Chaos Computer Club Bypasses Apple's Touch ID System (With Copy of Original Fingerprint)

[locust76]

...I'll have to check with my M-i-L if she upgrades to a 5s...

You might wanna stay away from that abbreviation... I originally read "MILF"...


----------

Here's a video showing putting five fingerprints into one slot:

http://www.youtube.com/watch?v=3Qasx0NUDRw

I'm not insinuating that CCC is tricking us... but this video shows how you can have multiple fingerprints saved on the phone and it looks like you only have one fingerprint saved.

If true... this might explain how he unlocked his phone with his middle finger even though he appeared to only have his index finger saved.

So it's just something to think about... I don't know which video to believe now!

When the CCC guy enrolls his finger, there are no slots, so no, he only enrolled his index finger.

 

[locust76]

This is all fake! He still used his finger the whole time. The sensor in the phone is very sensitive and will see right through that latex. If he would of used something other than his FINGER you might have something. Also, why is he shaking so bad? What is he afraid of?

Congratulations, you weren't paying attention!

----------

Get some glasses to fix those broken eyes of yours.

Had to think of this:
http://www.youtube.com/watch?v=V-fRuoMIfpw

 

[LV426]

This confirms or disproves nothing.

Try reading. I am simply asking someone with a 5S to see IF the scanner can read through a thin film to see the fingerprint underneath. Is that so hard to do?

 

[Arni99]

Just scanned the BACKSIDE of my index finger and it works flawlessly and this print can't be found anywhere because nobody touches items with this side of the finger.

 

[pkson]

Replicating fingerprints has been around for a while, and can be done relatively easy. Opening an Android with your face, same thing.

I'd like to see them hack the touchID data.

 

[Arni99]

Try reading. I am simply asking someone with a 5S to see IF the scanner can read through a thin film to see the fingerprint underneath. Is that so hard to do?

YES its possible, just tried it myself with a thin film.

 

[locust76]

Can someone with an iPhone 5S in front of them please confirm or deny this thesis by a simple experiment. Does your print still register when you cover it in a few layers of cling film, for example?

It doesn't matter. gr8tfly was suggesting that the guy had already enrolled his middle finger before enrolling his index finger, which is not the case, as we can clearly see there are no fingerprints enrolled when he starts the enrollment process, and after the enrollment process, we can see that there's only 1 fingerprint saved.

 

[macsrcool1234]

So a bunch of nerds in their parents basement with no lives managed to do something that is so absurd and over-the-top that Apple should somehow be worried... ok.

How is it even a "hack"? They just used a fingerprint as designed...

I think the ultimate irony in this post is that this is exactly what Steve Jobs started as.

It's incredible how people resort to ad-hominem attacks right from the get go, not realizing that 'hackers' are the ones who always move technology forward.

 

[Nevaborn]

This is laughable, and anyone who classes this as bypassing the touch I.D has bypassed some brain cells.

firstly if you can copy a fingerprint and the phone recognises it, then the first problem here is the guy has one already made up that would be as discussed in this thread a lengthy and demanding process requiring high quality equipment. Not something your average iPhone thief has...or they wouldn't need the money from stealing the phone.

next the film is so thin I wouldn't be surprised if its able to just read prints straight through it anyway I'm more worried about people seeing my 4 digit passcode than a fingerprint. I imagine it will see improvements by the time of the iPhone 6

 

[LV426]

YES its possible, just tried it myself with a thin film.

Thank you. It would, then, seem that the scanner can indeed recognise a fingerprint through an applied film.

Any chance you could repeat with some other material/thickness, e.g. paper?

----------

It doesn't matter. gr8tfly was suggesting that the guy had already enrolled his middle finger before enrolling his index finger, which is not the case, as we can clearly see there are no fingerprints enrolled when he starts the enrollment process, and after the enrollment process, we can see that there's only 1 fingerprint saved.

I read somewhere in the discussions that things aren't so clear cut, and this may not necessarily be the case.

Regardless, it was a very poor demonstration video. What he really had to do to make it much more convincing was demonstrate that his middle finger could not be recognised, then with the print attached, show that it could. Even then, there's already the possibility that it was the fake attachment that was registered itself. I'm not ruling out by any means that the video tells the truth, but it's not presented in a convincing way, so FAIL on that front.

I guess that Apple has to respond to this sooner or later because Marketing will be hopping mad. It's going to be interesting to see the response.

 

[furi0usbee]

Wow... still?

 

[Dave00]

No, you are not the first one to make the mistake of believing that. Now when you watch it again, you'll likely see that he scanned his index finger and used his middle finger with the replica.

