iPhone X Face ID Again Unlocked With Mask, Even With 'Require Attention' Turned On

[User 6502]

But again that might not work if the Face ID was setup several weeks ago. At least, hoping so.

There is no evidence that after a few weeks the neural network will become more strict in detecting the owner of the phone; in fact, it's very likely the opposite: to adapt to small changes as beard or different glasses etc, it will probably be easier to trick it with a mask.
[doublepost=1511825587][/doublepost]

Quite obviously FaceId can be unlocked with a mask - if you set it up using a mask, instead of using your face. And that's essentially what these guys are doing. In real life, it would be quite difficult to create a 3D mask without knowledge and permission of the user. No chance to unlock the phone unless the owner of the phone unlocks it for you whenever the unlocking fails.

It's not at all what they are doing, the guy trained the phone live, and he used his face, not the mask. He also unlocked the phone with his face initially, however after that the mask unlocked the phone with no effort.

 

[mattysmith118]

False advertising?

But no seriously if someone went to make a mask of my face to unlock my phone.. I probably have worse things to worry about...

 

[BruceEBonus]

You darned pesky kids. If you hadn't rumbled me with your 3D stone-powder 3D mask-detector, Id've got away with it as well!

They don't make 3D Stone-Powder Masks like they used to, viewers!

 

[Liquid Galaxy]

Since the iPhone X launched earlier this month, people have been attempting to fool Face ID, the new biometric facial recognition feature built into the device as a primary security feature. Face ID has thus far been tricked by twins, children, and even a mask.

Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.

As described in an accompanying blog post, Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.

Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.

After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.

Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.

Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.
Apple's Face ID security white paper [PDF] outlines several scenarios where Face ID has a higher probability of being fooled, including with twins, siblings that look alike, and children under the age of 13, but masks are of particular interest because Face ID features a neural network that was "trained to spot and resist spoofing" to protect against "attempts to unlock your phone with photos or masks." From Apple:When Touch ID, Face ID's predecessor, was first released in the iPhone 5s in 2013, there were many similar demonstrations of how it could be fooled with a fake fingerprint, but there's little evidence that these methods were ever used to unlock devices in the real world on a wide scale basis, and it turned out to be something most iPhone users did not need to worry about. The same is likely true of Face ID.

Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews for its security and ease of use.

Article Link: iPhone X Face ID Again

And in other news - when you put the same amount of effort in, Touch ID can also be bypassed...

 

[timborama]

I thought it had a 1,000,000 in one shot of fooling it..

As long as none of those 1,000,000 is a family member. Face ID waaay less secure in a familial household than Touch ID. Of course Apple spins it differently.

 

[Rogifan]

So if you can reconstruct something that is so identical to the real thing, it will work? Good to know. Hopefully next year Apple will make you use your finger, your face, say a random phrase out loud all while monitoring your heart arrhythmia.

Didn’t the same thing happen when Touch ID came out? Someone was able to create a perfect fingerprint replica using all kinds of equipment the average person would never have.

 

[Baymowe335]

Who cares? Let’s see the setup process.

Any look st the lengths taken to beat it. Had to be done in a lab.

I question his process too as a lot of the details seem to be lost in translation and/or broken English.

Again, need to see setup process for context.

 

[Jbusick7944]

Has anyone else noticed that FaceID got slower in the last couple weeks? Mine was super fast at first, but seems slower now. I wonder if Apple quietly increased the sensitivity or something. It's still quick but not as quick as the first week or 2.

 

[Tech198]

I bet this could all be avoided.

Who cares? Let’s see the setup process.

Any look st the lengths taken to beat it. Had to be done in a lab.

I question his process too as a lot of the details seem to be lost in translation and/or broken English.

Again, need to see setup process for context.

Any attempt to defeat TouchID can be done in a lab as well as evidence proves that on Youtube. but u don't leave it just because only the "professionals" can do it..... its only in labs today, but how do we know there won't be alternative ways for anyone to use.

Still, it's probably not a huge deal.

 

[Will.O.Bie]

I'm little concerned this is happening more times than Apple claims it would be secure. I understand that the AI has to learn your facial features over time and would be hard to fool even with an evil twin eventually. I also understand the circumstances when this test is being done, and the videos that have been posted about this, that all the factors that can fool FaceID, but I'm not sure I'm convinced this is "more secure" than TouchID now. I hope Apple is not arrogant enough to keep telling the public that this is fool proof.

