Face ID attention detection security defeated with glasses and tape

Posted:
in iPhone edited August 2020
Security researchers were able to bypass Face ID's "liveness" detection on the iPhone and iPad Pro with everyday items, defeating what is considered the industry's most advanced biometric security system using little more than a pair of glasses with tape affixed to the lenses.




When Apple debuted Face ID during the iPhone X's unveiling in 2017, it was claimed that the technology had a one-in-a-million chance of being unlocked by a random person, a marked improvement over Touch ID's 1 in 50 thousand false positive chance. The high profile nature of the security system has led to attempts by security researchers to defeat it, but at the Black Hat conference, Face ID appears to be susceptible to one relatively simple technique.

Demonstrated on Wednesday, ThreatPost reports researchers from Tencent took advantage of the "liveness" detection of Face ID, which is used to confirm the person it is looking at is real and not a mask or someone wearing prosthetics. By detecting background noise, distortions in response, and focus blur, biometrics tools like Face ID can determine if it is looking at a genuine face, not a manufactured version.

Liveness detection is one of many underlying technologies that make Face ID more effective and accurate than competing solutions used to secure Android devices.

The liveness detection also prevents Face ID from being used when the registered owner is asleep, in theory stopping attackers from simply pointing the TrueDepth camera at the face of an unconscious user. Researchers discovered that Face ID changes its scan process when a target is wearing glasses.

"After our research we found weak points in Face ID, it allows users to unlock while wearing glasses," Tencent's Zhuo Ma advised. "If you are wearing glasses, it won't extract 3D information from the eye area when it recognizes the glasses."

The researchers created the "X-glasses" prototype, namely glasses blacked out with white tape then overlaid with black tape. By placing the glasses on the victim, Face ID was able to be unlocked and money to be authorized for transfer within a financial app.

While the theory is sound in that it can defeat Face ID, the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up.

The researchers propose adding extra elements to biometric systems, including identity authentication and changing the weighting of video and audio synthesis detection to better improve liveness detection systems.

Tencent is not the first to claim success in defeating Face ID. Shortly after iPhone X saw release, a Vietnamese firm tricked the security feature using a 3D-printed mask with attached silicone nose, makeup and "specially processed" areas. The same company replicated the bypass with a $200 3D printed mask that incorporated 2D infrared images.

Face ID can in remote cases be fooled by family members who bear a close resemblance to the device owner.

More recently, a Chinese researcher from Ant Financial was poised to present an easy bypass of the biometric security protocol at a Black Hat conference in January, but canceled at the last minute after his company characterized the talk as "misleading."
«13

Comments

  • Reply 1 of 56
    Hardly an area of great concern for most users, but something that is worthwhile for Apple to know so they can take action to improve it.
    lolliverMacQcchasmracerhomie3superklotoncaladanianjony0
  • Reply 2 of 56
    HeliBumHeliBum Posts: 129member
    The headline is misleading. The hack doesn't defeat Face ID security completely, just one aspect of it.
    AppleExposedlollivermacpluspluschaickaMacQcJFC_PAsuperklotondewmecaladanianpscooter63
  • Reply 3 of 56
    AppleExposedAppleExposed Posts: 1,805unconfirmed, member
    Like TwinGate everyone's gonna pretend they're in danger.
    lolliver
  • Reply 4 of 56
    Their bypass consists of a cheap pair of glasses and two pieces of tape.  Approx. $2 worth of material to bypass a billion dollar security system.  Whodathunkit? ¯\_(ツ)_/¯



    edited August 2019 FileMakerFellerchemengin1tyler82
  • Reply 5 of 56
    SoliSoli Posts: 10,035member
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    Bryant_NorCallolliverAppleExposedStrangeDaysrevenantchaickaMacQcanantksundaramsuperklotonpscooter63
  • Reply 6 of 56
    Rayz2016Rayz2016 Posts: 6,957member
    HeliBum said:
    The headline is misleading. The hack doesn't defeat Face ID security completely, just one aspect of it.
    Agreed. 

    The headline is pure clickbait. It implies that you can defeat FaceID by putting a pair of specs on a random person. I knew that wasn’t true so I read the article to see what sort of nonsense we were dealing with. 