Looking closely, it does indeed seem that the index finger is used to scan initially - though it's nowhere near clear, and obviously very easy to fake if you don't see a clear image of which finger is doing what. Also, given that more than one finger can be used to unlock, there's no guarantee that they didn't previously setup the middle finger.

Regardless, it's not terribly convincing or concerning, given that the method requires an extremely high resolution photograph of one's finger, knowledge of which finger is used to unlock (out of 10 possibilities), the ability to clean up the resulting image and print on rubber material, etc.

Dave

 

[locust76]

Looking closely, it does indeed seem that the index finger is used to scan initially - though it's nowhere near clear, and obviously very easy to fake if you don't see a clear image of which finger is doing what. Also, given that more than one finger can be used to unlock, there's no guarantee that they didn't previously setup the middle finger.

Regardless, it's not terribly convincing or concerning, given that the method requires an extremely high resolution photograph of one's finger, knowledge of which finger is used to unlock (out of 10 possibilities), the ability to clean up the resulting image and print on rubber material, etc.

Dave

To quote myself:

...we can clearly see there are no fingerprints enrolled when he starts the enrollment process, and after the enrollment process, we can see that there's only 1 fingerprint saved.

 

[Tech198]

So, has this changed the "We though the finger-print reader was secure" type response ??

If all it takes is 'social engineering"(so to speak), I'm not surprised, cos the same thing happened with Mat Honan issue with icloud

 

[tbrinkma]

I understand where you two are coming from, I was only commenting on the pure mathematical angle.


That said, To me, the people using simple pass codes, aren't really taking security seriously to begin with. I personally don't use simple passcodes. I can't really enter my passcode when driving, but that is actually a good thing .

Of course, his statement is a simple, self-fulfilling prophecy. He knows which 4-digit code's he'd try, and the list includes 1234, but not 5317. Of course, he'd "crack more 1234 than 5317". If his list included 5317 (significantly *less* random than he thinks), but not 1234, he'd crack more 5317 than 1234.

 

[doctor-don]

Or, as one famous person put it, Much ado about nothing.

 

[tbrinkma]

Ok, so Apple's claim of sub-epidermal scanning was only marketing BS ?

That's the main thing I'd be pissed about. Either Tim lied, or he was lied to.

-t

Not at all. The sub-epidermal scan doesn't change the pattern of your fingerprint. The structures that make up your fingerprint exist pretty deep into your skin. What it does is provide resilience to surface damage, such as paper cuts and the like.

----------

The CCC video only shows that a latex copy of a fingerprint can be made.
This method has been known for a long time. The CCC person had his latex print ready maybe after days of working on it.

* This is not a true test.
My guess is that the person from CCC did not own the iPhone 5S and was using a store demo.
But an owned phone is essential for a real test.

* For a real test, someone's phone should be taken which has been used in a usual manner and;
1. Can clean / clear fingerprints be taken off the phone after regular use?
2. Can a workable latex copy of a fingerprint (from a phone) be made in 48 hours?
(In 48 hours the phone will switch back to the passcode to be unlocked.)
3, And to unlock the phone the fingerprint for the correct finger would need to be made possibly requiring latex copies of more than one print.

Until this is demoed, then it is not a real test.

PS. I would not use the option to use Touch ID to make iTunes/App Store purchases. That should always use a passcode imo.

1) Yes. It is certainly possible to lift a fingerprint from a glass surface, such as a phone. The phone's surface being a 'high traffic area' complicates it, but does not render it impossible.
2) Yes. It takes anywhere from 15 minutes to 2 hours to create the mock fingerprint, depending mostly on the cure time of the material used to cast the print.
3) Agreed. This makes the process more difficult, but it is still certainly possible to do this inside the 48 hour time limit. (This assumes a decent quality print from the correct finger can be found on the phone.)

----------

6. This may not bother you or me (it doesn't)--it may be no big deal to you or me--but it is indeed a (somewhat) big deal, because Apple claimed that the sensor could not be fooled by copies of fingerprints left on objects like drinking glasses or your phone because it was reading subdermal characteristics of your finger!..

Did they really? Or was it just people who confuse sufficiently advanced technology with magic that made that claim.

Please provide a reference to Apple's claim that the fingerprint scanner was immune to this spoofing technique.

 

[kdarling]

Regardless, it's not terribly convincing or concerning, given that the method requires an extremely high resolution photograph of one's finger, knowledge of which finger is used to unlock (out of 10 possibilities), the ability to clean up the resulting image and print on rubber material, etc.

Not picking on you, but just using your nicely detailed comment as a convenient jump-in point for a devil's advocate reply. Thanks!

• While they used more, I don't think it requires a very big or high resolution image. The Apple sensor is 500 DPI. It's also only about 10mm (.4 in) square. That makes it about 200 x 200 pixels (let's round up to binary 256x256). A complete fingerprint is unnecessary.
  
