Story image

Will the iPhone X's Face ID be hackable? Security expert weighs in

02 Oct 2017

The iPhone X’s facial recognition technologies have been called into question by a security consultant at global tech firm Synopsys, who claims that no facial recognition technology is ever unbeatable.

Nikola Cucakovic posted a blog titled ‘How secure is iPhone X Face ID facial recognition’, which analysed the widespread adoption of facial recognition as a means of biometric access control.

According to Cucakovic, any facial recognition technology must be able to consistently and securely identify the right person. But that technology comes with many attack vectors threat actors can use to beat the system.

While the iPhone X is not on the market yet, information about how its Face ID works has been widely circulated.

A flood illuminator can detect a face in any light conditions and the infrared camera can also take a picture. Using a projector comprised of more than 30,000 dots, the image and dot pattern are used to create a mesh in the ‘neural network’.

Every time a user looks at the device, the image is compared to the mesh. In the case of a match, the device is unlocked.

However, Cucakovic notes, Apple’s SVP of worldwide marketing Phil Schiller admitted that there is a one in a million chance that somebody else could unlock a device that it not theirs with their own face… especially if it’s your ‘evil twin’.

Apple’s Touch ID is subjected to a one-in-50,000 chance that somebody else could use their fingerprint to unlock someone else’s device – and it has been done by the Chaos Computer Club.

“While it’s not impossible to obtain someone’s fingerprint, we can say that it’s definitely more difficult than simply obtaining an image of someone’s face—especially since social media and technology are so integrated into modern-day life that photos are everywhere,” Cucakovic says in the blog.

“What Apple must therefore ensure is that even with a photograph of the victim’s face, an attacker cannot access the phone. Many facial recognition technologies released to date have been circumvented using rudimentary techniques, including printed photographs, digital photographs, animated digital photographs, and 3D models.”

While Apple claims it has worked to protect against these threats, nobody will know for sure until the device is on the market.

For enterprises ‘wishing to be at the forefront of technology’, Cucakovic believes that Apple’s Local Authentication API, which will be used for both fingerprint and facial recognition, will be easily adopted.

“However, for some organizations, there may have been a period of analysis and review concerning Touch ID before it was approved/risk-accepted for use within the enterprise (or for use in their externally visible App Store apps),” Cucakovic states.

“Those organizations may not have assessed the risks concerning facial recognition or approved the technology for enterprise use. On Day 1 when the iPhone X is released, all apps that support Touch ID will support Face ID. This means that users of corporate devices will be able to use facial recognition even if their organisations aren’t okay with that. Organizations should start to evaluate whether Face ID is appropriate for use now, ahead of the iPhone X release, to adjust their policies in time.”

Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.