Slashdot Mirror
Researchers Hack Biometric Faces
yahoi sends in news from a week or so back: "Vietnamese researchers have cracked the facial recognition technology used for authentication in Lenovo, Asus, and Toshiba laptops in lieu of the standard logon/password. The researchers were able to easily bypass the biometric authentication system built into the laptops by using photos of an authorized user, as well as by presenting multiple phony facial images in brute-force attacks. One of the researchers will demonstrate the hack at Black Hat DC this week. He says the laptop makers should remove the facial biometrics feature from their products because the vulnerability of this technology can't be fixed."
Shouldn't they get charged with hacking the researchers faces off? That is kind of brutal no?
He says the laptop makers should remove the facial biometrics feature from their products because the vulnerability of this technology can't be fixed.
If that's the standard, all security features should be removed. Everything is somewhat vulnerable, and a determined intruder with infinite resource will almost always find a way in. The object is to make this unreasonably hard for most applications.
If you get your laptop lifted at the coffee shop, they better lift your wallet too I guess.
=======
Science -- Sealed, Delivered.
Any security measure other than a (secure) password for computers are not going to provide much security. Fingerprint scanners can be bypassed, physical dongles can be duplicated, and other things are trivial to remove. A secure password with encryption is the only way that you can really make sure a computer is 100% secure. But most people don't need 100% security. There are very few robbers who would steal a laptop then proceed to attempt to remove data on it via fingerprints or other biometrics. So for the average user, it isn't a security risk. Its like saying that locking your door at night isn't good enough because a determined person can break through the glass.
Taxation is legalized theft, no more, no less.
The researchers were able to easily bypass the biometric authentication system built into the laptops by using photos of an authorized user [...]
Tragically, sadly obvious. Not even a hack, really.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Even made a point of saying "facial recognition systems aren't all that secure. They can't tell the difference between a person and a photo of the person". Then he proceeded to break into the room by holding up a picture of someone that had access.
...your average joe-6-pack criminal isn't going to have the brain cells for black hat cracking stuff like this. If they can't get into the laptop, they are probably going to part it out and sell it for any money they can get. On the other hand, if they have full access and can get wifi somewhere, then having Adeona (http://adeona.cs.washington.edu/) installed might pay off. A chance of getting your laptop back is probably better than none at all... If you're really concerned about security, true crypt + usb key would probably be a better choice imo. I guess it all comes down to how_secure you want your laptop to be...
Once upon a time in a mythical land called Soviet Russia, a hot bowl of grits had Natalie Portman.
Not for that. But they should be careful because they probably just pissed off a load of laptop and biometrics software manufacturers who will likely lobby for their being arrested if they land in the US, or if they commence their presentation.
Haven't they heard of Russian and other national's programmers being arrested or threatened with arrest if they land here?
But, if they are REALLY good, they've come up with a solution (for however long decent solutions can be expected to last...), and boost Vietnam's programmer prominence. They're doing not too shabby in the shipbuilding industry
Vinashin:
http://www.vinashin.com.vn/english/Capacity.asp
Hyundai-Vinashin:
http://www.hyundai-vinashin.com/
Maybe they can help out with the US TSA/TWIC/Port Security algorithms?
But, if they get arrested, I don't think Vietnam will take this lightly. The US better go light on this one because if the biometric software touted as good enough for consumers is a fraud, or shoddy at best, then these programmers are nothing less and probably a little bit more than responsible whistleblowers in my book. Why stand by and watch vapor/failure/crapware enter the market if it can be headed off?
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Wonder if, when you 'enrolled' your face in the recognition software, you held your hand(s) up in the image forming a symbol -- peace sign, one finger salute, whatever. Then someone would have to capture your image at the instant you authenticated.
It would be customizeable and and changeable, unlike your face, and hard to duplicate blindly.
Of course they broke it. "Biometric Authentication" is an oxymoron. The correct phrase is "Biometric Identification". A face or a finger are a claim of identity that still needs authentication with some form of secure credential, e.g. a password.
No Id and no authentication is "public". Id but no authentication is "public, but stupid about it".