  
• It's a good bet that almost everyone is going to register their thumb as an unlock digit, just because the whole point is convenience.
  
  
• Cleaning up the image is something for image processing software, which is abundant these days.
  
  
• The materials are commonly available, and the modeling techniques have been used for 15 years now by all sorts of amateurs. Heck, I would not even be surprised to see somebody demonstrate a way to image a fingerprint and feed it to a 3D printer.

The upshot is, yes, a common thief is unlikely to bother. However, if you are someone who needs or wants their info to be secure... and has reason to believe that someone else might want it... then the fingerprint sensor alone is not sufficient to restrict access to that info. (If it's hidden behind further passcodes, then fine.)

 

[locust76]

Please provide a reference to Apple's claim that the fingerprint scanner was mmune to this spoofing technique.

I actually looked for this, watched the keynote and read the info on Apple's website again, nowhere did Apple claim that the TouchID sensor is impervious to spoofing.

It was actually commenters and bloggers that came up with that claim. The only thing Apple said was that it reads into the sub-epidermal "living" tissue in order to get a more accurate sample of your fingerprint. Nowhere did they say you couldn't slap a fake fingerprint on a frozen sausage and get in the phone.

So, Apple implements a fingerprint sensor in a really innovative and convenient way, people find out that it's ... a fingerprint sensor ... and freak out because it's not made of unicorn tears and magical rainbow fragments.

 

[Tech198]

You can have the most secure thing ever, and I believe Apple's done a really good job.

You can have multiple layers of security, lock down the encryption keys, and whatever you want, but if all of that hardware security is **** by a simple mis-judment of a print of a finger... then its its no secure at al.

Add to this the time spent to crack this, only a few days.. This alone should tell you how much thought had gone into the security side of this.

If is was Really bullet proof, the Touch ID would ignore everything, BUT the original print.

Apple can't claim this, because they don't know. And, I bet even if you tel them, do you expect them to listen?

 

[locust76]

• Cleaning up the image is something for image processing software, which is abundant these days.

I'm not so sure that photographing a fingerprint and "cleaning up the image" is a one-button affair that can be performed by anyone using any software. I'm pretty sure you probably have to have expertise so you know which details to enhance/correct and which not to. It's like retouching a photo: in order to do it properly, you need real skill and training, not just an expensive piece of software.

• The materials are commonly available, and the modeling techniques have been used for 15 years now by all sorts of amateurs. Heck, I would not even be surprised to see somebody demonstrate a way to image a fingerprint and feed it to a 3D printer.

The materials are readily available, but the procedure still requires lots of patience and skill to pull off. You have to pull a near-to-perfect print, which I understand is a very delicate process, for which you only have one shot. One mistake lifting the print and the original is destroyed. Even then, you have to hope that the print you're lifting is the one that's registered.

Add on top of that the fact that actually creating the fake print, despite the ready availability of materials, is still no small feat. Then you only have 5 or 6 tries with that spoofed print (CCC Expert-Man used 2 tries), otherwise the phone will lock itself out from fingerprints completely.

The upshot is, yes, a common thief is unlikely to bother. However, if you are someone who needs or wants their info to be secure... and has reason to believe that someone else might want it... then the fingerprint sensor alone is not sufficient to restrict access to that info. (If it's hidden behind further passcodes, then fine.)

And that's the real point. This isn't a fingerprint sensor for James Bond and Co. This is a fingerprint sensor for people who aren't being chased by international superspies (no matter how strongly they believe they are). If your phone gets stolen on a train, bus, or you lose it in a bar, the thieves are going to have a very hard time accessing your phone.

----------

If is was Really bullet proof, the Touch ID would ignore everything, BUT the original print.

Apple can't claim this, because they don't know. And, I bet even if you tel them, do you expect them to listen?

Apple never claimed this.

 

[tbrinkma]

If you have 4 smudges on screen it would suggest that each digit in the pin is different so wouldn't that come down to 4 x3 x2 x1 = 24 Combinations?

You could run those in under an hour.

Good point. The 4^4 is the worst-case scenario based on the number of digits and number of possibilities. Knowing they're all different (or not) definitely reduces the search-space significantly.

 

[subsonix]

Here's some thoughts behind all this by the guy who did this:

https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/

 

[gnubelebung]

Here's some thoughts behind all this by the guy who did this:

https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/

That's a different guy who just replicated the results, goes to some lengths to make the method seem exceptionally complicated and comes to reasonable conclusions, I think.

 

[k995]

http://istouchidhackedyet.com/

claimed others did it as well as proof.

Let the minimizing for not reason (as nobody made a big deal out of it) continue.