Slashdot Mirror
Reverse-Engineered Irises Fool Eye-Scanners
Maximum Prophet writes "If you've ever had your eyes scanned, be sure to install new ones every 90 days. Wired reports on research being released at Black Hat: 'The replica images, they say, can trick commercial iris-recognition systems into believing they’re real images and could help someone thwart identification at border crossings or gain entry to secure facilities protected by biometric systems. The work goes a step beyond previous work on iris-recognition systems. Previously, researchers have been able to create wholly synthetic iris images that had all of the characteristics of real iris images — but weren’t connected to real people. The images were able to trick iris-recognition systems into thinking they were real irises, though they couldn’t be used to impersonate a real person. But this is the first time anyone has essentially reverse-engineered iris codes to create iris images that closely match the eye images of real subjects, creating the possibility of stealing someone’s identity through their iris.'"
If these types of scanners ever become common, all you would need is one untrustworthy scanning station to steal your identity (and then impersonate you at all other stations). And the problem with biometrics, of course, is that they can't be changed. Biometrics were never a good idea.
your iris can not. Well, not without some B grade horror movie level surgery. This is the fundamental issue with biometrics.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Someone has been watching Demolition Man a bit too much I think...
You must master your joystick like a fisherman masters bait! - Gimpy
The advantage is her eye color changes all the way from purple to blue to brown so just think of her eyes as Enhanced Security Eyes.
-- Tigger warning: This post may contain tiggers! --
The image editor didn't even bother to use Photoshop to add the fake iris images ... looks like they used MS Paint or something.
I prefer rogues to imbeciles because they sometimes take a rest.
No single or combined biometric is secure. If you want to verify identity you must have at the least, a second factor like a password.
This news makes me feel less unique as an American.
New technology is nice and all, but for every lock ever created there will be a lock pick for it.
The only thing is, the more expensive the lock, the more expensive the lock pick is supposed to be. That's the real measure of the effectiveness of a lock. I.e., an expensive lock that can be picked in an inexpensive manner is an ineffective lock.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
If I recall correctly, I do believe it has been said that even wearing contacts due to development of new veins can change your iris over time. Unless that was specific to your retina?
If Simon Phoenix wants my iris code, hell he can just have a photocopy! Fuckhead... I'll keep both my eyes.
["Tastecicles, you are fined one credit for violation of the Verbal Morality Statute."]
Operation Guillotine is in effect.
Somehow, I'm picturing the eye builder from Bladerunner when I think about reverse-engineered irises.
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Feynman
All your iris are belong to us
Who'd have thought they could do this? I mean the TSA has been duplicating SPHINCTERS for years, now - but irises are a Van Gough level of complexity!
"Flyin' in just a sweet place,
Never been known to fail..."
Doesn't really invalidate the point—I mean, what it amounts to is that iris scanners, traditionally thought of as extremely high-security items, are only really practical for low-security stuff where it wouldn't be worth the cost/risk/bloodshed/etc. to (a) kidnap someone to prototype from their eyes or (b) take what you need a la carte. You still wouldn't want to use it for a military installation.
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
The perfect identification system - is there none? Can everything be faked and replicated? In the end what is the most defining characteristics of a person's identity? One can for example create a complete fake identity and mimic a body with the help of non intrusive / intrusive technology. Perhaps the uniqueness comes from the constant flux - the actual logic or pattern of the changes in the person's life and body. Proving an identity completely means that the technology would follow the person anywhere and monitor the changes. How far is it necessary to actually go? The kind of systems can be abandoned once there's enough trust to not need them at all and/or there's nothing to guard.
Please read the story! This is exactly what this is about. They can copy your iris (what you are), steal your key and hurt you to give them the password. After that there is no need to keep you alive.
If you find a typo, you may keep it.
...shit.
Ok, so current systems can be tricked with photographs, and that seem pretty silly. But future versions could record stereo images while altering the illumination of the subject's eye. Properly functioning (attached) human eyes should have irises that dilate with extreme changes to illumination. By masking the subjects eye or eyes from the surrounding environment and changing the illumination levels over time, a complex system could measure pupil dilation characteristics to evaluate if the eye before it is valid and alive. Randomly timed flashes would be hard to predict and might cause predictable blinking in most humans in addition to dilation changes. By using stereo images, the system could also verify the 3 dimensional shape of the changing iris, which would be much harder to fake with pictures.
Add an infrared camera to mesure eye temperature and faking iris with a screen gets even harder.
Retina != iris.
I prefer rogues to imbeciles because they sometimes take a rest.
It seems to me that it would be easy to prevent that particular attack just by checking pupil reaction. If it doesn't react, the eye isn't attached to a living organism and shouldn't be allowed. Additionally, nothing high security should ever be single factor authentication anyway.
Biometrics done right are really good, biometrics done wrong are our worst nightmare.
Unfortunately, all three of those are really just "something you know."
If I have a 5-pin tumbler key and each pin has a depth setting of 0-5 then I really just need to know a 5-digit, hex (not hexadecimal) number and I can recreate the key. If I have a reading of a fingerprint all I need to do is experiment with fingerprint printing or fingerprint re-forming technology until I get a copy that can pass for the original.
