4 ms·

Point a similar device at someone's face. Now you have their facial structure. You can open up their iPhone, desolder the FaceID hardware, and feed the leads ca

Point a similar device at someone's face. Now you have their facial structure. You can open up their iPhone, desolder the FaceID hardware, and feed the leads captured inputs. Boom, phone unlocked. Even if they have some defense against that, you can just 3D print the person's face in a few hours and be done. Easy to write the data down in a less secure database somewhere, too. This is trivial to do if the person is in custody. You could also profile a specific target and get their face walking past them on the street. You could do this in bulk in a public place. Now your face is compromised and the person who stole it likely posesses your phone and is unlocking it now. You can't change your face, but it's too late anyway. You live in an oppressive regime, they found out you're gay from what they found in your phone, and you're going to be hanged in a week.

MBCook 9y ago
Ignoring the rediculous level of technical sophistication needed... You can’t ‘get their face’ if they’re ‘walking by’, you have to go through the whole enrollment. How are you going to trick them into that? Also even if they go through some Herculean process to get your ‘face hash’ Apple could simply change the hash algorithm and reset it. For all we know different phones will use a different per-device random seed in the algorithm and that attack wouldn’t work at all even if the algorithm isn’t changed. Again, you’re talking about getting a fully accurate 3D model of someone’s face that passes the FaceID tests and can be used to trick the attention sensors. That’s an INSANE level of effort for Joe random. This is not a realistic attack, and FaceID is not designed to secure anyone at any time from any government with unlimited funds and resources. It’s designed to be better than the trivial passcodes that almost no one used.
eeeeeeeeeeeee 9y ago
Actually, no. When you first power on an iPhone, you need the passphrase, not the FaceID. So swapping hardware does you no good unless you also have the passphrase/passcode. Either way, let's say this attack you're talking about is possible. What % of people that buy this phone are actually going to be at risk of someone taking their phone apart to compromise them in this way? This method you explained is in no way "trivial." If you're Edward Snowden, don't use this feature. Simple as that. But I wouldn't use TouchID if I was Snowden either. Judging by your last paragraph, though, I'm guessing you're trolling. Have a nice day.
- Sir_Cmpwn 9y ago
  >Actually, no. When you first power on an iPhone, you need the passphrase, not the FaceID. So swapping hardware does you no good unless you also have the passphrase/passcode. You don't need to shut off the phone to get into the hardware. >What % of people that buy this phone are actually going to be at risk of someone taking their phone apart to compromise them in this way? This method you explained is in no way "trivial." On the other hand, I bet a company could easily implement such an attack on the cheap and sell it to LE, who would just pass the costs on to the defendant. >Judging by your last paragraph, though, I'm guessing you're trolling. Have a nice day. I'm setting the stakes. If you're not up for the discussion that's up to you.
  - mikewhy 9y ago
    > You don't need to shut off the phone to get into the hardware. I'm genuinely curious if this has been done before and if you can provide examples.
    - Sir_Cmpwn 9y ago
      I don't have anything handy, I'm afraid, but the idea is sound from an electronics perspective. Definitely raises the implementation cost of this attack, though.
  - Fnoord 9y ago
    > You don't need to shut off the phone to get into the hardware. Do you mean row hammer [1] or cold boot attack [2]? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
    - Sir_Cmpwn 9y ago
      Uh, neither? I don't think you understand the problem.
jsjohnst 9y ago
Reading the linked PDF: > To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. and > An additional neural network that’s trained to spot and resist spoofing defends against attempts to unlock your phone with photos or masks. It's effectiveness is yet to be seen, but the implementation details counter all the points you made.
- Sir_Cmpwn 9y ago
  I just honestly don't believe it could be effective. The randomized pattern could be detected with an infared camera, and neural nets are easily fooled.
  - URSpider94 9y ago
    If it’s anything like TouchID, the sensor authenticates itself to the secure enclave with a unique private key burned into ROM. Any data not signed by this key (possibly even countersigned with a real-time code from the secure enclave to prevent replay attacks) will be rejected. Just ask anyone who replaced their home button on an iPhone with TouchID.
Fnoord 9y ago
TouchID can be easily tricked. From december of 2014 at CCC: [1] Its not merely secret service who can do this. Criminals can do it as well. The easy part of it? Your fingerprint is left all over your device. Including likely the one you authenticate with. If its your index finger of your primary hand, its bingo. A fake 2G cell tower costs 250 EUR on the black market. That's also a bad way to use TOTP. However, 15 years ago those devices were either not sold or still very expensive. That's a different threat model. FaceID is going to be hacked eventually (the question is when, not if), perhaps in the way you described. Until then it is reasonably good to keep criminals who steal your device at bay. Its also worth it to audit it (try to break it, e.g. in the way you described). State agencies, unlikely to keep those at bay with FaceID, given they can force you to authenticate. Criminals who mug you by force may also be able to force you to remove FaceID, but they may also compel you to give away your PIN. Government has already made devices to bruteforce PINs; we should've swapped to passwords ages ago. [1] https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272...
- willstrafach 9y ago
  > TouchID can be easily tricked. From december of 2014 at CCC: [1] While I am sure it is not impossible, nobody has been able to provably "trick" the current-generation Touch ID sensor. Only demonstrated on the first revision (found in the iPhone 5s, and possibly the iPhone 6 too).
URSpider94 9y ago
First of all, it’s pretty clear from the whitepaper that the sensor and the Secure Enclave speak over an encrypted channel - you’re not going to be able to inject valid data. Second, the point of using an IR image (in addition to the depth image) is that a simple 3D print is not going to provide valid spoofing - it will not match the IR absorption profile of a live face. Additionally, they are also likely testing for liveness by looking for changes from image to image, even if it’s just saccades of the eyes. Third, Apple implies that they are taking a sequence of images. They can, for example, look for changes in IR images associated with blood flow correlated with your heartbeat, which prove you are alive and may be distinguishing from individual to individual. The secure enclave could also request specific changes in the images that can’t be predicted in advance, thus foiling attempts at feeding in canned images. In short, I don’t think it’s anywhere near as simple as you propose.

