Sign in / up

back to article How good are selfies these days? Good enough to fool Samsung Galaxy S8 biometrics

Chaos Computer Club's "Starbug" has taken a look at the Samsung Galaxy S8's iris-scanning authentication feature and found you can beat it with a photograph. The tools the group used aren't even remotely sophisticated: a camera in night mode, a contact lens, and a printer. To fool the sensor, supplied to Samsung by Princeton …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *

Page:

  1. Anonymous Coward
    Anonymous Coward

    The current UNsecurity situation is a farce

    Another day another vulnerability 'that was considered impossible'... We need the 'Monty-Python' boys back to highlight the insanity of the path we're treading and bring realization to a deaf 'Tech Industry' and dumb 'Political / Regulatory' structure:

    "To fool the sensor, supplied to Samsung by Princeton Identity, the “attacker” took a photo of the subject from a few metres' distance, printed it out, and dropped the contact lens over the iris to imitate the curvature of an eye (note: the CCC video doesn't mention this, but you'd have to get the printout aspect right, so as to make the iris the same size as the contact lens). When that image was presented to the camera, it unlocked, right on cue."

    3 0 Reply
    1. John Brown (no body) Silver badge
      Reply Icon

      Re: The current UNsecurity situation is a farce

      "Another day another vulnerability 'that was considered impossible'... We need the 'Monty-Python' boys back to highlight the insanity of the path we're treading and bring realization to a deaf 'Tech Industry' and dumb 'Political / Regulatory' structure:"

      Biometrics are for usernames only, and even that's a security risk. If you can't change it at will, it's not a password.

      7 0 Reply
  2. Flocke Kroes Silver badge

    Best feature of the sensor

    Thieves do not have to steal your eyes to authenticate.

    13 0 Reply
    1. Christian Berger
      Reply Icon

      Re: Best feature of the sensor

      Thieves are stupid, they probably still will steal your eyes. Yet another problem of biometry.

      7 0 Reply
      1. allthecoolshortnamesweretaken
        Reply Icon

        Re: Best feature of the sensor

        Eyes grow back, right? Right?

        7 0 Reply
        1. Eddy Ito
          Reply Icon

          Re: Best feature of the sensor

          Yes, yes they do but only if you're a salamander.

          2 0 Reply
          1. Chemical Bob
            Reply Icon

            Re: Best feature of the sensor

            Oh, I'm good then...

            2 0 Reply
  3. Charles 9

    But what if you have a terrible memory and can't remember a PIN. And yes, I know plenty of people with memories that bad, which is why they can only go to brick-and-mortar branches and use cards that don't require PINs.

    2 9 Reply
    1. Charlie Clark Silver badge
      Reply Icon

      Patterns are pretty good for basic security and passphrased-based mnemonics can be used in a keychain for authorisations. But not using your phone for financial stuff is advisable anyway.

      5 0 Reply
      1. Charles 9
        Reply Icon

        Not so good for palsied or arthritic hands. As for avoiding the phone, what if the bank is branchless?

        4 3 Reply
        1. allthecoolshortnamesweretaken
          Reply Icon

          "... what if the bank is branchless?"

          Then it can't be "my" bank.

          (Yes, I know, not an option for everybody. But if it is an option for you, vote with your feet.)

          2 0 Reply
        2. CrazyOldCatMan Silver badge
          Reply Icon

          Not so good for palsied or arthritic hands

          Arthritis doesn't stop you using one finger to tap in a PIN. I know this both from personal experience[1] and from my elderly mother..

          [1] OK - mine's 'only' psoriatic arthritis but it sure hurts like the traditional kind.

          2 0 Reply
          1. Charles 9
            Reply Icon

            But you have to MOVE the finger to do a pattern match, which you'd probably need if your memory is too poor to remember a PIN (and note that since I'm talking arthritis, this usually means the elderly whose memory is failing).

            1 0 Reply
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      "And yes, I know plenty of people with memories that bad, which is why they can only go to brick-and-mortar branches and use cards that don't require PINs."

      If I draw money over the counter at my Barclays branch - the teller always passes me a PinSentry device and expects me to use my ATM card and pin code to authorise the transaction.

      2 0 Reply
    3. turnip handler
      Reply Icon

      Using biometrics requires you also set up a PIN which is used to unlock the phone for the first time after the phone is restarted, to perform certain setting changes and as a back up to the biometrics.

      2 0 Reply
  4. A Non e-mouse Silver badge

    Three pillars of identity

    This (and all the other form of biometric & password hacks) is why security should be made of three things:

    - Something you know (a passswod)

    - Something you have (a piece of hardware)

    - Something you are (Biometrics)

    Any one on its own is not strong enough.

