Hackers found a way to trick the iPhone X's Face ID security system
The iPhone X is just over a week old, but hackers have already found a way to hoodwink Apple's Face ID security system .
Like the Touch ID fingerprint reader on previous versions of the iPhone, Face ID is used to verify the identity of the user. It uses the iPhone X's "TrueDepth" selfie camera to scan your face, and compare it with a 3D image stored on the phone.
However, Vietnamese security firm Bkav claims to have found a way to trick Face ID into unlocking the iPhone X , even when the user isn't present.
The trick involves creating a 3D-printed mask of the user's face - complete with a silicone nose and 2D images of their eyes and mouth.
"The mask is crafted by combining 3D printing with makeup and 2D images, besides some special processing on the cheeks and around the face, where there are large skin areas," said Ngo Tuan Anh, Bkav's vice president of cyber security.
In a video posted on YouTube, Bkav demonstrated that the mask - which cost $150 (£115) to make - was able to successfully unlock an iPhone X using Face ID.
While hackers creating a 3D-printed mask specifically to break into your iPhone may sound a little far-fetched, Apple does specifically state that Face ID is designed to protect against spoofing by masks.
"They [Apple engineering teams] have even gone and worked with professional mask makers and makeup artists in Hollywood to protect against these attempts to beat Face ID," said Apple's Senior Vice President Phil Schiller at the iPhone X launch event in September.
"These are actual masks used by the engineering team to train the neural network to protect against them in Face ID. It's incredible!"
Similar attempts to trick the iPhone X's security system - using masks made of silicone, gelatin, vinyl, plaster and plastic - have all failed.
Bvac hasn't released full details of how its mask works, but said it was able to trick Apple's Face ID because "we understand how AI of Face ID works and how to bypass it".
It added that the people most likely to be targeted by this kind of attack are billionaires, leaders of major corporations, nation leaders and FBI agents, rather than regular users.
Commenting on the news, Mark James, security specialist at ESET, emphasised that biometric authentication features like Touch ID and Face ID are included for ease, not added security.
"Both of these features can and have been duped by technology - the question you need to ask yourself is 'does this feature make my life easier?'" he said.
"If you're a high profile celebrity or government official, then you may need to ask yourself how much effort someone would go to, in trying to replicate your fingerprint or face.
"Any security feature has the chance of being replicated or 'hacked' - but it often takes time, effort, and a fair bit of money and/or expertise to do so."
Post a Comment