MBCook 9y ago

Ignoring the rediculous level of technical sophistication needed... You can’t ‘get their face’ if they’re ‘walking by’, you have to go through the whole enrollment. How are you going to trick them into that? Also even if they go through some Herculean process to get your ‘face hash’ Apple could simply change the hash algorithm and reset it. For all we know different phones will use a different per-device random seed in the algorithm and that attack wouldn’t work at all even if the algorithm isn’t changed. Again, you’re talking about getting a fully accurate 3D model of someone’s face that passes the FaceID tests and can be used to trick the attention sensors. That’s an INSANE level of effort for Joe random. This is not a realistic attack, and FaceID is not designed to secure anyone at any time from any government with unlimited funds and resources. It’s designed to be better than the trivial passcodes that almost no one used.

eeeeeeeeeeeee 9y ago

Actually, no. When you first power on an iPhone, you need the passphrase, not the FaceID. So swapping hardware does you no good unless you also have the passphrase/passcode. Either way, let's say this attack you're talking about is possible. What % of people that buy this phone are actually going to be at risk of someone taking their phone apart to compromise them in this way? This method you explained is in no way "trivial." If you're Edward Snowden, don't use this feature. Simple as that. But I wouldn't use TouchID if I was Snowden either. Judging by your last paragraph, though, I'm guessing you're trolling. Have a nice day.

Sir_Cmpwn 9y ago
>Actually, no. When you first power on an iPhone, you need the passphrase, not the FaceID. So swapping hardware does you no good unless you also have the passphrase/passcode. You don't need to shut off the phone to get into the hardware. >What % of people that buy this phone are actually going to be at risk of someone taking their phone apart to compromise them in this way? This method you explained is in no way "trivial." On the other hand, I bet a company could easily implement such an attack on the cheap and sell it to LE, who would just pass the costs on to the defendant. >Judging by your last paragraph, though, I'm guessing you're trolling. Have a nice day. I'm setting the stakes. If you're not up for the discussion that's up to you.
- mikewhy 9y ago
  > You don't need to shut off the phone to get into the hardware. I'm genuinely curious if this has been done before and if you can provide examples.
  - Sir_Cmpwn 9y ago
    I don't have anything handy, I'm afraid, but the idea is sound from an electronics perspective. Definitely raises the implementation cost of this attack, though.
- Fnoord 9y ago
  > You don't need to shut off the phone to get into the hardware. Do you mean row hammer [1] or cold boot attack [2]? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack
  - Sir_Cmpwn 9y ago
    Uh, neither? I don't think you understand the problem.

jsjohnst 9y ago

Reading the linked PDF: > To counter both digital and physical spoofs, the TrueDepth camera randomizes the sequence of 2D images and depth map captures, and projects a device-specific random pattern. and > An additional neural network that’s trained to spot and resist spoofing defends against attempts to unlock your phone with photos or masks. It's effectiveness is yet to be seen, but the implementation details counter all the points you made.

Sir_Cmpwn 9y ago
I just honestly don't believe it could be effective. The randomized pattern could be detected with an infared camera, and neural nets are easily fooled.
- URSpider94 9y ago
  If it’s anything like TouchID, the sensor authenticates itself to the secure enclave with a unique private key burned into ROM. Any data not signed by this key (possibly even countersigned with a real-time code from the secure enclave to prevent replay attacks) will be rejected. Just ask anyone who replaced their home button on an iPhone with TouchID.

Fnoord 9y ago

TouchID can be easily tricked. From december of 2014 at CCC: [1] Its not merely secret service who can do this. Criminals can do it as well. The easy part of it? Your fingerprint is left all over your device. Including likely the one you authenticate with. If its your index finger of your primary hand, its bingo. A fake 2G cell tower costs 250 EUR on the black market. That's also a bad way to use TOTP. However, 15 years ago those devices were either not sold or still very expensive. That's a different threat model. FaceID is going to be hacked eventually (the question is when, not if), perhaps in the way you described. Until then it is reasonably good to keep criminals who steal your device at bay. Its also worth it to audit it (try to break it, e.g. in the way you described). State agencies, unlikely to keep those at bay with FaceID, given they can force you to authenticate. Criminals who mug you by force may also be able to force you to remove FaceID, but they may also compel you to give away your PIN. Government has already made devices to bruteforce PINs; we should've swapped to passwords ages ago. [1] https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272...

willstrafach 9y ago
> TouchID can be easily tricked. From december of 2014 at CCC: [1] While I am sure it is not impossible, nobody has been able to provably "trick" the current-generation Touch ID sensor. Only demonstrated on the first revision (found in the iPhone 5s, and possibly the iPhone 6 too).

URSpider94 9y ago

First of all, it’s pretty clear from the whitepaper that the sensor and the Secure Enclave speak over an encrypted channel - you’re not going to be able to inject valid data. Second, the point of using an IR image (in addition to the depth image) is that a simple 3D print is not going to provide valid spoofing - it will not match the IR absorption profile of a live face. Additionally, they are also likely testing for liveness by looking for changes from image to image, even if it’s just saccades of the eyes. Third, Apple implies that they are taking a sequence of images. They can, for example, look for changes in IR images associated with blood flow correlated with your heartbeat, which prove you are alive and may be distinguishing from individual to individual. The secure enclave could also request specific changes in the images that can’t be predicted in advance, thus foiling attempts at feeding in canned images. In short, I don’t think it’s anywhere near as simple as you propose.