    2 0 Reply
    1. Christian Berger
      Reply Icon

      Re: Three pillars of identity

      Actually that "Something you are" part is very bad, as in reality you want to give up your security in certain situations, i.e. when you face actual danger to yourself. It's much easier to give someone your password than having your finger cut off, or your eye removed. Stupid attackers may do that.

      To any smart attacker, Biometrics is not a hurdle at all, particually the stupid things like scanning irises.

      16 0 Reply
    2. Charles 9
      Reply Icon

      Re: Three pillars of identity

      So what happens when you have a terrible memory (meaning there's little you know) and you tend to travel with little and keep losing things (meaning there's little you have) and you STILL need a strong identity?

      2 6 Reply
      1. G2
        Reply Icon

        Re: Three pillars of identity

        quote:

        So what happens when you have a terrible memory (meaning there's little you know) and you tend to travel with little and keep losing things (meaning there's little you have) and you STILL need a strong identity?

        /quote

        solution: NFC / RFID chip implanted under your skin.

        Humans do this regularly to pets these days and from this point of view a pet has better 2-factor authentication than a human. (biometrics + chip ID)

        6 1 Reply
        1. Mage Silver badge
          Reply Icon

          Re: RFID

          Never invented for security but tracking palettes etc instead of barcodes which are not convenient. The non--contact nature of RFID makes them inherently insecure.

          Criminal also can use a scanner and cut it out. I'd rather have a physical "electronic" key / card / dongle.

          The contactless debit and credit cards are already a disaster.

          A pet's RFID is NOTHING to do with security.

          4 0 Reply
          1. G2
            Reply Icon

            Re: RFID

            quote:

            A pet's RFID is NOTHING to do with security.

            /quote.

            you're thinking of old-school RFID that only provides a serial number ... think instead of NFC and U2F / OpenPGP / PIV over NFC

            https://www.yubico.com/products/yubikey-hardware/yubikey-neo/

            https://fidoalliance.org/fido-alliance-equips-u2f-for-mobile-and-wireless-applications/

            2 1 Reply
        2. CrazyOldCatMan Silver badge
          Reply Icon

          Re: Three pillars of identity

          from this point of view a pet has better 2-factor authentication than a human. (biometrics + chip ID)

          Cool. I have 7 2FA devices running[1] around at home then! Now - how to carry one of the semi-feral ex-farm cats with me to the bank?

          [1] 6 of them cats. The only time some of them are seen to run is in the general direction of their food bowl..

          3 0 Reply
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        ... and you STILL need a strong identity

        Well, I wouldn't hire you for any job that require a strong identity - such a person would be unfit for the role, sorry.

        If it's your personal need, you made your bed, lie in it.

        5 2 Reply
        1. Charles 9
          Reply Icon

          Re: ... and you STILL need a strong identity

          "Well, I wouldn't hire you for any job that require a strong identity - such a person would be unfit for the role, sorry."

          So basically it's, "Game Over. You Lose. Better Luck Next Life." How Spartan...

          Ever considered the person doesn't have to work...because he or she is retired? Old people still need to be able to access their accounts and so on, and if the last local branch closes...

          5 3 Reply
      3. hplasm
        Reply Icon
        Facepalm

        Re: Three pillars of identity

        "So what happens when ..."

        You've probably forgotten where you left your phone already. No problem.

        8 0 Reply
    3. Mage Silver badge
      Reply Icon

      Re: Three pillars of identity

      No, just forget biometrics. I said from the start it was just a Hollywood trope and doomed.

      Anything that can't be changed is no use for security.

      Also people believe computers, so you only have to hack in a desired biometric. It's worse than a password or dongle BECAUSE the real person can't easily change it without fake skin or contact lenses etc.

      11 0 Reply
    4. CrazyOldCatMan Silver badge
      Reply Icon

      Re: Three pillars of identity

      - Something you have (a piece of hardware)

      - Something you are (Biometrics)

      Those two are (mostly[1]) functionally identical.

      [1] Yes, yes - I know you can't change your fingerprints[2] like you can a 2FA device..

      [2] If you have them. EldestBrother (being a chainsaw wielding manual-working tree monkey) doesn't really have any..

      2 0 Reply
  5. Anonymous Coward
    Anonymous Coward

    If does not matter

    Samsung is not Apple so it will be forgotten in the same time if take for a Daily Mail headline to decay.

    Unsure?

    How many times to Apple haters trot out 'you are holding it wrong' a year?