Even an RSA keyfob, technically, can be copied if I can rip it apart in a manner that lets me read the secret encoded within it. There's no such thing as "something you are" or "something you have" when you're translating it to "something you know" anyway.
That neeeeeever happens in today's world of OS security, now does it? And what happens when researchers find a vulnerability in a computer system? It usually gets patched pretty quickly.
This one will not take long to patch. In the "can you tell which is which?" pictures, I picked the synthetic iris with 100% accuracy, in less than 3 seconds of inspection. Yes, I work actively in the biometrics field...but guess what? So do the folks who build these systems. I will hazard a guess that Neurotech (and L-1, and IrsID, and Fujitsu, and...) has a patch out to defeat this is less than a month.
Then another group of researchers will discover another vulnerability, and the game will continue.
FWIW, liveness checks are part of lots of biometric systems, especially fingerprint systems. My prediction is that we will see liveness check technology appear in iris systems pretty quick now.
I worked on early iris recognition software and we had already worked through this scenario way back then. If the scanner was worth it's salt, it would be doing what we did years ago...
1) Verify that the eye reacts to changing light conditions... Pupils should contract or dilate when required.
2) Verify that the eye isn't flat (i.e. a picture). Proper specularity orientation from changing light sources (we used infrared) to identify the curvature.
3) Glowing pupil under infrared, dark with different lighting.
I'm sure there were a number of other things we did, but it has been awhile. Bottom line is that we only used a representative frame from a video sequence for the iris coding; we used the sequence to verify that what we had was not a picture, a contact lens imprinted with an iris pattern, even a live person (not a corpse).
When I left that project, we were able to do iris recognition at a significant distance even if the subject was walking fast using high speed, high resolution video capture.
Two of those three factors - the "something you have" and the "something you know" can be changed. You can be issued a new security card, and you can change your password. The third factor - "something you are" can not be changed. This makes it a lot weaker than the other two factors because if at any time in your history it has been stolen, then it is no longer secure and useful - ever again.
What do you do when your security system requires all three factors, but you already know the "something you are" has been compromised? Let's say it's a staff member with high level security clearance who you know has had their biometrics copied. Do you fire them because they can no longer meet the three factor requirements? or do you just allow them to continue on with two factor? and if the latter, then why did you have the third to begin with?.
And this is exactly why duresse codes exist. if you can give them a "something you know" that gets help dispatched quickly, without tipping off the bad guys, you're in a lot better position. (and they don't dare kill you until they've verified that the information they extracted from you is accurate)
Also improvements to the technology authenticating the "something you are" to make copying impossible is a good thing because it forces them to take you to the authentication device, giving you some measure of temporary safety.
preventing people from using a detached eyeball is easy in several different ways. first of all you can check pupil response or similar to make sure the eye behaves as if it's alive. secondly (and most importantly) you can put the checking device in a supervised place where someone walking up to it with a detached eyeball might attract some attention. this also helps when dealing with coersion/kidnapping issues, and makes even simple attacks like showing a picture to the scanner much more difficult as you now have to have that picture attached to your retina to make it work.
Biometrics done right are wonderful, biometrics done wrong are our worst nightmare.
That's a good trick—albeit one probably fairly easy to simulate with a decent e-paper display put in place, or a transparent LCD.
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Why create an iris when the movies showed you can just pull someone's eye out and hold it in front of the scanner?
Yeah, Loki can leave his fancy gadget home next time.
(But I like the palm scanner scene on Red Dwarf better.)
Sheesh, evil *and* a jerk. -- Jade
Dutch.
The gift that keeps on giving.
"Flyin' in just a sweet place,
Never been known to fail..."
All biometrics can be fooled if the biometric sensor system alone is all you are using for the security.
Biometrics only uniquely identifies a person. You still need another person (security guard, for example) or technology (detect a live human being and/or a real eye) to verify it is a person that provides the biometric input. This is to prove an actual person is there.
Until someone switches eyes out (improbable) or finds a way to implant the iris image of another individuals eye within their own eye (improbable) a security person can verify an eye is actually being scanned by the biometric scanner. Add an independent security feature (ID, password, etc.) and it's a pretty darn good security system.
-- Mean People Suck
the eye scanners they had there measured iris geometry and pupil size and response. They were easily spoofed with psychoactive substances, because calibrated from a baseline measurements. If you could make the the baseline wasn't really baseline, subsequent tests would look a-ok
The point isn't to stop them before detaching your eyeball, it's to make it pointless for them to bother. If they know that a detached eyeball won't work, why would they detach it? someone could come cut my eyeball out right now, but the lack of any authentication system making use of it means there is no reason to do so. similarly if all authentication devices require a LIVE eyeball, criminals will have no use for a detached one.
There is no police force, alarm system, or other security force in existence that makes crime impossible. They all just seek to make crime more difficult, or to stop criminals after the fact. The thing is, criminals know this, and the mere existence of these systems prevents large amounts of crime.