Apple's Touch ID already bypassed with established 'fake finger' technique

145791017

Comments

  • Reply 121 of 330
    jdwjdw Posts: 1,417member
    I simply don't understand how this can be possible if one takes Apple's "sub-epidermal" statement at face value. Watch the following video on Apple's site, starting at 1:20...

    http://www.apple.com/iphone-5s/videos/#video-touch

    The way I understood it when presented at the keynote was that it reads the print on the surface of the skin as well as penetrating deeper into the skin to ensure the print could not be faked.

    I don't write this to attack Apple. I write this to know if any of you can explain in technical detail how Apple's sensor reads sub-epidermal details of one's finger.

    Or could this be a bug that prevents the sub-epidermal scan from taking place?

    Thanks.
  • Reply 122 of 330

    If this had been a stolen phone this hack would not have worked because the finger print would have been invalidated in 48 hours.  Buyng your own phone and then take your sweet time to fake your own finger to crack it is not impressive.

     

     

    By the time you fake a fingerprint for a stolen iPhone, the police would have located your with "Find my iPhone".

     

     

    A lost or stolen iPhone can be easily wiped via iCloud.

  • Reply 123 of 330
    MacProMacPro Posts: 19,822member
    lkrupp wrote: »
    Take yourself and your "This is not good for Apple" nonsense and jump off a bridge. Apple never said anything remotely indicating this was unbeatable. YOU and your ilk blew it up into something it wasn't. You tell me which is easier to hack, a 4 digit PIN or Touch ID. You tell me how ANY device is secure once someone has physical possession of it.  YOU tell me how your ex-wife or girlfriend is going to do this. YOU tell me how the common thief is going to accomplish this. It's a step UP from the PIN and not a gimmick. Lots of people run around with no lock code at all because they don't like punching numbers. Touch ID will let them have some real security because it's easy to use.

    I'll tell you what. When I get my iPhone 5s I'll let you have it and YOU into it hack it. And let's put some serious money up too. Otherwise shut up.
     
    Just go away and play with yourself.

    PED should quote this verbatim on CNN Money.
  • Reply 124 of 330

    Hopefully my earlier comment clarifies something for you:

     

    Gather 'round children, gather 'round.

     

    Watch me debunk this.

     

    Let me first start out by bringing out the fact that this sensor DOES scan the sub epidermal layers of your skin(which means it scans multiple layers of your skin to ensure it's yours).

     

    Keep that fact in mind..

    Now, when watching the video, you can see the person obviously successfully registering his finger print(his index finger), and it works quite well and very fast.

    Then look at the finger print he copied. Notice how he used the same print, from the same finger, on the same person? Interesting.. Let's see where this is going..

     

    Now, the sensor works by detecting your finger touching the steel band, so it's capacitive. When he puts the paper on the sensor, it clearly does nothing, but when he puts the SAME finger that he used for the print.. It magically unlocks. Why?

     

    The sensor is reading the print through multiple layers, it is merely treating the paper as another layer of skin, therefore, it unlocks.

     

     

    Until I see this German folk do the same thing, with a different print copied, and use another different person who is using a different finger to "fake" this, I call BS.

     

    I'm not as easily conned by them, and just for a side note, it seems all they're doing is scamming the people who are offering bounties for this. Being a computer club full of guys, imagine what they would buy $16k worth of..

     

    Debunked, and I'll be using the sensor because so far, it has not been hacked/faked.

  • Reply 125 of 330
    Congratulations to the submitter that said in the time it would take to go through the proces the phone would be wiped. Correct me if I'm wrong. The person who cracks the phone shouldn't be able to gain access unless he or she has the ID and the passcode.
  • Reply 126 of 330
    arlorarlor Posts: 533member
    Quote:

    Originally Posted by JDW View Post



    I simply don't understand how this can be possible if one takes Apple's "sub-epidermal" statement at face value. Watch the following video on Apple's site, starting at 1:20...



    http://www.apple.com/iphone-5s/videos/#video-touch



    The way I understood it when presented at the keynote was that it reads the print on the surface of the skin as well as penetrating deeper into the skin to ensure the print could not be faked.



    I don't write this to attack Apple. I write this to know if any of you can explain in technical detail how Apple's sensor reads sub-epidermal details of one's finger.



    Or could this be a bug that prevents the sub-epidermal scan from taking place?



    Thanks.

     

    It's already established that you can, for example, read somebody's pulse from a cell phone camera, by sensing very rapid changes in skin tone. And that's from several feet away. It wouldn't surprise me if the sensor can read through a bit of skin. Skin is translucent, after all.

     

    Now, as to what exactly they're measuring under the skin (e.g. what skin structures or formations under there are stable enough to reliably detect over time), I have no idea. But I doubt Apple would say it if it's just not true at all.

  • Reply 127 of 330
    Quote:

    Originally Posted by tort View Post

     

     

    I've done it before.. I've done it with my friend's phones.. Just tell them you want to check out their phone if it has a pattern unlock, and boom lol. You're in. Not that hard. It's not impossible to do it..


     

    Give it up buddy, nobody believes your BS. Or are you in denial that nobody believes you.

    This is the last time I'm gonna tell you this, Denial is helluva drug. 
  • Reply 128 of 330
    kpomkpom Posts: 660member
    Quote:
    Originally Posted by 1983 View Post

     

     

    Yes, but Apple wanted much more from this technology over the long run. That seems to be quashed now. 


