The CCC defeats Apple's Touch ID
Summary
The Chaos Computer Club demonstrates that a fingerprint sensor can be fooled with a fingerprint reconstructed from a photograph. The target device was Apple's iPhone 5s. The artificial fingerprint was made from common materials.
Ideas
- Biometric features leave copies on everyday surfaces.
- High-resolution images reconstruct a usable fingerprint pattern.
- An artificial fingerprint fools the capacitive sensor.
- Liveness detection increases the effort but does not guarantee a real person.
Insights
- Biometrics is user name and secret at the same time.
- Compromised physical features can hardly be replaced.
- Convenient local unlocking does not replace strong multi-factor authentication.
Recommendations
- Only use biometrics together with revocable factors.
- Protect particularly sensitive actions with renewed authentication.
References
Links to the original source and the Web Archive open in a new tab.