Sign in / up

back to article Roll up, roll up: Cash, Bitcoin and booze offered for iPhone 5S fingerprint scanner hack

Hackers have taken to crowdfunding in a bid to raise a bounty to hack the iPhone 5S fingerprint scanner. The IsTouchIDHackedYet.com site has so far received cash offers exceeding $3,250 – and 7.13 Bitcoins, which is a shade over $900 at current exchange rates – from more than 30 people prepared to chip in to offer a "reward to …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. MrXavia
    Facepalm

    So a phone, which you constantly use fingers on, has a fingerprint scanner for security?

    Doesn't that seem like an idiotic idea?

    Even the pin code is not that secure, grab someones phone and you can often see the most often pressed numbers..

    1 3
    1. SuccessCase
      Reply Icon

      @MrXavia

      It was until companies like Authentech (who Apple purchased) came up with the idea of scanners which scan below the surface of the skin. Consequently it isn't possible to simply use a fake print. Severed fingers don't work either. Additionally the scanner doesn't store data that can be used to map the print. It is stored in a hashed form. So any hack would need to lift the hashed print. My prediction is they won't manage it. This is a secured hardware subsystem. Lot's has been learned about how to make such systems secure from hacking. I suspect these hackers are from the world of PC's where everything tends to be accessible to the CPU and so therefore readable if the system/software is subverted.

      0 2
      1. SuccessCase
        Reply Icon

        BTW it's always possible to hack any system if you have enough time and money and access to the physical system. However what is not necessarily possible is a repeatable easily applied hack that means such systems can be compromised remotely.

        0 0
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        The contest specifically says the hack needs to involve lifting prints eg from a beer glass. Hacking the hardware would not count, even if it weren't the harder approach.

        I'll be very, very surprised if that "below the skin' stuff means anything besides "a live finger needs to be there". I mean, every spy movie has people using peel-off fake fingerprints, and you can make those with a little bit of rubber cement. If it's thin enough, unless there are substantial differences in the blood vessel and skeletal structure under the skin, there's no way for the scanner to tell the difference.

        0 0
        1. SuccessCase
          Reply Icon

          Cite World writes:

          "the [next gen] sensors that will be in laptops and keyboards and other phones can detect the ridge and valley pattern of your fingerprint not from the layer of dead skin on the outside of your finger (which a fake finger can easily replicate), but from the living layer of skin under the surface of your finger, using an RF signal."

          I doubt you will be able to replicate that from a simple surface print. Now if you have your own RF fingerprint scanner and can find a way to incorporate it in an object that you get a target to pick up, that might be a different matter.

          0 0
      3. MrXavia
        Reply Icon

        Don't get me wrong, I would love this to be secure, I just see it being a real risk if it does use fingerprints as the biometrics with nothing else.. The only reliable biometrics I've ever used is IRIS, I've never had a fingerprint scanner actually work reliably so far...

        0 0
      4. launcap Silver badge
        Reply Icon

        >Additionally the scanner doesn't store data that can be used to map the print. It is stored in a hashed form.

        This is really, really not a new idea - a company I worked for had this in their fingerprint scanners ten years ago..

        It has several advantages (can't reconstruct the fingerprint from the hash, takes up less storage than a fingerprint image etc etc) but does require more CPU (or dedicated chippery) to make it work properly.

        0 0
  2. Anonymous Coward
    Anonymous Coward

    Will they do the same for Android?

    When next month Samsing copies Apple and releases an identical phone?

    If they don't then we can be sure that the Fandroids are behind this whole scam.

    Now the next question is...

    Will this post break the record for the most downvotes?

    1 9
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Will they do the same for Android?

      Strange, but my Sammy phone is nothing like an iPhone. It has better performance, and screen size, plus programmable widgets and several nice features. It does not need a rubber bumper and has excellent wifi. It is half the thickness and weight of an iDevice plus the battery goes for three days of use. Everytime I go through the airport I see iPhone trees from their white cords plugged into the charge stations. Oh, and I can change my battery in seconds.

      I can buy my apps from any store I want and unlike you I have full control over it without endangering my warranty. I can buy any third party charger cord I want (At a third of the price you pay) and hook it up to any standard computer gear effortlessly.

      Last, my Sammy is has survived four iterations of new "revolutionary" iPhones and still does more than the 5S.

      Living in a glass house must be nice. Keep throwing those stones.

      8 2
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Will they do the same for Android?

        And you are a regular attendee at the Church of the Great and All Powerful (who can do no wrong, ) Samsung

        Strange that that same diety can produce a POC called 'Galaxy Mini'. Even my old HTC Desire was a better phone that the Mini.

        2 1
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Will they do the same for Android?

        Wow your sammy certainly wins on every measurable aspect. The thing is, the iPhone is nicer to use which is something Samsung seem to be unable to reproduce and better. Any fool can put a bigger screen, processor, camera etc. into a smaller box but for those of us who aren't running benchmark software as our main use case Apple will continue to win.