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
Well, Mythbusters got past fingerprint recognition systems with a Xerox and a Sharpie (after getting the fingerprint off of a can or glass, IIRC). My comment at the time to the group I was watching it with was approximately "I hope their stocks drop hugely tomorrow".
but wouldn't those hackers be pissed if they go through all the trouble to get a good face pic of the user only to find out that there's a password screen immediately after that. i'd say it's a great addition to a layered security system.
I assume that grandparent is alluding to the Dmitry Sklyarov case. Some years back; but fairly big news, in geek circles, at the time.
I can't understand the mindset that people must have to actually post trollish crap like this under their username.
It boggles the mind that we as a society are producing a generation of kids that actually takes pride in being anti-social and disruptive. Yet we have the arrogance to wage wars in an effort to make other nations emulate our social paradigm.
Perhaps it's not them that needs liberating from dictatorial governments, it's us that needs liberating from a downward spiral into social implosion.
Yes, yes I'm ready for the off topic mods now.
If you've ever posted a photo of yourself on Twitter, Facebook, Myspace, a blog, or your website, people can easily get a high-quality photo of you without you knowing it.
Just sayin'.
If you're in a coffee shop, then the best type of authentication is dance recognition. You place the laptop on a table, push the chair to one side and dance like you're selling nails. As most people are terrible dancers it should be a fairly unique identifier. Especially for Apple owners, who will have to dance like Leonard Cohen because they all wear polo neck sweaters.
Task Mangler
What planet have you been on for the last couple of years? Seriously.. which one?
This has nothing to do with tin-foil-hat paranoid delusions. The GP may have been referring to Dmitry Sklyarov, which another poster just mentioned to you. That was about Adobe. Adobe did/does have huge flaws in it's software and Mr. Sklyarov came to the U.S to demonstrate that Adobe's representations of security were basically just fluff. He was arrested, and it was a HUGE deal.
This is not the only instance either. Anytime somebody dares to demonstrate how a security technology may be flawed those affected companies are using the DMCA and the corrupt/broken legisilative/judicial system to quash any dissemination of data that would reveal their products are snake oil.
Just awhile back there was a posting here on /. where a group of university kids (MIT) were involved in a lawsuit to suppress information they uncovered involving vulnerabilities in another security system.
There are plenty of examples where security is proven to be worthless and those affected financially have resorted to corrupt influences in the government to suppress the information and punish those involved with arrest.
These things I have mentioned to you are not delusional. I would suggest you educate yourself with the facts before accusing somebody of just being paranoid. Especially, since the GP was referring to something factual.
If facial recognition is being offered as a replacement for passwords, then it is being sold as a replacement for security.
I'll never make that mistake again, reading the experts' opinions. - Feynman
I was under the impression that for any serious application of a biometric (as in "for security reasons"), that the system should check that the subject is alive, to help deter people from chopping off fingers or poking out eyes. eg a fingerprint scanner would check for sub-surface bloodflow.
The fact that this system is fooled by a static image of the person therefore deems it not fit for purpose IMHO, and this finding should be gratefully received by the manufacturers who can now work on improving the system.
> If it can be defeated with a 2D picture, why not up the ante and ensure that the target
> is 3d by scanning it with a cheap laser?
Because the whole point was to offer biometric identification without spending any money on hardware. The camera was already there.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Here's an up-to-date partial list of security researchers who have been threatened with legal action for releasing research on security vulnerabilities:
http://attrition.org/errata/legal_threats/
It should give you an idea of why people are concerned.
End of lesson. You may press the button.
You want me to get my facts straight? Ummm, OK.
What situation are you referring to in the first place? I also don't understand the difference between reverse engineering code and demonstrating the function of intact code. Both would seem to me to have the same goal, which is to demonstrate that the intended goal of the software is flawed in some way. Neither should be illegal and cause for arrest. It should not be grounds for a lawsuit either.
By all means, please be more specific as to the differences. I would like to know just how one of the situations I mentioned should be illegal or actionable. Help me get my facts straight. Provide your arguments why the arrest was correct and explain the actions.