Forget twerking. Forget celebrity photobombing, toddlers performing "Blurred Lines," or even grumpy cat GIFs. The hot new craze is figuring out which body parts can be used to unlock Apple's iPhone 5s.
Let's start with fake fingers. Less than two days after a pair of hackers challenged the world to successfully spoof a fingerprint and gain illicit access via Apple's Touch ID biometric, a researcher in Germany named Starbug did just that.
[ Why hacking the iPhone 5s fingerprint reader is no big deal. | See the iPhone 5s fingerprint scanner hack in action. | Get a humorous take on the tech industry's shenanigans; follow Cringely on Twitter. | For a quick, smart take on the news you'll be talking about, check out InfoWorld TechBrief -- subscribe today. ]
After news of Starbug's Touch ID hack became public, Lookout Security's principal researcher Marc Rogers decided to see if he could duplicate Starburg's feat. Of course, he could.
Gold fingers
Both of them went through a series of CSI-like steps, carefully lifting a fingerprint from the iPhone's glass surface, reproducing a high-res image of it, and using that to create a fake fingerprint from latexlike material and applying it to the Touch ID sensor. The process is either surprisingly easy or extremely difficult, depending on which guy you believe. According to Rogers:
Hacking Touch ID relies upon a combination of skills, existing academic research and the patience of a Crime Scene Technician.... Practically, an attack is still a little bit in the realm of a John le Carré novel. It is certainly not something your average street thief would be able to do, and even then, they would have to get lucky.
Starbug had a rather different take on the matter, as he told Ars Technica:
It took me nearly 30 hours from unpacking the iPhone to a [bypass] that worked reliably. With better preparation it would have taken approximately half an hour. I spent significantly more time trying to find out information on the technical specification of the sensor than I actually spent bypassing it.
I was very disappointed, as I hoped to hack on it for a week or two. There was no challenge at all; the attack was very straightforward and trivial.
Despite Apple's claims that Touch ID provides a "very high level of security," both Rogers and Starbug note that Touch ID is not a "strong" security control, merely a "convenient" one. Rogers adds, correctly, that Touch ID would be a lot more secure as part of a two-factor authentication system involving a passcode or password.
Still, the speed and relative ease of the hack took many people off guard. As Ars Technica's Dan Goodin writes:
Many security researchers and writers, yours truly included, predicted that the ability of the high-definition scanner included in the iPhone 5s wouldn't be fooled by attacks using scanned fingerprint smudges to impersonate an already enrolled thumb or finger. It's now clear we were wrong.