Story image

Will the iPhone X's Face ID be hackable? Security expert weighs in

02 Oct 17

The iPhone X’s facial recognition technologies have been called into question by a security consultant at global tech firm Synopsys, who claims that no facial recognition technology is ever unbeatable.

Nikola Cucakovic posted a blog titled ‘How secure is iPhone X Face ID facial recognition’, which analysed the widespread adoption of facial recognition as a means of biometric access control.

According to Cucakovic, any facial recognition technology must be able to consistently and securely identify the right person. But that technology comes with many attack vectors threat actors can use to beat the system.

While the iPhone X is not on the market yet, information about how its Face ID works has been widely circulated.

A flood illuminator can detect a face in any light conditions and the infrared camera can also take a picture. Using a projector comprised of more than 30,000 dots, the image and dot pattern are used to create a mesh in the ‘neural network’.

Every time a user looks at the device, the image is compared to the mesh. In the case of a match, the device is unlocked.

However, Cucakovic notes, Apple’s SVP of worldwide marketing Phil Schiller admitted that there is a one in a million chance that somebody else could unlock a device that it not theirs with their own face… especially if it’s your ‘evil twin’.

Apple’s Touch ID is subjected to a one-in-50,000 chance that somebody else could use their fingerprint to unlock someone else’s device – and it has been done by the Chaos Computer Club.

“While it’s not impossible to obtain someone’s fingerprint, we can say that it’s definitely more difficult than simply obtaining an image of someone’s face—especially since social media and technology are so integrated into modern-day life that photos are everywhere,” Cucakovic says in the blog.

“What Apple must therefore ensure is that even with a photograph of the victim’s face, an attacker cannot access the phone. Many facial recognition technologies released to date have been circumvented using rudimentary techniques, including printed photographs, digital photographs, animated digital photographs, and 3D models.”

While Apple claims it has worked to protect against these threats, nobody will know for sure until the device is on the market.

For enterprises ‘wishing to be at the forefront of technology’, Cucakovic believes that Apple’s Local Authentication API, which will be used for both fingerprint and facial recognition, will be easily adopted.

“However, for some organizations, there may have been a period of analysis and review concerning Touch ID before it was approved/risk-accepted for use within the enterprise (or for use in their externally visible App Store apps),” Cucakovic states.

“Those organizations may not have assessed the risks concerning facial recognition or approved the technology for enterprise use. On Day 1 when the iPhone X is released, all apps that support Touch ID will support Face ID. This means that users of corporate devices will be able to use facial recognition even if their organisations aren’t okay with that. Organizations should start to evaluate whether Face ID is appropriate for use now, ahead of the iPhone X release, to adjust their policies in time.”

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.