    To to be honest though, this isn’t as bad as the “Google followed Apple” shtick they tried to pull a while back.
    lollivermacpluspluspscooter63jony0
  • Reply 7 of 56
    Rayz2016Rayz2016 Posts: 6,957member
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    AppleExposedStrangeDaysfastasleepspock1234anantksundarampscooter63jony0
  • Reply 8 of 56
    SoliSoli Posts: 10,035member
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    🤣🤣🤣
    lolliver
  • Reply 9 of 56
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    What do you mean "let's be clear"?  Everything you said is stated better right in the article.  It couldn't be more clear.  The researchers even offered up their thoughts on how to mitigate the vulnerability.  Instead of trying to make excuses for Face ID, be happy this beyond low tech, super cheap MacGuyver hack has been exposed.  Now Apple can work on nullifying it.  I think Apple concentrated on defeating high tech penetration techniques.  This hack is the equivalent of throwing a rock through window.  Low tech, but it works.
    chasmchemengin1
  • Reply 10 of 56
    SoliSoli Posts: 10,035member
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    What do you mean "let's be clear"?  Everything you said is stated better right in the article.  It couldn't be more clear.  The researchers even offered up their thoughts on how to mitigate the vulnerability.  Instead of trying to make excuses for Face ID, be happy this beyond low tech, super cheap MacGuyver hack has been exposed.  Now Apple can work on nullifying it.  I think Apple concentrated on defeating high tech penetration techniques.  This hack is the equivalent of throwing a rock through window.  Low tech, but it works.
    It is, but it's about 3/4 of the way through the article. How many people will read that before either freaking out or, more likely, use it as a jumping off point to say how crappy Face ID and Apple are?
    lolliverAppleExposedspock1234pscooter63
  • Reply 11 of 56
    gatorguygatorguy Posts: 24,176member
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    A scenario that comes to mind is your partner/friend/someone hanging out partying or whoever passed out and this glasses trickery being used to unlock their phone while they're incapacitated. 
    revenantcornchip
  • Reply 12 of 56
    SoliSoli Posts: 10,035member
    gatorguy said:
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    A scenario that comes to mind is your partner/friend/someone hanging out partying or whoever passed out and this glasses trickery being used to unlock their phone while they're incapacitated. 
    What is the likelihood of all those factors lining up? I think I have a better chance of winning the lottery than being passed out drunk at a party and someone wanting to get into my iPhone without my knowledge. In my case that doesn't even require the rigamarole of special glasses (even if I wore glasses) because I'm still using an iPhone 7 Plus and my finger would work just fine when I'm passed out.
    lolliverStrangeDays
  • Reply 13 of 56
    avon b7avon b7 Posts: 7,623member
    gatorguy said:
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    A scenario that comes to mind is your partner/friend/someone hanging out partying or whoever passed out and this glasses trickery being used to unlock their phone while they're incapacitated. 
    Another scenario.

    How many law enforcement agents does it take to implement this technique?

    LOL!
    bigtdsmuthuk_vanalingam
  • Reply 14 of 56
    gatorguygatorguy Posts: 24,176member
    Soli said:
    gatorguy said:
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    A scenario that comes to mind is your partner/friend/someone hanging out partying or whoever passed out and this glasses trickery being used to unlock their phone while they're incapacitated. 
    What is the likelihood of all those factors lining up? I think I have a better chance of winning the lottery than being passed out drunk at a party and someone wanting to get into my iPhone without my knowledge. In my case that doesn't even require the rigamarole of special glasses (even if I wore glasses) because I'm still using an iPhone 7 Plus and my finger would work just fine when I'm passed out.
    Probably right Soli, but I do know of an extended family member with an XR who drinks FAR too much and passes out kinda regularly. Someone unlocking his phone while he's out definitely should not be his biggest concern tho. Can't talk him into rehab either.
    edited August 2019
  • Reply 15 of 56
    Soli said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    What do you mean "let's be clear"?  Everything you said is stated better right in the article.  It couldn't be more clear.  The researchers even offered up their thoughts on how to mitigate the vulnerability.  Instead of trying to make excuses for Face ID, be happy this beyond low tech, super cheap MacGuyver hack has been exposed.  Now Apple can work on nullifying it.  I think Apple concentrated on defeating high tech penetration techniques.  This hack is the equivalent of throwing a rock through window.  Low tech, but it works.
    It is, but it's about 3/4 of the way through the article. How many people will read that before either freaking out or, more likely, use it as a jumping off point to say how crappy Face ID and Apple are?
    If someone doesn't read the article and they freak out, that's on them.  If they don't read the article and say Face ID is crappy, so what?  Just ignore them or if it bothers you, correct their incorrect assumption.  Simply put, this is not a good look no matter how you look at it.  A vaunted security feature bypassed by $2 worth of supplies.  No 3D printer, no sophisticated masks or prosthetic pieces.  No Mission Impossible dangling from a rope inches above the floor.  Nope.  Just a quick hop over to Walmart and you're good to go.  As I said, I think Apple focused on high tech intrusion, not anything like this.  Their fix shouldn't be that hard to come up with imo.
  • Reply 16 of 56
    DAalsethDAalseth Posts: 2,783member
    This story is receiving WAY too much attention. You need a pair if glasses that the user has worn to unlock the phone. Then you also need the persons real face. It’s not like you can toss groucho glasses on anyone and unlock the phone
    AppleExposedspock1234superklotoncornchip
  • Reply 17 of 56
    AppleExposedAppleExposed Posts: 1,805unconfirmed, member
    More factors to consider:

