Slashdot Mirror
Reverse-Engineered Irises Fool Eye-Scanners
Maximum Prophet writes "If you've ever had your eyes scanned, be sure to install new ones every 90 days. Wired reports on research being released at Black Hat: 'The replica images, they say, can trick commercial iris-recognition systems into believing they’re real images and could help someone thwart identification at border crossings or gain entry to secure facilities protected by biometric systems. The work goes a step beyond previous work on iris-recognition systems. Previously, researchers have been able to create wholly synthetic iris images that had all of the characteristics of real iris images — but weren’t connected to real people. The images were able to trick iris-recognition systems into thinking they were real irises, though they couldn’t be used to impersonate a real person. But this is the first time anyone has essentially reverse-engineered iris codes to create iris images that closely match the eye images of real subjects, creating the possibility of stealing someone’s identity through their iris.'"
Wow such potential for security.. get your eyes changed every 90 days. :P
You must master your joystick like a fisherman masters bait! - Gimpy
If these types of scanners ever become common, all you would need is one untrustworthy scanning station to steal your identity (and then impersonate you at all other stations). And the problem with biometrics, of course, is that they can't be changed. Biometrics were never a good idea.
Why create an iris when the movies showed you can just pull someone's eye out and hold it in front of the scanner?
your iris can not. Well, not without some B grade horror movie level surgery. This is the fundamental issue with biometrics.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
The advantage is her eye color changes all the way from purple to blue to brown so just think of her eyes as Enhanced Security Eyes.
-- Tigger warning: This post may contain tiggers! --
...the folks at the Genesis Project? They seem to keep all their important files secured via retina scans. Wouldn't want that technology falling into the wrong hands.
The image editor didn't even bother to use Photoshop to add the fake iris images ... looks like they used MS Paint or something.
I prefer rogues to imbeciles because they sometimes take a rest.
No single or combined biometric is secure. If you want to verify identity you must have at the least, a second factor like a password.
This news makes me feel less unique as an American.
New technology is nice and all, but for every lock ever created there will be a lock pick for it.
The only thing is, the more expensive the lock, the more expensive the lock pick is supposed to be. That's the real measure of the effectiveness of a lock. I.e., an expensive lock that can be picked in an inexpensive manner is an ineffective lock.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
If I recall correctly, I do believe it has been said that even wearing contacts due to development of new veins can change your iris over time. Unless that was specific to your retina?
If Simon Phoenix wants my iris code, hell he can just have a photocopy! Fuckhead... I'll keep both my eyes.
["Tastecicles, you are fined one credit for violation of the Verbal Morality Statute."]
Operation Guillotine is in effect.
Something you have, something you know, something you are.
A (physical) key, a password, and a retina-/iris-/finger-print. That way they have to keep you alive until the door is open
Somehow, I'm picturing the eye builder from Bladerunner when I think about reverse-engineered irises.
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Feynman
All your iris are belong to us
There was only a brief window between the time it became possible and the time it became insecure. Fingerprint sensors have been foolable for years; now iris scanners are broken. Realtime DNA scanners aren't even practical yet, but they won't be feasible and secure for long once they become available, either.
The perfect identification system - is there none? Can everything be faked and replicated? In the end what is the most defining characteristics of a person's identity? One can for example create a complete fake identity and mimic a body with the help of non intrusive / intrusive technology. Perhaps the uniqueness comes from the constant flux - the actual logic or pattern of the changes in the person's life and body. Proving an identity completely means that the technology would follow the person anywhere and monitor the changes. How far is it necessary to actually go? The kind of systems can be abandoned once there's enough trust to not need them at all and/or there's nothing to guard.
...shit.
Ok, so current systems can be tricked with photographs, and that seem pretty silly. But future versions could record stereo images while altering the illumination of the subject's eye. Properly functioning (attached) human eyes should have irises that dilate with extreme changes to illumination. By masking the subjects eye or eyes from the surrounding environment and changing the illumination levels over time, a complex system could measure pupil dilation characteristics to evaluate if the eye before it is valid and alive. Randomly timed flashes would be hard to predict and might cause predictable blinking in most humans in addition to dilation changes. By using stereo images, the system could also verify the 3 dimensional shape of the changing iris, which would be much harder to fake with pictures.
Add an infrared camera to mesure eye temperature and faking iris with a screen gets even harder.
"be sure to install new ones every 90 days" The premise of the post is stupid, the article is fine. The problem is not systemic - it is implementation specific. Claiming that iris scanning is a failed technique is like saying that a 1000 character random password is insecure because it was stored in plain-text or scrambling in a less than keen way. Obviously the problem here is the hashing system being used. If you improve the hashing system then iris' are still FAR better passwords because they contain FAR more information. Just like any other password you shouldn't, I don't know, enter it at a site that you don't think will be secure e.g. Joe Schmoe down the street has an iris scanner for his house, "lets scan your eye"! (this is equivalent to a keylogger). The article isn't debunking iris scanners, its debunking an idiotic claim by a company that their method is good.
get a extra eye in your head or ten
That neeeeeever happens in today's world of OS security, now does it? And what happens when researchers find a vulnerability in a computer system? It usually gets patched pretty quickly.
This one will not take long to patch. In the "can you tell which is which?" pictures, I picked the synthetic iris with 100% accuracy, in less than 3 seconds of inspection. Yes, I work actively in the biometrics field...but guess what? So do the folks who build these systems. I will hazard a guess that Neurotech (and L-1, and IrsID, and Fujitsu, and...) has a patch out to defeat this is less than a month.
Then another group of researchers will discover another vulnerability, and the game will continue.
FWIW, liveness checks are part of lots of biometric systems, especially fingerprint systems. My prediction is that we will see liveness check technology appear in iris systems pretty quick now.
I worked on early iris recognition software and we had already worked through this scenario way back then. If the scanner was worth it's salt, it would be doing what we did years ago...
1) Verify that the eye reacts to changing light conditions... Pupils should contract or dilate when required.
2) Verify that the eye isn't flat (i.e. a picture). Proper specularity orientation from changing light sources (we used infrared) to identify the curvature.
3) Glowing pupil under infrared, dark with different lighting.
I'm sure there were a number of other things we did, but it has been awhile. Bottom line is that we only used a representative frame from a video sequence for the iris coding; we used the sequence to verify that what we had was not a picture, a contact lens imprinted with an iris pattern, even a live person (not a corpse).
When I left that project, we were able to do iris recognition at a significant distance even if the subject was walking fast using high speed, high resolution video capture.
All biometrics can be fooled if the biometric sensor system alone is all you are using for the security.
Biometrics only uniquely identifies a person. You still need another person (security guard, for example) or technology (detect a live human being and/or a real eye) to verify it is a person that provides the biometric input. This is to prove an actual person is there.
Until someone switches eyes out (improbable) or finds a way to implant the iris image of another individuals eye within their own eye (improbable) a security person can verify an eye is actually being scanned by the biometric scanner. Add an independent security feature (ID, password, etc.) and it's a pretty darn good security system.
-- Mean People Suck
so I can
so I can
keep my identity safe
When biometrics are used, there should always be someone there to monitor the person, ie. guard.
Your data has been compromised. We have sent you a new finger. Failure to attach immediately releases us from any legal obligations.
Have a nice day.
the eye scanners they had there measured iris geometry and pupil size and response. They were easily spoofed with psychoactive substances, because calibrated from a baseline measurements. If you could make the the baseline wasn't really baseline, subsequent tests would look a-ok