.
I'm not sure which part of that is supposed to be the insult, "10 year old", or "virgin". By themselves those aren't especially insulting. A 10 year old posting to this site alone would be reasonably impressive; especially considering his use of protologisms comprised of non sequitors combined with slang.
Virgin is not a bad thing. I think they're missing out, but then again 94% of everything ever done was part of an attempt to get laid. Maybe they're more focused in their endeavors because of it... Who knows.
Now, a 10 year old non-virgin, that is disturbing but not really anything you could hold against someone in an insulting way. People of that age who are not virgins shouldn't exist; wouldn't exist if there weren't some terribly fucked up people out there.
Both of you handled attempts at insults poorly. A proper insult should clearly and directly assault the targets honor, intelligence or other core Human virtue or physical feature in a manner that cannot be misconstrued (ex: Limp Dick Show Pony or Stupid Sloppy Gashed Whore). Good non sequitor insults not only attack the target, they make everyone else laugh; which only adds to the shaming power of the insult.
Also crucial when insulting people in written formats, is to ensure proper spelling and, at a minimum, slightly above average use of grammar. This is doubly true when actually writing a letter, with pen and paper, to heads of State and/or the recipients of ransom demands.
In this case I would say something like: "Christ Almighty. You lot of Syphilitic Little Garden Gnomes are really shitting in your own cereal here. Take your ignominious commentary elsewhere". You could append a good "forthwith" or "posthaste" on the end if you're dealing with a bunch of Blue-blooded Ivey League Tosspots.
Government agencies like NSA won't bother with your prints, they probably have other ways to get around the device's security.
So is this a possible deterrent security control against phone theft? Yes.
And possibly no more then that.
Can you ever design a phone with enough security against people with enough skills and money and determination to get YOUR data? Which will be usable as well?
I seriously doubt it.
Front door keys have been demonstrably hacked and should not be used, says a prominent group of hackers.
The group of experts warned that using a key to lock the front door to one's house is unsuitable, as the technology is flawed and could be easily stolen or reproduced.
The hackers were given access to a key and using simple household materials, and with "minimal effort" (just 10 steps including basic forensic techniques, image processing expertise and the use of household chemicals), they reproduced it to a satisfactory level of accuracy.
"We hope this puts an end to the notion that using front door keys is a good idea. They should be avoided at all costs," said the hacking group.
In recent decades the use of door keys has proliferated to the point that even the hackers themselves admitted they use such devices. After this latest revelation, however, the experts have decided to use a far more complex access control mechanism, comprising a long and complex series of numbers and letters.
In bygone times more than 50% of people didn't have any security on their doors - and even left their backdoors wide open. Pro-key lobbyists noted that keys gained prominence as they at least provided a basic level of security - which previously had not existed. Not only that but they were simple to use and hard to lose.
Police fear is that this latest revelation will lead to more people once again leaving their homes unprotected, as they shun this imperfect technology.
A police spokesman said: "Of course keys can be vulnerable - I'm not sure that anybody has claimed otherwise. But we believe that they are still a valuable addition to the overall security of premises. Determined criminals will be able to access your property regardless of your front door key, of course. But for opportunistic criminals - which represent the vast majority - front door key technology is a strong deterrent."
yeps! Totally agree.
And we could rewrite this perfect scenario for:
- pincodes on bankpasses and creditcards
- Iris detection on airports
- handprint scanners
- face recognition
- baggage locks with keys or 3-digit cyphers
- those TSA locks nobody but the TSA is supposed to have the key for
- wireless carkeys
By simply copying the peace, replacing the appropriate security term and rewording some small bits to fit the different style of technology.
What do you really want?
An iPhone requiring both a fingerprint and a passcode to unlock? I would but then I'm security paranoid enough to care.
99% of users on this world don't and that's why this will improve security for those who don't bother to set a passcode at all in the first place.
The key difference is a lack of hype about keys. Well, nearly, some con attempts can be safely ignored here. Keylocks are well understood and most people do not have illusions about them.
Biometrics are not so ubiquitous to have the same familiarity.
Oh, and keys do not have cult following.
15 years ago a friend hacked a fingerprint scanner into his door bell button. While it didn't work well enough to unlock the door, it did work well enough to let him know when UPS had dropped off a package most of the time or when the mother in law dropped by.
If MS did something this stupid the press and the fanbois would be all over it labeling it a major vulnerability and serious negligence.
It is true that in most cases blackhats and many alleged white hats have unreasonable expectations of programmers.
Even main battle tanks can be vandalized and stolen.
Even bank vaults can be broken into within 15 minutes using a thermic lance, which is why you need a police station within 15 minutes drive to get insurance on your bank branch insured.
The lack of any kind of police crackdown on the thriving industry of buying and selling exploits is not something vendor coders can prevent. It is a justice system and legislative failure that only voters and their employees can fix.
And how many people have complained about MS having vulnerabilities that required physical access to the desktop?
However, in this case we're talking about a portable device that has its passwords (fingerprints) all over it.
That is simply as bad as leaving the keys under your doormat.
The whole "so a mugger has to do all this to get in to your phone... blah" scenario isn't the first thing that sprang to my mind.
The one that I first though of was the where foolish business or political types keep *all* their important stuff on their phone. For the right people, it would be advantagious to take their time in getting the stuff they need beforehand, making the print and so on. Snagging the phone would be the very last thing to do. If they're already wearing the fake prints, they could be opening up their victims mobe as they're running away.
It's even simpler then that: if you're right handed then simply use a finger you mostly ignore on your left hand and vice versa.
Earprints maybe interesting as well.
Although I'll hear the sceptics cry out wolf again as you will leave that on your phone everytime you make a call.
Yes, so use the other ear!
Besides: you have 10 fingers and only 5 attempts.
I'll let somebody else do the math ;)
...somebody breaking into your phone. And let's face it, thieves are not the people you're worried about getting into your phone. It's your close friends and those you keep even closer...
It's a privacy thing not security. Anybody who keeps really important stuff on a phone that needs to be locked down is not being very smart.
The real problem, in the real world, is the uniqueness of a fingerprint from the user's perspective. They cannot make a copy of their 'key'. They won't be using any of the other options to get into their phone, and will no doubt have lost their PUK codes etc. Then, oops, they catch their finger in a door and they have to wear a great big bandage on it for a few days until the swelling goes down. OMG! They won't be able to update FB to let everybody know how their finger is healing. They will probably not be able to get in touch with any of their contacts, because most people have their friends' numbers in their phone and nowhere else.
I agree with the sentiments expressed elsewhere about the 'normalisation' of using fingerprints to go about our daily lives. It's a Bad Thing(tm). Selling this as a 'security feature' is disingenuous. In fact, the only security people in general care about with regard to their phone is the stealing of the hardware itself I think. I'm pretty sure the majority of thieves will factory reset any phone they get, they're not interested in your personal data. If they were, they wouldn't need to steal your phone to get it...
"It's a privacy thing not security. Anybody who keeps really important stuff on a phone that needs to be locked down is not being very smart."
By coincidence I was watching a documentary on digital privacy at the weekend, and in an interview with a guy at a security company which sells equipment to Governments and large companies in the security industry he was saying we keep more personal information on smart phones these days than we ever did on computers, and you have to bear in mind potential targets are likely to be politicians, celebrities, and the like who are hardly likely to be security minded at all, and are likely to assume everything on their phone is "secure".
As to what is "important", sometimes this may not be apparent when you store or record it, sometimes something only becomes so after the event, witness the amount of private comments making there way into the public domain after the person responsible assumed they were "private"
Biting the hand that feeds IT © 1998–2019