Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

1/31/2018
02:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Passwords: 4 Biometric Tokens and How They Can Be Beaten

Authentication security methods are getting better all the time, but they are still not infallible.

Passwords present many security concerns. Users still choose short and obvious passwords or use the same ones across all their accounts. Meanwhile, the organizations we trust to safeguard our data often suffer breaches and end up losing millions of customer credentials. All this results in an authentication standard we can't trust.

But don't fret yet! Passwords aren't the only possible factor for authentication. You can use many other factors to identify yourself, including digital certificates, hardware tokens, and biometrics. Right now, biometrics are in vogue, primarily because they're more convenient. Rather than having to remember a hundred different, long passwords, isn't it great to just push your finger against a sensor, or look at your computer or phone to log in? As you've probably noticed, this seems to be the future of authentication, with new examples like Microsoft's Hello and Apple's FaceID.

But do biometrics really solve all our authentication security problems?

I would say no. While biometrics are fairly accurate, they're not infallible. Over the years, hackers and researchers have beaten biometric solutions many times. Let's look at the top four biometric hacks from the past.

1. Gummy Bears Beat Up Fingerprint Readers
When you think biometrics, you probably think fingerprints. Fingerprint readers were one of the first forms of biometrics used in computing, and they're pretty ubiquitous today. However, they were also one of the first biometrics that researchers figured out how to defeat on the cheap.

In 2002, a researcher named Tsutomu Matsumoto shared how to defeat fingerprint readers with plain old gummy bears. Matsumoto pulled prints from a glass using the same techniques as law enforcement, and then used the prints to make a finger out of the gummy materials. With a little work, many of these crafty creations tricked the fingerprint sensors.

Of course, over time biometrics have become more advanced. Modern sensors read at higher resolutions or look for new factors such as heat or heartbeat. However, the techniques researchers use to defeat them have also evolved. In 2013, the Chaos Computer Club defeated the iPhone's TouchID reader shortly after its release. Even more recently, researchers hacked fingerprint readers with paper and glue.

While I love that fingerprint readers have made accessing our smartphones easier, we can't totally trust them yet.

2. Faking Out Iris Scanners
We've all seen fancy iris scanners in the movies, but these eye-based biometrics don't just exist in fiction.

Unfortunately, they're no more foolproof than fingerprint readers. In 2012, researchers shared how they could bypass iris readers with replica images of irises. The most interesting aspect of this research was how they replicated the fake irises based on the iris data stored in the biometric system's database. In the same way that password database leaks result in hacked passwords, an iris database breach could result in fooled eye scanners.

3. Paper Faces Fool Facial Scanners
The latest hot trend in biometrics is facial scanning. With features like Microsoft's Hello, you can unlock your computer or phone by looking at it. This sounds like a usability dream, but it's still trivial to beat.

Back in 2011, a blogger and researcher quickly learned that you could easily fool Android facial scanners with a still picture. You take a still picture of yourself, show it to the phone, and voila, you're in. To vendors' credit, they updated their facial scanner technology to perform "liveness" checks, looking for some sort of motion to make sure the face looking at the camera was a real person. Unfortunately, a Photoshopped blink could bypass that new check. Just by editing your eyes closed and then switching between two still photos, you could get past those early liveness checks. The good news is that facial recognition is still evolving.

4. 3-D Printers Crack 3-D Facial Scanners
In 2017, Apple released a new facial scanning feature called FaceID. On the surface, the user's experience is like any other facial reader. However, underneath the phone's glass is technology that should make facial recognition much more accurate and hard to beat. Essentially, the phone includes a sensor (TrueDepth) that sends out thousands of infrared beams of light, which accurately map your face. This allows the phone to store a kind of 3-D digital representation of your face, which it can recognize from many angles. Apple reinforces this feature with machine learning, which can recognize you even when you wear hats, glasses, or other accessories that might confuse classic facial scanners.

All this should make facial biometrics pretty bulletproof, and it does make it stronger. However, about a week after Apple released FaceID, a Vietnamese security group claimed to have cracked it. The hack required a 3-D printer, 2-D infrared images of eyes, stone powder, and lots of handcrafting to create a mask that could fool FaceID. To be fair, no other research group (to my knowledge) has independently verified this attack yet.

I suspect we might see updates that make it harder to fool, but so far both 2-D and 3-D facial scanning are not perfect.

It may seem I'm painting a bleak picture for the future of biometrics, but that's not true. Biometric vendors are learning from these mistakes and will add new features that make their systems more robust. Meanwhile, new biometrics options continue to emerge, such as heartbeat, typing cadence, and even brain waves.

History has shown us that motivated attackers can find a way to copy, steal, or bypass the factors they need. If we rely on biometrics alone, we'll likely suffer the same types of issues passwords have experienced. Only now, when a hacker replicates your fingerprint or face, you can no longer use it for authentication.

Biometrics will play an important role in the future of authentication. However, no authentication token is infallible. Rather than depending entirely on some new form of advanced biometrics, the safest course of action is to implement multifactor authentication — using more than one factor — for anything you want to secure.

Related Content:

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Google Lets iPhone Users Turn Device into Security Key
Kelly Sheridan, Staff Editor, Dark Reading,  1/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5647
PUBLISHED: 2020-01-22
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue af...
CVE-2011-3612
PUBLISHED: 2020-01-22
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
CVE-2011-3613
PUBLISHED: 2020-01-22
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
CVE-2011-3614
PUBLISHED: 2020-01-22
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
CVE-2011-3621
PUBLISHED: 2020-01-22
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.