Picture perfect? Hackers claim iPhone 5S fingerprint scanner can be broken using photograph

Apple's new TouchID iPhone 5S fingerprint scanner can be fooled using a photograph of the owner's finger, hackers have claimed.

Germany based Chaos Computer Club (CCC) alleged its biometrics team had bypassed the new security feature using a latex "fake finger" slide made using an image taken from a glass surface.

It posted a video on YouTube purporting to show a hacker with the alias Starbug using it to unlock one of the new iPhones, which went on sale last Friday for up to £709 for the top-end model.

In a statement posted on the CC website, Starbug said: "In reality, Apple's sensor has just a higher resolution compared to the sensors (available) so far.

"So we only needed to ramp up the resolution of our fake.

"As we have said now for more than years, fingerprints should not be used to secure anything.

"You leave them everywhere, and it is far too easy to make fake fingers out of lifted prints."

Unveiling the 5S handset earlier this month, Apple's Philip Schiller told a press conference at the firm's California headquarters that TouchID would provide a "simple and secure way to unlock your phone with just a touch of your finger."

The security feature is built into the home button and uses a laser cut sapphire crystal with a sensor to take a high-resolution image of a user's fingerprint.

According to Apple, the technology can "intelligently analyse" the print to provide accurate readings from any angle.

All fingerprint information is encrypted and the firm has insisted it will never be stored on Apple servers.

Beyond unlocking the phone, the feature can be used as a secure way to approve purchases from the iTunes Store, App Store or iBooks Store, Apple said.

It has yet to comment on the allegations.

David Emm, senior security researcher at Kaspersky Labs said fingerprint scanning tech should provide extra security for people who don't password lock their handsets because of the "hassle" it involves.

He added: "If my passcode becomes compromised, I can simply replace it with a new one - hopefully one that's more secure. But I can't change my fingerprint - it's part of what I am and so I'm stuck with it.

"So if someone is able to fool a fingerprint reader by spoofing the fingerprint, you can't just find a new fingerprint.

"If the CCC has indeed found an easy way to circumvent the TouchID technology, then it would suggest that Apple's 'highly secure' implementation may not be secure enough.

"Because of the nature of fingerprints, you effectively leave your password everywhere you go so unless a fingerprint reader is able to fully distinguish between a real finger and a fake one, a fingerprint scan is a poor substitute for a password."

Bu Haber için yorum yapabilirsiniz 28.09.2013 12:45:22 204.236.235.245

Yorumlar()