    You can make your own mind up but I get the feeling that this is a bit of tech that Samsung has rushed out in order to beat Cupertino to the market.

    I won't touch Samsung branded kit with a bargepole. The stack of dead Samsung HDD's in my office is my reason for the boycott.

    2 7 Reply
    1. Richard 12 Silver badge
      Reply Icon

      Re: If does not matter

      Nah, everyone was expecting this as all the camera-based unlock are pretty awful.

      They kind of have to be because of their speed and user intolerance of false negatives.

      I assume someone has broken the face recognition as well.

      5 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: If does not matter

        Samsung's facial recognition was broken immediately - just hold up a phone with a picture of the face to unlock it! The iris scan was hoped to be the more secure option.

        Some rumors claim Apple will be doing facial recognition using 3D scans of the face for the iPhone 8, which would prevent the "hold up a photo" attack, but such 3D scans can't be made too precise - if they are then if allergies made your eyes swell up a bit you couldn't unlock your phone. So while it would be more secure it won't be a panacea against all methods of attack, only raise the bar.

        2 0 Reply
    2. Mage Silver badge
      Reply Icon
      FAIL

      Re: Dead Disks

      Anecdotal.

      We had 80 Segates fail in one day. Assembly area too cold, in days when you did low level formatting.

      Then half the disks in two classrooms of new computers we installed (I forget why?)

      Another period it was Quantum disks.

      Then all those Western Digital 0.5T and 1T SATA drives, loads. Was it a firmware bug?

      I've one faulty Samsung 1T drive, "dumped" yesterday.

      Replacing HDDs since 1983. All anecdotal. You need a BIG sample. You need to know if moved about, in smoker's atmosphere, weather, power cuts, storms, temperature of PC etc.

      9 1 Reply
    3. Adam JC
      Reply Icon

      Re: If does not matter

      You do realise Seagate bought Samsung's hard-drive biz back in 2011 for $1.4b right...?

      2 0 Reply
      1. allthecoolshortnamesweretaken
        Reply Icon

        Re: If does not matter

        Seagate. Oder sie geht nicht.

        1 0 Reply
  6. Christian Berger

    Obviously they had fun with it...

    ... as there also is a version of the video with commentary in the style of a popular children's show in Germany:

    https://media.ccc.de/v/biometrie-s8-iris-fun

    2 0 Reply
    1. allthecoolshortnamesweretaken
      Reply Icon
      Pint

      Re: Obviously they had fun with it...

      "The tools the group used aren't even remotely sophisticated: a camera in night mode, a contact lens, and a printer."

      The sophisticated bit is their minds.

      Which are sharp and alert because they all grew up watching Die Sendung mit der Maus. (Link links to english Jimbopedia entry, check it out). The pint is for Armin Maiwald.

      2 0 Reply
  7. The Original Steve

    Windows Hello

    My understanding is that Microsoft's "Windows Hello" (what a crap name) does a combo of iris and facial recognition. The phones suck as they can only do iris recognition so I'd imagine have the same problems as reported in this article, however the version used on their Surface range is not only significantly faster and more accurate than their mobile efforts, I don't believe it's been tricked / hacked / spoofed yet into unlocking a device without the owner being present.

    I believe that the PC version of Windows Hello builds a 3D model of your face which it uses along with an iris scan. Due to the width restrictions of modern phones it's not possible to have an array of three cameras (one infrared plus two for the 3D face scan) thus crap on phones but excellent on laptops.

    Personally I'm sticking to a 6 digit PIN on my phone and Windows Hello on my Surface.

    1 0 Reply
  8. Charlie Clark Silver badge

    Biometrics are fundamentally flawed

    But there's a big business in making them seem okay: governments love them because they add to the security theatre while allowing them to fire expensive meatware, which is easier to trick but harder to deceive.

    As the Veneer of Democracy Starts to Fade…

    5 1 Reply
  9. 's water music

    phew

    So glad to hear someone else has cracked this and I can stop poking myself in the eye with gummy bears to make an imprint. It's been costing me a bomb in in optrex

    15 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: phew

      Thank you for that. You actually made me laugh out loud.

      2 0 Reply
    2. handleoclast
      Reply Icon
      Coat

      Re: phew

      You're doing it all wrong.

      To unlock somebody else's phone you need to poke the gummy bear in the other person's eye, not your eye.

      HTH

      8 0 Reply
    3. CrazyOldCatMan Silver badge
      Reply Icon

      Re: phew

      So glad to hear someone else has cracked this

      Some decades ago (when I was young and dinosaurs lived in data centres) the Nationwide Building Society had an iris recognition trial so see if it could be used to access bank accounts. They spent quite a bit of money on the trial with the (then) state of the art optics and computing.

