Chaos Computer Club Bypasses Apple's Touch ID System (With Copy of Original Fingerprint)

[peterdevries]

What many here forget is that you need to go through great lengths to obtain a quality fingerprint (the CORRECT finger too), duplicate it through this process AND obtain the iPhone.

What is also overlooked is that the percentage of locked iPhones will increase. People that think a pass code is to cumbersome but value security will be swayed by the user friendliness of this system.

Of course it can and will be hacked, but it is an unusable process for 99.99% of the iPhone thieves.

 

[katmeef]

If Tim Cook lost his iPhone... it would be bricked 30 seconds after it was reported missing.

That's the big thing people are missing. Pass codes and TouchID will just slow you down until they can nuke the phone from orbit.

Let's say you find an iPhone 5S... or actively steal it. And happens to have a good fingerprint on it. And you go through the dozen steps it takes to make a fake fingerprint.

If the phone has any kind of important data on it... it's been wiped already.

Unless the thief took out the SIM card

 

[flottenheimer]

A method to bypass any "enter your passcode" system:

"Install a hi-res/HD surveliance camera. For example in a restroom. Position the camera in such a way, that it has a clear view of the passcode protected device. Film people while they enter their passcode. Look through the film. Find the bits where they enter their codes. Write down the pass codes. This process can be used with minor refinements and variations against the vast majority of passcode protected devices on the market".

 

[Snowy_River]

Well, law enforcement would need a court order and have to do it within the 48 hour window before a passcode would be required. Any evidence found in an unlawful search/seizure could/would be ruled inadmissible in a court of law, but it may give them enough info to find other evidence, legally, if you committed some crime. But if Apple gives up the goods on you, you have no chance.

Actually, I believe that any evidence that is acquired as a direct result of an illegal search and seizure is also inadmissible. So, if they illegally broke into your phone and found a note saying that your drug stash is located at 123 Street Avenue, allowing them to go and find that drug stash, the discovery of that drug stash would also be inadmissible because it came as a direct result of an illegal search and seizure.

Relating to the story, it does seem a bit suspect that the person using the "false" fingerprint is the actual phone owner. If (s)he had put on a thick glove first, or had someone else entirely use the false print, then I'd find it more plausible, but as it stands right now, I'm firmly in the "hoax" category.

 

[UltimaKilo]

Some of you guys are really messed up. Clearly the guy in the video has Parkinson's disease...

 

[Michael Scrip]

Unless the thief took out the SIM card

I think Activation Lock will kick in whenever a SIM card is removed. And whenever you reinsert a SIM card... it will ask for your AppleID and password.

So all that work of finding a fingerprint, scanning a fingerprint, making a fake fingerprint... for nothing!

The phone is still rendered useless.

 

[k995]

What?! Madness! I was certain that the button-sized fingerprint scanner on my phone would be impervious to elaborate latex reproductions of 2400 DPI images of my finger!

In other words, this method works on all fingerprint scanners. No surprise here. No one is billing the iPhone's scanner as an invulnerable security system for sensitive confidential data. Based on the effort it takes to make a fake, it's likely more secure than a 4-digit code and certainly way better than no password, which is how most people use their devices.

"The sensor uses advanced capacitive touch to take a high-resolution image from small sections of your fingerprint from the subepidermal layers of your skin. "


The issue : this is now proven to be (once again) total BS from apple.

A stolen phone is wiped and sold. It may be briefly browsed for relevant financial data if it's unlocked. If you're the kind of person who fears targeted espionage you may want to look into more aggressive security measures not covered by this functionality, like armed escorts or psychiatric care (depending on the reality level of your concerns). Or at the very least a long-form password.

I wouldnt use any smartphone certainly not something from apple.

 

[turtle777]

Ok, so Apple's claim of sub-epidermal scanning was only marketing BS ?

That's the main thing I'd be pissed about. Either Tim lied, or he was lied to.

-t

 

[djtech42]

So basically, nothing new that we didn't know before...

More fear mongering about security

This is worrisome though:

Ok, so Apple's claim of sub-epidermal scanning was only marketing BS ?

That's the main thing I'd be pissed about. Either Tim lied, or he was lied to.

-t

 

[kenwk]

"
The issue : this is now proven to be (once again) total BS from apple.



I wouldnt use any smartphone certainly not something from apple.

Well you have always been pro android (or hate apple) anyway so what is your point?

 

[PBUser167]

I'm not buying this just yet. As others have pointed out, they could have enrolled their other finger being used. Then they put out a stupid video showing someone else doing it so that it is someone else's finger being used. That is pretty lame. I don't care who's finger they use, they should be showing the finger failing to unlock the phone a few times without the fake finger first. Showing any other finger being used with the fake finger doesn't mean anything unless we know the finger under it is not enrolled.

 

[User0]

Universal vulnerability with fingerprint sensors?

Seems to be an issue that is known in the fingerprint sensor industry.

