Hackers Trick Samsung Galaxy S8 Iris Recognition Using a Printed Photo and a Contact Lens

[lazard]

No. The point is the degree of easiness.

Is it easier to buy a digital camera and a $120 infrared filter attachment or a 99 cent bag of gummy bears?

 

[I7guy]

Is it easier to buy a digital camera and a $120 infrared filter attachment or a 99 cent bag of gummy bears?

Hard to tell, I have the digital camera, filters and printer...but would have to buy the gummy bears.

 

[DCIFRTHS]

It was totally staged! The guy looked directly into the camera for a clear shot. Once again, I put the challenge to you also. Go ahead and start taking photos of people this way and then tell us how many black eyes you come back with.

You would literally have to stalk that person to get the right shot (which I'm not saying is impossible, but really very difficult).

The camera was set to night mode.

I don't plan on trying this because I don't like the idea of retina scanning anyway. It's almost ridiculous to have to look into your phone to unlock it. Pick it up, put your finger on the Touch ID sensor, and well, that's it

 

[kdarling]

The camera was set to night mode.

Night mode is usually just long exposure. What you really need is the ability to capture infrared, and most good cameras block IR these days.

Freezing the video, it looks like they used an old Sony Cybershot with Night Shot capability. That was a camera with a switch to remove the infrared cut out filter from its sensor path. I wonder if it was otherwise modified as well, since they took the picture in broad daylight and that would normally overwhelm its sensor with IR in that mode.

But I'm no expert. Any ghostbusters around here with IR camera experience?

I don't plan on trying this because I don't like the idea of retina scanning anyway.

Note that it's scanning the iris, which is the colorful front of the eye. Not the retina, which is the inside back of the eye.

 

[mib1800]

I am wondering whether this hack is staged or not as easy as it seems. After so many days, there isn't any other copycat YouTube videos of the hack.

When touchID was hacked there were
many videos showing others copying/doing the same tricks.

 

[taiwuchiang]

This is the consequence of misuse of identity information as authentication information. Fingerprints or facial features or Iris patterns are identity information. They can't be used for authentication process alone. A secure authentication process needs two information: an identity information and a piece of secret info only that person who owns the identity knows.

 

[44267547]

Certainly I think that people in truly sensitive jobs should not be allowed to use any biometric unlock by itself. For that matter, shoulder-surfing a passcode isn't hard either. It's a pity that stock phone makers don't have two factor unlock options.

Ignorance. And Your logic is false and completely skewed Sir. I can tell you the agency I am Employed with ONLY is deemed to use biometric security measurements by itself, nothing else would suffice. Period. As a matter of fact, the biometric Iris scanning capabilities are recalibrated every few months to ensure there are no discrepancies and rechecked. Iris scanning is our primary source, which is all time sensitive and encrypted, which also has fail safes. We have back up methods, but Biometric is solo used on its own.

No snark intended, Do you have any idea how many government agencies safe guard Themselves and use biometric scanning as a primary and you "Think" they should not be using any biometric by itself? The NSA would disagree with you on your flawed logic.

You see, security isn't perfect. Why? Because if you allow something to be exposed long enough where someone has the advantage to create the technology, that technology has the means to allow the technology to be available. How does some of the top security in the world be the best defense against what one is trying to hack? It's called being dynamic, which regularly requires change in pattern, behavior and regularities from being static. Complacency and stagnancy are the two biggest hurdles for ANY security to become exposed.

Some of the best security engineers in then world are designing other means to keep the biometric process refreshed and ever changing as we speak, because of the tools criminals have today.

 

[kdarling]

No snark intended, Do you have any idea how many government agencies safe guard Themselves and use biometric scanning as a primary and you "Think" they should not be using any biometric by itself? The NSA would disagree with you on your flawed logic.

What agency do you work for and what's your clearance?

Myself, I was a spook for NSA. TS/SCI+. I can't think of any place really secure where there wasn't layers you had to pass through. For example, I'd bet that at your place of work you at least have security at the front door.

However, that's all moot anyway. If it wasn't clear from the context, I was talking about security for a smartphone. I don't think having a single factor unlock method is smart in the case of a device that is used outside a secure area. That goes for political and business people too, if they keep any sensitive info onboard.

 

[DCIFRTHS]

Night mode is usually just long exposure. What you really need is the ability to capture infrared, and most good cameras block IR these days.

Freezing the video, it looks like they used an old Sony Cybershot with Night Shot capability. That was a camera with a switch to remove the infrared cut out filter from its sensor path. I wonder if it was otherwise modified as well, since they took the picture in broad daylight and that would normally overwhelm its sensor with IR in that mode.

But I'm no expert. Any ghostbusters around here with IR camera experience?



Note that it's scanning the iris, which is the colorful front of the eye. Not the retina, which is the inside back of the eye.

Yes. I am, and was aware that it does not scan the retina. My point was that I don't want to hold a phone up to my face to unlock it. I prefer the current Touch ID method - for convenience.

 

[I7guy]

Yes. I am, and was aware that it does not scan the retina. My point was that I don't want to hold a phone up to my face to unlock it. I prefer the current Touch ID method - for convenience.

However, more options are better. With the phone on a desk, leaning toward the phone and having it unlock is preferable to touch id. Of course, if one doesn't like this method, they can turn it off.

 

[DCIFRTHS]

Ignorance. And Your logic is false and completely skewed Sir. I can tell you the agency I am Employed with ONLY is deemed to use biometric security measurements by itself, nothing else would suffice. Period. As a matter of fact, the biometric Iris scanning capabilities are recalibrated every few months to ensure there are no discrepancies and rechecked. Iris scanning is our primary source, which is all time sensitive and encrypted, which also has fail safes. We have back up methods, but Biometric is solo used on its own.

No snark intended, Do you have any idea how many government agencies safe guard Themselves and use biometric scanning as a primary and you "Think" they should not be using any biometric by itself? The NSA would disagree with you on your flawed logic.

You see, security isn't perfect. Why? Because if you allow something to be exposed long enough where someone has the advantage to create the technology, that technology has the means to allow the technology to be available. How does some of the top security in the world be the best defense against what one is trying to hack? It's called being dynamic, which regularly requires change in pattern, behavior and regularities from being static. Complacency and stagnancy are the two biggest hurdles for ANY security to become exposed.

Some of the best security engineers in then world are designing other means to keep the biometric process refreshed and ever changing as we speak, because of the tools criminals have today.

Your response was arrogant, but I guess that's besides the point. What agency do you work for that would allow biometric unlocking as opposed to biometric in conjunction with passcode? I'm guessing here, but I would venture to say that if the courts ruled that a fingerprint is not protected, than neither would any of your other biometric information. Not too secure when the cops force you to open you eyes, and look into you phone to unlock it. On the other had, if biometric data was coupled with a passcode, current law prevents the authorities from forcing you to give up your passcode.

Run that by your security team in the "agency" you work for, and let me know what they say. I'm always open to being wrong, and probably more times than not, I am
[doublepost=1496064968][/doublepost]

However, more options are better. With the phone on a desk, leaning toward the phone and having it unlock is preferable to touch id. Of course, if one doesn't like this method, they can turn it off.

Preferable for security or convenience? BTW, I agree that more options are better. I am also a paranoid kind of person, so I do prefer secure methods of unlocking devices.

 

[melendezest]

Are u seriously? Contact lens and photos of eye is so easy to get.

Have u ever try to get fingerprint photos and make it into a wax? Very difficult.
[doublepost=1495741202][/doublepost]

Pin is "super" easy to acquire. If u are a target, all it takes is nice tele-zoom camera. Or simply observe u for a while. Just stay behind u while u punch your pin. Or simple guess from your movements in CCTV.

Hacking cannot get easier than that.

Pin is also least convenient way of all security measures.

In short, Pin is the worst for mobile devices
[doublepost=1495741940][/doublepost]

Totally wrong. Pin is the least safe of all. Why?
1. U have to punch your pin in public. And u have to do it very often.
2. U cannot use very long pin. Again u have to do it very often.

In that sense, Pin is "super easy" to acquire. If u are a target, all it takes is nice tele-zoom camera. Or simply observe u for a while. Just stay behind u while u punch your pin. Or simple guess from your movements in CCTV.

Hacking cannot get easier than that.

Pin is also least convenient way of all security measures.

In short, Pin is the worst for movile devices.

* if u don't believe me, try to get PIN from someone who spends a lot of time with u. I even unintentionally get the PIN while strangers opening his phone by entering his code from time to time.

All very good points, although I was referring to a Password, not a Pin.

There are inherent risks in using a mobile device in public, so if you are a target, someone WILL get into your device if they really want to.

Personally, I use the fingerprint reader/password combo, but to each his own.