     

    Not necessarily. Fingerprint recognition in connection with retina scans or some other technique can still work. I agree, though, that companies may be spooked out of allowing Touch ID instead of a pass code on their enterprise profiles. The silly thing, though, is that pass codes can be deduced by looking at where the fingerprints or wear is on the screen. 

  • Reply 129 of 330
    kpomkpom Posts: 660member
    Quote:
    Originally Posted by Arlor View Post

     

     

    It's already established that you can, for example, read somebody's pulse from a cell phone camera, by sensing very rapid changes in skin tone. And that's from several feet away. It wouldn't surprise me if the sensor can read through a bit of skin. Skin is translucent, after all.

     

    Now, as to what exactly they're measuring under the skin (e.g. what skin structures or formations under there are stable enough to reliably detect over time), I have no idea. But I doubt Apple would say it if it's just not true at all.


     Probably the sub-epidurmal stuff is meant to make it quicker to read fingerprints. Remember the remarkable thing about Touch ID is its accuracy. I always had issues with fingerprint recognition systems in the past.

  • Reply 130 of 330
    arlorarlor Posts: 533member
    Quote:

    Originally Posted by KPOM View Post

     

     

    Not necessarily. Fingerprint recognition in connection with retina scans or some other technique can still work. I agree, though, that companies may be spooked out of allowing Touch ID instead of a pass code on their enterprise profiles. The silly thing, though, is that pass codes can be deduced by looking at where the fingerprints or wear is on the screen. 


     

    That can be defeated to some extent by requiring your employees to change their passwords frequently, or to use passwords with lots of distinct characters.

  • Reply 131 of 330

    Some of you guys are acting as if you are personally being hacked. Chill.

  • Reply 132 of 330
    jungmarkjungmark Posts: 6,927member
    ramrod wrote: »
    Sorry, best and easiest way is the pattern unlock that android uses. Apple should have put more money towards a better user experience, bigger and better screen, and better hardware overall. The fingerprint lock is useless in winter. What a hassle to keep taking off gloves to unlock my phone. I like what Nokia and Samsung did with the touchscreens that work with gloves. Get on it Apple. Stop these stupid gimmicks.

    Stop with these stupid comments. Wah wah. I'm gonna have to take my gloves off? You also can't get your wallet out if your pocket with gloves on.

    Fact is there are a lot of users that don't bother with any pass codes and a lot more users that hate having to type them in dozens of times per day.
    taniwha wrote: »
    Believe what you want. You might want to remember that precisely this procedure was published in 2004 by the CCC and used effectively to demonstrate the absurd claim of the then German Interior Minister (Wolfgang Schäuble) that fingerprints were a secure means of idenification and authentication. They made Schäuble look like a complete idiot. For a while you could even buy Coffee Mugs with his "authentic fingerprint". So it's really trivial to fake fingerprints by this method which doesn't require any technology that's not available in millions of households round the world.

    Damn nothing improves over 9 years. We're still in 2004 tech.
    ramrod wrote: »
    Sorry to hear you don't know how to wipe your screen or that your friends can't come up with a complex pattern. And sorry to hear you blame the locking mechanism because the idiotic user didn't know how to connect the dots. Wow! Like I said, Denial is a helluva drug.
    In the end I say don't worry what me or others think about this ridiculous gimmick. The inconvenience of having to constantly take your gloves off is enough reason to not want to use it. Come this winter, anyone with a GS4 can happily swipe in their pattern lock and never have to be inconvenienced with CONSTANTLY taking off their gloves. Samsung was smart enough to know this. Apple? Not so much.

    Quit crying.
  • Reply 133 of 330
    1983 wrote: »
    Just go somewhere and relax, you rude zealot! I'm not going anywhere, and while I'm an Apple fan, I'm not going to shut up when they make the occasional mistake.
    The issue is there IS NO MISTAKE, other than your ill-informed assumptions. And your ridiculous position. The fact of the matter is that it is an extremely secure system for many reasons, not the least of which that around half of smartphone users don't even use a pass code to unlock.
  • Reply 133 of 330
    Quote:

    Originally Posted by Robin Huber View Post



    My front door lock can be picked. Guess I am foolish. Will leave my doors open from now on.

    try the new android door… the customization is too good and you can also select the door bells, sneak a peak from eyepiece with fish eye angle with some instagram filters (with some advertisements ofcourse), you can change the color of the doors and select many default themes.

     

    /s

  • Reply 135 of 330
    drblankdrblank Posts: 3,385member

    I'm sure it's possible to jump off the top of the torch at the Statue of Liberty, but I don't think it's going to be done on a daily basis.

  • Reply 136 of 330
    Quote:

    Originally Posted by MacHarry de View Post



    OK,is it possible to return the new iPhone 5s to Apple until this hard issue is solved?

     

    It will never be resolved, but I sure Apple would be happy to give you a refund if you promise to go away and buy an Android based phone.

  • Reply 137 of 330
    All you have to do is to require both a password and a fingerprint.
  • Reply 138 of 330
    All you have to do is to require both a fingerprint and a password. That would be an ultimate security method.
  • Reply 139 of 330
    Originally Posted by jameskatt2 View Post
    All you have to do is to require both a fingerprint and a password. That would be an ultimate security method.

     

    Unless you forget your fingerprint, meaning it’s not.

  • Reply 140 of 330
    arlor wrote: »
    That can be defeated to some extent by requiring your employees to change their passwords frequently, or to use passwords with lots of distinct characters.

    Well that's certainly convenient....
Sign In or Register to comment.