    1. You'd have to wait until the person falls asleep or drug them (like Cardi B does her dates) and wait.

    2. You'll have to hope their iPhone is in their hand or somewhere you can reach without waking the person up.

    the biggest one:

    3. The invader would have to know about this hack in the first place.

    Luckily Apple will have this patched in the coming days so there's another one:

    4. You'll have to pull this off this week!

    #GlassesGate
    edited August 2019 spock1234cornchip
  • Reply 18 of 56
    SoliSoli Posts: 10,035member
    Soli said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    What do you mean "let's be clear"?  Everything you said is stated better right in the article.  It couldn't be more clear.  The researchers even offered up their thoughts on how to mitigate the vulnerability.  Instead of trying to make excuses for Face ID, be happy this beyond low tech, super cheap MacGuyver hack has been exposed.  Now Apple can work on nullifying it.  I think Apple concentrated on defeating high tech penetration techniques.  This hack is the equivalent of throwing a rock through window.  Low tech, but it works.
    It is, but it's about 3/4 of the way through the article. How many people will read that before either freaking out or, more likely, use it as a jumping off point to say how crappy Face ID and Apple are?
    If someone doesn't read the article and they freak out, that's on them.  If they don't read the article and say Face ID is crappy, so what?  Just ignore them or if it bothers you, correct their incorrect assumption.  Simply put, this is not a good look no matter how you look at it.  A vaunted security feature bypassed by $2 worth of supplies.  No 3D printer, no sophisticated masks or prosthetic pieces.  No Mission Impossible dangling from a rope inches above the floor.  Nope.  Just a quick hop over to Walmart and you're good to go.  As I said, I think Apple focused on high tech intrusion, not anything like this.  Their fix shouldn't be that hard to come up with imo.
    Why go to Walmart? Take the glasses from the person that already has to be wearing them to setup Face ID with glasses and then put tape on them before putting them back on the face of the iPhone owner to get into their device. Despite your comment saying how obvious it is you still failed to not it requires all these very odd circumstances to use this "hack" effectively.
    StrangeDaysspock1234superklotonpscooter63
  • Reply 19 of 56
    StrangeDaysStrangeDays Posts: 12,834member
    Their bypass consists of a cheap pair of glasses and two pieces of tape.  Approx. $2 worth of material to bypass a billion dollar security system.  Whodathunkit? ¯\_(ツ)_/¯



    You can also knock a person out and stick their finger on a fingerprint sensor. 

    You people try so hard. 
    Soliradarthekatsuperklotondewmepscooter63Rayz2016
  • Reply 20 of 56
    StrangeDaysStrangeDays Posts: 12,834member

    avon b7 said:
    gatorguy said:
    Rayz2016 said:
    Soli said:
    Let's be clear that this "hack" still needs the face of the person who is already keyed for the device. This only allows a person who wears glasses to allow someone to use their phone on their face to unlock Face ID without their consent if they happen to be unconscious after making a pair of augmented glasses, assuming that their picking up the iPhone doesn't trigger Face ID and the subsequently disabling of Face ID before they can execute this "hack".
    You say that but what if I’m walking down the street and someone lifts my phone from my pocket, then they shout “Hey you!”  When I look round they stick a pair of glasses with tape on my face and unlock my phone, even if I close my eyes in time!

    i wasn’t worried about someone unlocking my phone with TouchID while I was asleep, so I’m certainly not going to worry about this. 
    A scenario that comes to mind is your partner/friend/someone hanging out partying or whoever passed out and this glasses trickery being used to unlock their phone while they're incapacitated. 
    Another scenario.

    How many law enforcement agents does it take to implement this technique?

    LOL!
    Sure beats the crummy knockoffs that can be fooled with a photo on another device. Oh but that’s on,y meant for “convenience” not security! riiiight. 
    revenantspock1234
Sign In or Register to comment.