Chaos Computer Club Bypasses Apple's Touch ID System (With Copy of Original Fingerprint)

[sshhoott]

Looks like TouchID is just going to be limited to unlocking the iPhone and purchasing apps for a while.

 

[Eriamjh1138@DAN]

This is why I use a different body part

Access to my phone? Please allow me to whip out my "special digit".

 

[jlnr]

Yay, good to see the CCC make international news! (Hope it won't be an embarrassment )

which is in itself ridiculous. Phones get stolen and then wiped and sold. You are not that precious a snowflake that someone who steals your phone, wants to read your texts.

arn

Yes, but iOS 7 has a feature that is supposed to prevent exactly that:

http://www.itproportal.com/2013/06/...-apples-ios-7-iphone-theft-prevention-system/

If you can bypass Touch ID and reset the phone before the owner can use Find My iPhone, then you can sell it. Or can you? I'm not sure if you can disable Find My iPhone if you bypass Touch ID.

It would also be interesting to know if it has to be a 2400dpi photograph of the finger, or if you can just steal the phone along with the (fingerprinted) coffee mug next to it at Starbucks and create the fake finger from that.

(All that being said, I still want a 5s just for Touch ID…)

 

[madsci954]

So everything needed here

First, the fingerprint of the enroled user is photographed with 2400 dpi resolution. The resulting image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting. Finally, pink latex milk or white woodglue is smeared into the pattern created by the toner onto the transparent sheet. After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone. This process has been used with minor refinements and variations against the vast majority of fingerprint sensors on the market.

is considered "everyday items?" So they are assuming everyone is MacGyver?

 

[orijin]

shaky fingers, makes this video extra creepy.

 

[stevaroo01]

Here we go... Cue all the nay sayers who will complain about how insecure the newest iPhone is and how Apple just can't get anything right any more!

I mean really... Are we really that concerned that our friends, family, coworkers, whoever, are going to covertly obtain our finger prints and then go through all of this trouble so that they can do what? Download apps to our phone? Read our texts and emails? Send out tweets and status updates from our account?

Seriously, the only true way to not ever have a possibility of someone getting into our accounts is to just not have them. For the average person, a finger print scanner like on the 5s is much more secure and convenient than any other option. I'm not really concerned by this.

 

[muuhamed]

Did anybody else notice how violently his hand was shaking?

 

[DaReal_Dionysus]

That isn't a 5S. More BS vid's

 

[chrmjenkins]

Ok, so don't let anyone take high resolution macro shots of your finger?

 

[Jimbo47]

The sheet he has on his finger looks like it is clear. How do we know its not just scanning his finger through the paper?

 

[SPNarwhal]

I hope the iPhone 6 uses blood sample as a security feature.

 

[its93rc]

Robber: "LET ME TAKE A 2400DPI PICTURE OF YOUR FINGER!"

 

[pgiguere1]

Do we have any proof that it simply isn't still reading the finger's fingerprint through the transparent plastic sheet?

Because the process they claim to use sounds like it would fool an optical fingerprint reader, which Touch ID isn't.

Touch ID uses a radio-frequency capacitive sensor that only works with live body parts, as previously explained by Mashable.

 

[iSunrise]

which is in itself ridiculous. Phones get stolen and then wiped and sold. You are not that precious a snowflake that someone who steals your phone, wants to read your texts.

arn

Wiped and sold is "only" theft, they still protect the original user of the phone. Impersonating someone else by unlocking the phone and using his account for everything and fingerprint authentication would be a bit more severe.

The methods they´ve used are kinda ridiculous though. Getting a 2400 dpi scan of your fingerprint should be a bit hard, unless the guy really wants his fingerprint to be stolen.

 

[HowEver]

Jesus, the phone is reading the print through the clear film through to the actual finger.

Show us a break-in with just a photo or the print on paper or whatever.

This one USES THE PERSON'S ACTUAL FINGER.

Not sure why this isn't completely obvious?

 

[jon3543]

Would be more interesting if they could do it with prints left on the phone's surface.

 

[crawler1975]

[url=http://cdn.macrumors.com/im/macrumorsthreadlogodarkd.png]Image[/url]


The Chaos Computer Club claims to be able to bypass Apple's new Touch ID fingerprint sensor using everyday items and a photo of the original user's fingerprint. The bypass is demonstrated in this short video:

YouTube: video​

The system is detailed in a how to which requires obtaining the original user's fingerprint:Apple's new iPhone 5s includes a fingerprint sensor called TouchID, which can be used to unlock the iPhone as well as make purchases on the Apple iTunes store. Users, however, can continue to use a pin or password as an alternative to the fingerprint sensor -- though that is arguably even less secure than duplicating someone's fingerprint.

Article Link: Chaos Computer Club Bypasses Apple's Touch ID System

well.. first of all the video does not show how they photographed the fingerprint.. did they lift it up from the touchID (ala CSI /FBI /Police) then photographed it?

second, they will need to chop off the user's finger in order to obtain a print.. and which is already being done by the "professionals" (mafia, yakuza and the others)... that part is scary -

from a security perspective, I think apple employed a decent deterence on iphone theft. remember, there is no 100% full-proof security ...

 

[SPNarwhal]

is it just me or does that 5S have a silver bezel?

 

[tigres]

Bypass?
Can I have bs foe 500 Alex

 

[Rodel30]

For those mentioning 4 digit passcodes, there is a somewhat hidden feature for longer digit only passcodes. Most people know about complex passwords, but don't want to type on the full keyboard to get into their phone. But if you create a complex passcode that is only digits it will still use the number pad for passcode entry, but you can have as many digits as you want!

 

[123]

This doesn't surprise me at all. CCC was able to do this with PC laptops with finger print sensors more than 10 years ago. Apple, ignorant as always, couldn't care less about security concerns.

 

[petsounds]

I call BS on this. The fingerprint scanner specifically reads at the sub-dermal layer. I really doubt glue would fool it. I'm going to guess that he had already registered his other finger, and the paper has nothing to do with it.

Also, that guy needs to lay off the caffeine a bit.

 

[Maclver]

So it's that simple...

LMAO... Best comment! +100

 

[arn]

well.. first of all the video does not show how they photographed the fingerprint.. did they lift it up from the touchID (ala CSI /FBI /Police) then photographed it?

second, they will need to chop off the user's finger in order to obtain a print.. and which is already being done by the "professionals" (mafia, yakuza and the others)... that part is scary -

http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en

That documents how the fingerprint is obtained.

arn

 

[lorax3]

How is a 2400 DPI photograph of someones fingerprint an everyday item? I'm sorry but this is click bait pure and simple.

I agree. I would like to see the "house hold items" bit removed from the story on the Front Page. They are not just using a piece of tape. I know it says a photo AND household items, but it's a bit deceiving IMO.