        You say your Samsung has survived 4 generations of iPhone which would mean it was released in the iPhone 3GS timeframe and therefore you must still be running Android 2 as Samsung has long since stopped supporting those handsets where Apple have only today dropped support for the 3GS.

        1 1
    2. Dangermouse 1
      Reply Icon

      Re: Will they do the same for Android?

      Everyone keeps forgetting that there have been Android phones with fingerprint scanners for years - the Motorola Atrix. My wife has one, but it might be telling that she usually unlocks it by typing the PIN rather than scanning her finger! :)

      0 0
      1. Steve Davies 3 Silver badge
        Reply Icon
        Boffin

        Re: Will they do the same for Android?

        That fact has been pointed out a geed few times. Sadly the Atrix will never sell in the volumes that the iPhone will. That is why there is a bounty to break the scanner on the iPhone. I can only wonder if it is some form of envy. Apple has it so because we all hate Apple we have to trash everything they make.

        The Fandroids have been rather silent on the use of a 64bit CPU. I suppose this is one bit of innovation that Samsung can't claim that Apple copied from them.

        but being honest it is all rather childish. Instead of slagging off the type of phones/devices you don't like perhaps if similar amounts of energy was put into deveoping their favorite platform the naysayers might get a bit of pride in improving something rather than being negative all the time.

        This will probably fall on deaf ears though.

        1 0
    3. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Will they do the same for Android?

      Motorola had a fingerprint scanner on their phone back in 2011, one interesting thing is a mobile phone users movements and tower pings, not triangulation may be more accurate than fingerprint reading in identifying a user.

      Maybe in case of a lockout situation apple currently require you to enter an appleid and password, they already by default use your realworld registration address to help them build on mapping and how you move around that home location, so requiring you to walk your phone through a normal day seems a very good way to unlock it from lockout on a failure, should only take a few hours and (if they had network operator help) really hard to hack.

      0 0
      1. Fuzz
        Reply Icon

        Re: Will they do the same for Android?

        Long before the Motorola in 2011 there was an HTC P6500 I have one in a drawer at work.

        http://www.gsmarena.com/htc_p6500-2129.php

        I also remember some kind of slider phone around the same time that had a fingerprint scanner on the rear. The scanner could be used to launch different apps depending on what finger you scanned.

        A quick look and it's a Toshiba http://www.gsmarena.com/toshiba_g500-1904.php

        2 0
  3. Anonymous Coward
    Anonymous Coward

    "We're sorry..."

    Your fingerprint is not recognized. For some strange reason, Apple only recognizes the middle finger.

    0 0
  4. Anonymous Coward
    Anonymous Coward

    Easily bypassed.

    I'll just wait for my father to fall asleep (drunk, because that's his style) and use his finger to unlock it. It requires physical access to the device with the right configuration but it's still possible.

    0 0

  5. This post has been deleted by its author

  6. Anonymous Coward
    Anonymous Coward

    Data Mining En Masse

    The NSA say "thank you for voluntarily providing us with your fingerprint data".

    0 0
  7. westlake

    Tech marches on.

    The geek can't let go of a Mythbusters trick he saw maybe five to ten years back.

    The 5s scanner uses both capacitive and RF sensors. It reads living tissue beneath the outer layers of the skin and it expects a pulse.

    http://www.tuaw.com/2013/09/16/why-a-disembodied-finger-cant-be-used-to-unlock-the-touch-id-se/

    0 0
  8. bazza Silver badge

    How many fingers?

    Does anyone out there know whether the phone keeps several fingerprints on record? I hope so, or its going to be very annoying on some occasions:

    * when you've injured your first term and got a plaster wrapped around it

    * if you're a couple used to sharing a phone

    * when you just want to lend your phone to someone for a short while

    * when you're wearing a pair of those touch screen compatible gloves on a cold day

    If iPhone 5x doesn't deal with those scenarios then I suspect it will be quite annoying...

    0 0
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: How many fingers?

      " touch screen compatible gloves " I hate those... glad my new phone works with gloves, well they SAY it does, i am yet to test it

      0 0
  9. Anonymous Coward
    Anonymous Coward

    Looking at the new scanner I just looked at the new IOS7 online, I guess someone in their UI design team has been using android, loads of the useful features are near direct copies of what I have had on my Samsung phones for years (and are probably on other Android phones too, just happens my last few were samsungs)..

    The nice 'handy' way to control wifi/bluetooth etc.. my GalaxyS had that years ago! And the music controls.. and the 'hold the button for task manager'..

    For someone who keeps suing for Samsung copying them, they sure like to copy what others produce and slap it into their own products when its good...

    But I am glad to see Apple are playing catchup again with the UI, I would rather they improve than stagnate, competition is good for development.

    1 0
This topic is closed for new posts.