      About half-way through the trial is was withdrawn and never mentioned again.

      2 0 Reply
  10. DrXym

    Hardly a big deal

    Unless the thief happens to have a picture of you in the proper light and knows this is how you unlock the phone then it's not going to help them. And theft is the biggest threat by far.

    I think the biggest problem with phones & security is one of usability and defaults. Some phones have "smart lock" functionality but it's very finnicky to set up and separate from the screen lock stuff.

    It needs to be redesigned and consolidated into a single screen that summarises what security is set, and the conditions that the rules apply. e.g. idle time, location, proximity to other devices. The easier it is to set up the security, the more likely people are to use it. The more people who have security enabled by default, the less reason thieves will have to steal phones.

    4 2 Reply
    1. Just Enough
      Reply Icon

      Re: Hardly a big deal

      It is possible to have your phone stolen by someone you know.

      It is possible to have your phone stolen by someone who uses some ruse to obtain a photo first.

      It is possible that the information on your phone has a distinct, unique value that will tempt criminals to go to the lengths necessary.

      Yes, for most people the chances of these things happening are smaller than your everyday mugger. But the point of testing things in this manner is they demonstrate how it can be done. It therefore follows that, guaranteed, some criminals will perfect a way of doing it in a practical manner in real life. So the fact remains that this method of securing devices is fundamentally flawed. As long as you make your 'key' something that is in public view, and can be copied with increasing ease, accuracy and fidelity, then your 'key' is not secure.

      7 1 Reply
      1. DrXym
        Reply Icon

        Re: Hardly a big deal

        Yes it's possible all those things could happen AND you have iris enabled (don't forget that) AND you're prepared to put up with how crap the function works. Now think on the likelihood of all that actually happening in real life as opposed to some thought experiment and it's very slight.

        If security researchers want to improve security they should stop doing these silly experiments on esoteric features and an improbable chain of events and think of ways a phone can be made more secure by default. Not such a headline grabber but vastly more useful.

        2 1 Reply
        1. Charles 9
          Reply Icon

          Re: Hardly a big deal

          The trouble with edge cases is that they don't REMAIN edge cases for long. Think STALKERS...

          2 0 Reply
  11. Michael H.F. Wilkinson Silver badge

    Iris scans can be done properly

    There are a few tests that can be done to distinguish a print from a real, live iris:

    Fourier analysis of the image, if taken at sufficient resolution, will show frequencies corresponding to the raster of the printer. Simply check the Fourier power spectrum for such regular spikes. This does not work on old-fashioned analog photography and printing, as the grains in the emulsion are placed randomly.

    The second test is to capture two images: one at a low illumination and one in brighter light. The pupil should contract, if it is a real, pupil attached in the usual way to a living brain. This is similar to proper fingerprint scanners which should incorporate IR Doppler to detect flowing blood under the skin.

    In case of high security applications, these tests must be done, and also make stealing someone's eyes useless. Infra-red imaging is essential to get the iris patterns clearly. In smartphones they probably did some cost cutting, resulting in poor security.

    4 1 Reply
    1. Yet Another Anonymous coward Silver badge
      Reply Icon

      Re: Iris scans can be done properly

      So you are proposing a system that can recognise specific irises?

      The samsung one just seems to recognise that it is an iris !

      This could also work with passwords - rather than just have the computer recognise that you entered some sort of random collection of letters that was probably a password

      2 0 Reply
    2. Charles 9
      Reply Icon

      Re: Iris scans can be done properly

      "This is similar to proper fingerprint scanners which should incorporate IR Doppler to detect flowing blood under the skin."

      Does that also defeat the gummy fingerprint on top of someone else's finger which would have live blood flow and everything?

      4 0 Reply
  12. Mage Silver badge

    Other Options

    My phone is setup for Border Control.

    Only PAYG, so if stolen, no big bill.

    Four years old, and not an Apple, so not a huge target

    Only used for note taking, photos, FM Radio, SMS and phone calls. Nothing important kept on it.

    No PIN or lock, to allow instant calls.

    I appreciate it's a special use case ^_^ and not much help for most people. I only take my real laptop to known "secure" places, otherwise I take a semi-disposable small netbook (Linux Mint + LXDE).

    4 0 Reply
    1. Charles 9
      Reply Icon

      Re: Other Options

      So what if they take your phone and then use it to make incriminating phone calls or texts in your name?

      2 0 Reply

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon