14 ms·
Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8
- lnx01 9y agoUsing a fingerprint for security is like writing your password on everything you touch. Using your iris is like walking around with your password written on your forehead.
- lucb1e 9y ago> like writing your password on everything you touch. > with your password written on your forehead. ... in invisible ink*, I'd say. But basically yeah.
- morsch 9y ago"The by far most expensive part of the iris biometry hack was the purchase of the Galaxy S8 smartphone."
- CyberTrekker 9y agoI realize that to some it may appear as obvious, but quite often the obvious is overlooked as people respond to the hastily promoted propaganda relative to a system and become emotionally entangled in it instead of holding to reason. Having prefaced my response with the above clarification, such an outcome should be expected rather than being unexpected. There's no such thing as a totally secure and uncompromisable system. Any system can be compromised. Where there's a system, there's a way to compromise it. When all is said and done, what can reasonably be expected is a system that's as secure as it can be reasonably made and a genuine effort to patch vulnerabilities as quickly as humanly possible.
- johansch 9y agoGotta love these CCC takedowns. I find myself smiling in anticipation when clicking these kinds of links....
- alxhill 9y agoWhilst it's certainly valuable to make people aware of the limitations of the security systems we use, this shouldn't really come as a surpre. If someone is close enough and motivated enough to take a high-res photo of your face just to access your mobile device, they're also probably close enough to film you typing in your passcode - sure, you might do that less often, but for an average user are either of those things a real concern? The security model hasn't really been "broken" because if someone steals my phone they don't have access to the device by default.
- dx034 9y agoWith a 4k camera and decent light conditions that could be possible in public space. Whereas you can avoid entering your passcode in public spaces (or shield it well enough). It shows again that for people with very valuable data (where others would spend significant amounts of money to get data), passwords remain the only secure way.
- konceptz 9y agoWe should understand the attack model better and the likelihood of a successful eye capture. We know that it's certainly less hard than knowing someone's password given a semi sane password policy, but more difficult than scraping fb selfies and printing them. Thinking out loud, I certainly don't share my phone password with my eye doctor, so there's one example of disclosure.
- piyush_soni 9y ago> If someone is close enough and motivated enough to take a high-res photo of your face just to access your mobile device, they're also probably close enough to film you typing in your passcode Not sure about that. All of my friends, family and work colleagues are 'close enough' to me to take a high res photo of my face (and I'd gladly let them do it), but none of them can see my passwords when I'm typing or unlock my phone without my permission. For me this revelation is of a big concern.
- philfrasty 9y ago„But biometric authentication does not fulfill the advertised security promises“ This is completely out of context. For the average smartphone user Iris-Recognition on a phone (just like touch-ID) VS pin-disabled on the phone is a huge step forward.
- hexhex 9y agoI can obtain an image of you online, while I need to be on-site to spot you typing your pin. So if I have your phone, I can do research at home to break in. Additionally, you cannot change your iris once it's compromised. This is an absolute no-no for secure systems! Changing your pin is easy. This is definitely not a huge step forward. And, as already mentioned, the average user gets misguided by exaggerated marketing promises.
- raverbashing 9y agoA random photo on the net probably doesn't have the resolution needed for Iris recognition
- hexhex 9y agoThe CCC used an old digicam at medium distance. It is quite likely that such a photo is on FB, Instagram etc. Side note: The CCC even recovered the fingerprint of the Germany's defense minister from a photo: https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...
- raverbashing 9y agoYeah then Samsung's "iris recognition" is more like "iris blur matching"
- chinathrow 9y agoThey also used the IR mode of a digicam. That hack is not possible from existing photos only, I think.
- Kipters 9y ago> The Samsung Galaxy S8 is the first flagship smartphone with iris recognition. That's not quite true, Lumia 950, Lumia 950 XL and HP Elite x3 came out a lot earlier than the Galaxy S8 and all of them use iris recognition (still undefeated, by the way)
- skocznymroczny 9y agoThere could a bit of a bias, Lumias and HP Elite x3 aren't anywhere near as popular as Samsung Galaxy S8, same as most malware targets Windows rather than Linux/macOS.
- tbihl 9y agoBased on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't know enough about the capabilities of the S8 camera to know if that's feasible (shouldn't be that hard.) Capturing the patterns of the iris at 500, 800, and 1200nm results in three templates that are quite different from another. CCC were able to do this for about the cost of a S8. I would say this is one of the rare situations where defeating the attack would have been even cheaper. It's that simple a programming exercise.
- Asdfbla 9y agoI suppose Samsung tuned the system to avoid false negatives, which might be difficult in all the lighting conditions that might come up in real world use. It's a device for the mass market and average user after all. Might be that they did a bad job with the Iris recognition, but why not give them the benefit of the doubt and consider that they were aware of the trade-offs involved?
- dahauns 9y agoKnowingly and willingly giving users a false sense of security? How is that not worse in every way? If they couldn't manage to get false negatives down to an sensible level without compromising security in such a blatant way, there's two courses of action: Live with it, or don't release it.
- adrianN 9y agoOr release it and make money with your cool feature that competitors don't have.
- moe 9y agoSpot on. This is a marketing gimmick, not a security feature. Just as with fingerprint readers[1] the target audience is people who otherwise wouldn't lock their phone at all. [1] https://arstechnica.com/apple/2013/09/chaos-computer-club-hackers-trick-apples-touchid-security-feature/ https://arstechnica.com/apple/2013/09/chaos-computer-club-ha...
- dingo_bat 9y agoThe important thing is how much more/less difficult is this than spoofing a fingerprint. If it is significantly harder, I still see it as a win for samsung's security.
- draugadrotten 9y agoSpoofing this eye is significantly easier than spoofing a fingerprint, because modern fingerprint technology detect if a fingerprint is "alive" by looking at sweat pores, pulse, veins under the skin and other features of a living finger.
- dingo_bat 9y agoBut do phones check for all those markers?
- draugadrotten 9y agoWell, maybe. Usually flagship phones gets the best (most expensive) chips. Budget phones gets knock-offs. It depends on which fingerprint hw/sw the phone is using. There are about 4 large players in the phone fingerprint chip space that have 90 percent of the market. Fingerprinting is heavily patented so all four vendors have their pros and cons. A few dozen small players competing about 10 percent of the market. They probably don't do much of it.
- Jonnax 9y agoDo you know where I could read more about the ways fingerprint scanner detect that it's a human finger? Sounds pretty fascinating.
- draugadrotten 9y agoJust do an internet search for "fingerprint liveness detection". Google Scholar has enough reading for a night or two.
- Asdfbla 9y ago>Iris recognition may be barely sufficient to protect a phone against complete strangers unlocking it I suppose that's the attack scenario those systems (at least in phones) are supposed to protect against, to be fair. Suppose the alternative might be that some users use a predictable pin or none at all. Fingerprints or the iris sensor is an improvement for them because they are quick and easy to use. Of course it's still good to deflate the hype around Iris scanners a bit and demonstrate that it is currently a very limited technology after all. Especially considering their remark that iris scanners spread to other devices too.
- freeflight 9y ago>Fingerprints or the iris sensor is an improvement for them because they are quick and easy to use. I'm not sure about it being an improvement, human laziness always finds a way to make something less secure. Like buying "fingerprint stickers" because too lazy to pull off a glove when wanting to unlock the phone [0]. The CCC always does interesting stuff like this, a couple of years they reproduced a politicians fingerprint just using photos of her hands [1]. This kind of stuff turns biometrics from something "you are" (your fingerprint, your iris) to something "you have" (a fingerprint on a glove, a picture of an iris) making biometrics often very trivial to bypass. [0] http://gizmodo.com/these-fake-fingerprint-stickers-let-you-access-a-protec-1788710313 http://gizmodo.com/these-fake-fingerprint-stickers-let-you-a... [1] https://arstechnica.com/security/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/ https://arstechnica.com/security/2014/12/politicians-fingerp...
- josefx 9y ago> a fingerprint on a glove Fingerprints are even worse. They are all over your phone. So if someone steals it the key is already included. Fingerprints are something you leave all over the place right now and with the increased camera placement and tracking done everywhere pictures of your iris wont be much better for long. So both are not something you are or have, they are something everyone you ever passed on the street has access to.
- jlg23 9y ago
- sschueller 9y agoI am curios how much eye damage these system can cause. The S8 gives a warning before you activate it that you should not place the phone too close to your face. How bright is this infrared light and can it cause eye damage although we can't see it?
- konceptz 9y agoAnecdotally I do not notice any eye discomfort while using this n times per day. It's also not "bright" from my perspective but someone with this system would better answer the eye damage question.
- matt4077 9y agoIt's unlikely to be dangerous (see other answers), but "eye discomfort" is a bad yardstick: the retina doesn't have nociceptors and any discomfort would only be secondary, appearing long after the damage is done. See (without being seen) the few people who manage to observe each solar eclipse with binoculars.
- HappyTypist 9y agoNo, it can't. The warning is for optimal detection rates, it doesn't harm your eye.
- dmd 9y agoHave you ever been outside? It's dimmer than that.
- adrianN 9y agoA nice campfire that noticeably warms your face when you look at it probably gives off a couple orders of magnitude more IR than the phone. IR can damage eyes [1], but the phone probably won't contribute significantly [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3116568/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3116568/
- 9y ago
- algesten 9y agoBiometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.
- draugadrotten 9y ago> Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). Why complicate things with 2fa tokens. Something you have: the phone! However I agree with something you know being missing.
- algesten 9y agoSure. But perhaps it should be something you have that isn't the device you're trying to get into.
- rimliu 9y agoOne out of three is still somewhat more secure than zero out of three.
- JohnStrange 9y agoFingerprints and iris scans are not equivalent to a username or email, since the username and email can be changed easily. Proper biometric data cannot be changed, it is tied to the individual. So when the data is compromised and published in the wild and the devices can be fooled with it (which will always be possible), then the user of biometric recognition devices can become the victim of identity theft for the rest of their life.
- algesten 9y agoGood point. It's worse than email or username.
- CyberTrekker 9y ago
- 6d6b73 9y agoWait. S8 has iris recognition system and people are dumb enough to scan their eyes and give another biometric data point to god knows whom?
- ry_ry 9y agoGiven how easily they broke the iris recognition, that particular cat is likely already out of the bag.
- CyberTrekker 9y agoAs it would to varying degrees with any system, knowing humans.
- geniium 9y agoOh Samsung, nice try!
- throwaway32194 9y agoThe overzealous dum dums at https://uidai.gov.in/ https://uidai.gov.in/ should take note. Here's to hoping @ViralBShah will bring this to their notice.
- dreamcompiler 9y agoRetinal scans are somewhat more difficult to fool (it's hard to photograph a retina from a distance), but the scanners are too unwieldy to fit in phones and lay people are queasy about lasers scanning their retinas.
- madez 9y agoTo those who know german, I recommend watching the german video.
- deleted 9y ago[deleted]
- tmsldd 9y agoSir. Daugman has left the job incomplete.. there still space for research. "Liveness" checking is of course a challenge in such cheap and simplistic setups.. Anyhow, for operator-attended application scenarios it is still ok. On the other, I see biometrics as a convenience feature in physical or logical access control scenarios (As long as the security level is at least equal or higher than conventional methods).
- jupp0r 9y agoWho would want to use an authentication token that they cannot change once it's been compromised?