Touch-what?
You know, the fingerprint sensor built into the Home button on the new iPhone 5s. It’s for unlocking the handset and buying stuff through iTunes and the App Store.
I thought the fingerprint was stored in some secure chip. How’d it get hacked?
It is, and this isn’t a hardcore technological hack so much as a good old-fashioned fake fingerprint technique. You find the iPhone owner’s print somewhere (the device itself may carry a few on its glossy surfaces), put some powder on it to make it more visible, then photograph or scan it at high resolution. Clean up the reversed image, print it at high resolution using thick ink, then use that to make a thin latex dummy, which you can put on your finger and use to unlock the iPhone.
I thought TouchID was supposed to be smarter than that.
Well it was, and I admit I’m a bit confused by what was revealed on the weekend.
A big selling point of the new generation of fingerprint readers, including that in the iPhone 5s, is that they don’t simply read the outer, dead layer of skin – instead, they use a radio frequency (RF) scanner to read a living layer of skin underneath. According to a Citeworld report, this assures the system that it’s dealing with a living finger, nixing both the old lift-a-print trick (see above) and the chop-off-some-poor-person’s-finger-to-unlock-their-phone trick.
But according to the Chaos Computer Club (CCC) and hacker Starbug, who claimed TouchID’s breakage on Sunday, “the marvels of the new technology” are less impressive than touted. Here’s what Starbug said in a statement:
“In reality, Apple’s sensor has just a higher resolution compared to the sensors so far. So we only needed to ramp up the resolution of our fake.”
If that’s correct – and it should be noted that Apple itself only talks about taking “a high-resolution image from small sections of your fingerprint from the subepidermal layers of your skin” in its online FAQ — then TouchID isn’t actually that good at making sure it’s dealing with a living finger. It appears that it can be fooled by, as Starbug describes, breathing on the latex sheet “to make it a tiny bit moist” before using it on the sensor.
I’m waiting for Apple to comment on all this, and have also asked the CCC if anyone is available to discuss the technique further.
Can we trust “Starbug”?
In the first of the two videos Starbug has published on YouTube, someone programs the iPhone with their index finger, then puts the latex sheet on another finger to unlock the device. In the second, a completely different person dons the sheet to fool the phone. It looks legit:
Starbug has been around for a while. Also, even though there’s a crowdfunded bug bounty out there for cracking TouchID, the CCC is Europe’s largest hacker organization and it has a reputation to uphold. I sincerely doubt anyone’s pranking the world on this one.
As an iPhone 5s user, should I be afraid?
Depends on the scenario you’ve got in your head. If it’s pickpocketing you’re worried about, then bear in mind that your iPhone is probably covered in your fingerprints. That said, making a fake print of the quality we’re talking about here is not trivial and it also takes a while, making it likely that the owner would just remotely wipe the device before anything can be accessed. So I guess it depends on the caliber of pickpocket, and their desire to do more than simply steal and sell the hardware.
If it’s muggers or overzealous law enforcement or border agents that you’re thinking about, then this “hack” doesn’t make a blind bit of difference. Merely having a biometric access mechanism makes it possible to grab your hand and use it to unlock the phone – much simpler than having to go through the tedious process of passcode extraction (or making fake prints).
The only real worry here relates to a more targeted attack, perhaps by a private investigator who’s after some juicy corporate secrets. If the victim’s fingerprint has already been lifted from somewhere – which any idiot with a degree of patience could achieve — and a corresponding latex sheet made, then a skilled pickpocket armed with that sheet could get very quick access indeed.
So…
So for most people this won’t be a problem. And indeed, if you’re the type who forgoes passcodes because they slow you down, it’s better to use TouchID than to use no security at all. Also, it’s not like we’re talking about someone hacking into the phone’s secure A7 chip.
But do remember that, compared with passcodes, the inclusion of biometric access can in certain circumstances make it just that little bit easier for someone to get into your phone. And if that phone carries secrets that others really want to steal, you may want to bear this new risk in mind.
Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.
- Bluetooth to Feel Blue as Personal Area Network Battles Loom
- Analyzing the wearable computing market
- Opportunities and challenges for mobile deals