 

[rjohnstone]

I see this being useful for law enforcement.
People are photographed as part of the arrest process.
So it would be pretty easy to obtain all the facial data needed to access an iPhone X.
No need to compel a person to use their fingerprint to unlock the phone.
Snap a few pics and break out the 3D printer.

 

[BlueCreek]

Good news, next year's iPhone will have Face ID but will include a dongle for your nostril to allow you to insert a finger up your nose for ID purposes. /s

Im glad you added the sarcasm tag to the end if your post, I was wondering for a second how much this nostril dongle was going to be.

 

[sofila]

While I'm not accusing these guys of doing anything wrong, it is interesting to note that for every step made in the name of security, there is a counterpart who works to find a way to break it. As the wrong hands will have access to more and more powerful tools, The end user's security will always be more of a clash between black and white hats.

 

[Act3]

And in other news - when you put the same amount of effort in, Touch ID can also be bypassed...

Yea, just ask the FBI how much it costs to do that.

 

[Tech198]

i still believe as "secure enough: is not for everyone.... Whatever is secure enough for THEM... and for me TouchID is secure enough no matter how much u can prove its not .

All of these issues must have your phone... that's the problem is sharing.

That's not saying it shouldn't be fixed, but whatever works for you is more important, as these "issues" that can happen, i always see as secondary, because u must do something else first.

 

[jerryk]

This is an interesting issue. We all pass by multiple locations where a 3D scan of our face could be made. Imagine when you looking up at the menu at a fast food place, or looking up to read the room number of a door. A generic (i.e. not with Apple proprietary face technology, but with industry standard 3D mapping technology) 3D scan is made of your face and picture of your face taken. Feed this generic data into a 3D printer to make mask. Combine mask with eye image, and there you go.

 

[Baymowe335]

Acid test. Give these guys a locked phone that they have no other access to, and a few minutes with an independent test subject, and let's see how successful they are given just FIVE attempts before the X disables the feature and requires a pass code instead.

That’s really the most relevant scenario.

This access to the phone and passcode for weeks and then saying you “cracked” it is really ridiculous.

In the real world, you might get a stranger’s phone and you have 5 tries to get it right before lockout.

Guarantee they can’t do it under that scenario.

 

[The Game 161]

if any person spends loads and loads on a mask they would just buy the x anyway

 

[2010lexus]

Even if Face ID is able to be unlocked with a mask of Jabba the Hutt and Chewbacca, I’m still not downgrading back to the ugly and outdated iPhone 8

Hell no

Yes and the iPhone X looks a lot like a Samsung galaxy 8 only the galaxy doesn’t have the stupid notch on the top of the screen.

 

[Thai]

Didn’t the same thing happen when Touch ID came out? Someone was able to create a perfect fingerprint replica using all kinds of equipment the average person would never have.

Playdoh is not considered equipment average person would have?

Because Playdoh can be used to bypass TouchID!

 

[The Game 161]

Yes and the iPhone X looks a lot like a Samsung galaxy 8 only the galaxy doesn’t have the stupid notch on the top of the screen.

and? better to look like that than a 3 year old design with wasted space

 

[jerryk]

I see this being useful for law enforcement.
People are photographed as part of the arrest process.
So it would be pretty easy to obtain all the facial data needed to access an iPhone X.
No need to compel a person to use their fingerprint to unlock the phone.
Snap a few pics and break out the 3D printer.

Haven't they finger print people as part of their standard booking/arrest process for decades?

 

[gnasher729]

It's not at all what they are doing, the guy trained the phone live, and he used his face, not the mask. He also unlocked the phone with his face initially, however after that the mask unlocked the phone with no effort.

Without having to unlock with the passcode? I very much doubt it. It's simple.

Train the phone with your face. Try to unlock with the mask. It fails. That's where you are stuck without the help of the phone owner. Now the phone owner unlocks the phone. So the camera thinks the mask must have been the legitimate image. The camera adapts. If need, you repeat, until the phone recognises the mask easily.

You can do that, as the legitimate owner of the phone, and as someone who has the passcode. Doesn't work if you don't have the passcode. And if you have the passcode, then you can unlock the phone thousand times easier and quicker. By entering the passcode.

 

[Apple_Robert]

To me, the video is meaningless. And the more attention the video gets, the more revenue income. Thanks for helping to pad their pockets MR.

 

[Thai]

Yes and the iPhone X looks a lot like a Samsung galaxy 8 only the galaxy doesn’t have the stupid notch on the top of the screen.

S8 also has that wonderfully placed fingerprint reader....