Does anyone know enough about fingerprint sensors to say if this is a universal vulnerability? I didn't think it was…

From AuthenTec's remaining support web site:
The Eikon fingerprint readers leverage the same fingerprint sensor technology embedded into millions of laptops, keyboards, physical access devices, and ID card readers relied upon by governments, hospitals, banks, and enterprises for secure and convenient authentication everyday.
…
AuthenTec’s Digital ID Hardware EngineTM companion processor performs processes such as match-on-device and OTP generation in secure, dedicated hardware. Anti-spoofing technology counters attempts to fool the fingerprint reader.

Vague but spoofing is mentioned.

http://support.authentec.com/KnowledgeBase/KBview/tabid/843/ArticleId/452/What-are-the-differences-between-Eikon-fingerprint-readers-Which-one-is-the-best-for-me.aspx

---------
I could imagine Apple's ultra high-tech labs completely over looking a relatively low-tech attack!

Maybe Apple needed a selling point for the iPhone 6!

 

[bb-15]

The CCC video only shows that a latex copy of a fingerprint can be made.
This method has been known for a long time. The CCC person had his latex print ready maybe after days of working on it.

* This is not a true test.
My guess is that the person from CCC did not own the iPhone 5S and was using a store demo.
But an owned phone is essential for a real test.

* For a real test, someone's phone should be taken which has been used in a usual manner and;
1. Can clean / clear fingerprints be taken off the phone after regular use?
2. Can a workable latex copy of a fingerprint (from a phone) be made in 48 hours?
(In 48 hours the phone will switch back to the passcode to be unlocked.)
3, And to unlock the phone the fingerprint for the correct finger would need to be made possibly requiring latex copies of more than one print.

Until this is demoed, then it is not a real test.

PS. I would not use the option to use Touch ID to make iTunes/App Store purchases. That should always use a passcode imo.

 

[k995]

Well you have always been pro android (or hate apple) anyway so what is your point?

yeah, currently 3 iphones, 1 imac and most of the network runs on apple equipment.

But yeah I "hate" apple.

You seem to think criticizing means hating, its actually quite the reverse .

I like apple and I want them to actually make good products, not spend most of the budget on PR to dupe people like you.

 

[AppleMark]

So everything needed here



is considered "everyday items?" So they are assuming everyone is MacGyver?

Perhaps.

But I am more concerned that if this is genuine, that anybody who is not an everyday person, for example a hacker, spoofer, government agencies, ex-wives and girlfriends [] who have been known to cross the legal line to obtain information will be pleased to know this. These people will have the resources and the incentive to invest in the time and equipment to do this. For example, we know there is a backlog of government requests for Apple to unlock iPhones, as they cannot break the 4 digit passcode in the legacy system.

Also it is amusing to see and compare the last weeks story / post's regarding lock screen vulnerabilities to this.

In that people were saying [about lock screen bypass] "This is bad etc..., but at least Apple will fix this with an update etc", yet in the face of this threat [if genuine], are now simply saying "Oh well security is never 100%" and prepared to live with it as an acceptable reality.

 

[yansun]

Actually, I believe that any evidence that is acquired as a direct result of an illegal search and seizure is also inadmissible. So, if they illegally broke into your phone and found a note saying that your drug stash is located at 123 Street Avenue, allowing them to go and find that drug stash, the discovery of that drug stash would also be inadmissible because it came as a direct result of an illegal search and seizure.

Relating to the story, it does seem a bit suspect that the person using the "false" fingerprint is the actual phone owner. If (s)he had put on a thick glove first, or had someone else entirely use the false print, then I'd find it more plausible, but as it stands right now, I'm firmly in the "hoax" category.

You know what "parallel construction" is?
http://en.wikipedia.org/wiki/Parallel_construction

And to the discussion fake or not. The Chaos Computer Club is not a bunch of wannabe hackers, but a very reliable organization with a very good reputation. So if they are claiming something, you can believe it.

 

[Serban]

So now with this thing come to live..what is more secure? only passcode or finger print? i mean to secure your data,phone calls/messages?

 

[Lancer]

I got tired of entering a password so my old iPhone I just had it without any password, and I guess that's the point. a finger print scan is much better than no password at all but they can be faked. Maybe Apple should have used retina scan?

 

[vmistery]

So Firstly the person would have to have a very good copy of my print then have the ability to put this onto some medium to place against the scanner and also have to have my iPhone. Or they could glance over the shoulder of someone putting their 4 digit pin code into their phone and steal their phone. Which is more likely. Security is never going to be perfect, you have to also balance the convenience vs security, I bet if it took 15 seconds to do a really detailed scan of your finger most people would turn the feature off for example. I am not saying we shouldn't work on making it more secure I am just saying it is not as simple as lifting a print with some sticky tape, If it was then we would have an issue.

Well I guess I am safe from this terror as I don't have a 5s!

 

[jasonst165]

So they havent bypassed it, they copied the persons fingerprint.

I think I will notice someone taking a Hi-Res photo off my fingers

 

[-js-]

OK. Just read this entire thread. And I think there are some takeaways (to summarize) so far:

1. CCC would not fake this. Period. It's genuine.

2. You don't need an image of a finger, only a fingerprint.

3. It's a 5S. (also see 1)

4. You can see that the finger that gets registered is the first and (so far) only finger registered, because it starts with no listed prints. (also see 1)

5. He uses a different finger when opening the phone with the facsimile print. (see 1, again).

6. This may not bother you or me (it doesn't)--it may be no big deal to you or me--but it is indeed a (somewhat) big deal, because Apple claimed that the sensor could not be fooled by copies of fingerprints left on objects like drinking glasses or your phone because it was reading subdermal characteristics of your finger!.

So at this point, we really need to see this replicated and tested and explored and we really need to hear a response from Apple.

Now, personally, I tried to live with a passcode lock for a while and it was just way too much of a PITA so I turned it off. I have no protection whatsoever on my iP4. The fingerprint sensor thing--even if just a mild form of protection against unauthorized access--really appeals to me.

Finally, as for fingerprints replacing passwords, I think that's a BAD BAD idea, for obvious reasons. For me, the appeal, from the get-go, has always been MULTI-TIERED PROTECTION. As was mentioned earlier, there are three types of security:

1. Something you know: lock combination, password, etc.
2. Something you have: key, credit card, RFID, etc.
3. Something you are: fingerprint, heartbeat, retina, DNA, etc.

COMBINING two (or three!) of these things is exponentially more secure than using just one alone. If I had to pick just one, it would definitely be #1 because it can be changed anytime and can be as complicated as you like. But having your iTunes account require BOTH your password AND your fingerprint before authorizing a purchase is even better.

And consider that getting a fingerprint requires propinquity. You can't do it from half a world away. Whereas your password can be hacked from anywhere.

I still think that TouchID (and similar biometrics) is important and will be used more and more in the years to come, but not as a replacement for, but rather as a supplement to the password. And we can see this attitude in some of the great points, thoughts and suggestions made here about how phone unlocking could best work. Initial opening requires PIN, but then after that, for a limited amount of time (which would be set by the user in settings) FP alone would suffice to unlock the phone.

Anyway . . . very interested to see how this all develops.

 

[till213]

Calm down fanbois! No need to jump in front of the Apple train and die a heroic death in order to save Apple's reputation!

We already knew that Apple's finger print reader would be unsecure - well, only die hard Apple fanbois were rambling about "blood capilars", "totally secure", "measuring pulse", "When Apple does it they do it right!" and all that nonsense.

So what CCC just uncovered is that "Yes, also Apple is selling you 10 years old technology - and it can be fooled in the same foolish way like any other finger print reader". So nothing new here - go on!

The actual Apple Fail here is that Apple is trying to sell it as "totally secure" and "you can also use this technology for more sensitive stuff" - like buying apps from the App Store (implemented already NOW!) and who knows what's next: "money transfers", "identification with voting systems"?

Then we talk again how interesting it will be to steal iDevices together with the owner's fingerprint! It's just a matter of how much money you can get out of this - and that WILL be done! And you only need ONE out of - say - 50 stolen iPhones where a valid fingerprint can be extracted from the screen...

 

[where is it]

I'm surprised by this test being classed anywhere close to being valid.

A few things bother me.

The first being the 'fake' finger print being used by the owner. Surely a proper test would be to demonstrate a stranger trying to use the phone with / without the 'fake' fingerprint.

The owner using the phone but with a different finger and a 'fake' print probably was enough to log in. Plus we don't know that even though he scanned only one print that his 'other' prints weren't good enough to log-in with or without the 'fake' print.

The people trying to log into your phone would need to make 'fake' print copies of all your fingers on both hands as they don't know which finger you use to log in with.

The most puzzling problem I have with all this is the basic fact that up till now if someone saw your passcode or cleaned your screen and watched you log in and looked at the smears to guess your passcode then once they knew it they could log in.

Same thing here, you have a print extracted and replicated then yes you have the credentials to log into someone elses phone.

The point being here, if you have the right credentionals with anything in life you will be granted access.

A better test would be to bypass the system without the use of a fingerprint altogether.

 

[viacavour]

I saw the video. It's too early to call.

For one, getting a carefully constructed image of your finger is easy.
Getting a carefully constructed image of someone else's finger is difficult.

Plus, while this particular set of material may work for this guy. It may not work with everyone.

Finally, Apple should be able to tune the sensor further to make it more difficult if people want better security. The only issue is increased scan time.

People are too quick to jump to conclusion. If they increase the sensitivity further it may be beyond current printing technology to spoof.

 

[iPadPublisher]

Seems like B.S. to me... Authentec was said to be working on some amazing stuff before the Apple acquisition. You can't tell me that a bunch of fingerprint security guys didn't figure out 30 ways to try to trick their own system, including this.

If, on the off chance, this turns out to be true... then just wow. Wow Apple. Wow.

But I doubt it.

----------

Plus, while this particular set of material may work for this guy. It may not work with everyone.

This part doesn't make any sense to me... its not about what works for each person IF (I'm with you that its probably not legit)... IF... its true, then these materials would probably work just fine for anyone. The sensor is either smart enough to avoid this, or its not... the materials aren't going to react differently per-person. They've either got a high-res scan of a fingerprint or they don't... ya know?