Slashdot Mirror
Crowdfunded Bounty For Hacking iPhone 5S Fingerprint Authentication
judgecorp writes "There's more than $13,000 pledged for a crowdfunded bounty for bypassing an iPhone 5S's fingerprint reader. The bounty, set up by a security expert and an exploit reseller, requires entrants to lift prints 'like from a beer mug.' It has a website — IsTouchIDHackedYet — and payments are pledged by tweets using #IsTouchIDHackedYet. One drawback: the scheme appears to rely on trust that sponsors will actually pay up."
Other prizes include whiskey, books, and a bottle of wine.
With a $10 Walmart machete from the camping aisle, you can "Hack" off the key for yourself.
Or from the iPhone itself.
Apple has already pointed out that the fingerprint sensor will deliver a false-positive approximately 1 time in 50,000 (which they correctly point out is five times more secure than a four digit passcode which can be guessed 1 time in 9,999 attempts). Further, it's already been covered to death that the fingerprint sensor does not read the outer layer of skin and thus lifting a fingerprint from a beer mug will NOT work (despite the internet's intent to claim that it will...).
There's so much stupid surrounding this that it hurts my brain...
Didn't these clowns watch the keynote?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
I wonder if the sensor could be trained to recognize an inanimate object like a casting of my finger. Then I could say "see this casting bypasses the security".
Gunblade
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
I'm pretty sure the fingerprint sensor does not scan the outer layer of skin, but the sub-dermal layer. Why would you think that taking a cast of the outside of the finger would work?
Didn't these clowns watch the keynote?
-jcr
I am totally shocked someone in the tech industry would launch a project without fully understanding the original problem. SHOCKED I SAY.
Season 2 Episode 1, "The Human Factor". Mac scrapes some gypsum dust off of a wall and blows it across the reader (a hand print reader, if I remember correctly) like one would dust for fingerprints. Then he wrapped his hand and pressed the reader - voila! It should work as long as the phone's owner doesn't remember to wipe down their fingerprint reader each time they use it.
If someone could find a way around this, it would be worth a lot more than the stated bounty to criminals.
No, because the iPhone 5S doesn't use an optical fingerprint scanner. It's using a capacitive sensor that measures capacitance of the skin and sub-epidermal layers of the finger. A simple image of the print won't fool it.
How long does it take to etch a PCB (mould) and how long does it take for gelatine to cool down (finger cast)? (The method that Mythbusters used)
The Mythbusters episode was from 2006, and was done on a sensor that was even older. Technology improves. In a decade, it can improve a lot. Their technique would almost certainly not work today. Apple's sensor requires a pulse, and detects deep skin layers that do not show up on a lifted fingerprint.
yes, but only the cat can unlock it! actually i don't know, if one cat is registered can others unlock it as well?
The problem is that the fingerprint scanner could create a false sense of security.
The source you site seems to be saying the opposite of what you claim:
When you touch the iPhone’s fingerprint sensor, it measures the minuscule differences in conductivity caused by the raised parts of your fingerprint, and it uses those measurements to form an image..
Those raised parts of the fingerprint are exactly the ones that deposit fat stains on every surface you touch.
Of course, it is possible that the macworld article is misleading, and that the fingerprint reader reads some other pattern after all. If so, it would be nice to see a source that backs that up. This has been brought up in previous slashdot discussions too, but I have never seen any evidence backing it up, even after explicitly asking for it.
Probably :)
What is your source for claiming that the sensor reads a different pattern than the normal fingerprints you leave behind? A capacitive fingerprint reader works by measuring the difference in capacitance between the ridges and valleys of your fingerprint. In the ridges, the distance to the more conductive layers beneath the skin (the sub-dermal layers you've heard about) is greater than in the valleys, which gives these regions higher capacitance. I guess the pattern you get this way could be different from the visible fingerprint if the underside of the skin has a significant, different pattern than the overside, but I have not heard that that is supposed to be the case.
To simplify things a bit, the much touted sub-dermal layers work as a sort of capacitive back-light which highlights the differences in thickness of the fingerprint above it. It is, to the best of my knowledge, simply another way of measuring the same fingerprint we see when we look at our fingers.
From this macworld article on the subject:
A capacitance fingerprint reader leverages a handy property of your skin: The outer layer of your skin (your dermis), where your fingerprint is, is non-conductive, while the subdermal layer behind it is conductive. When you touch the iPhone’s fingerprint sensor, it measures the minuscule differences in conductivity caused by the raised parts of your fingerprint, and it uses those measurements to form an image..
A capacitor works by having an insulator sandwitched between two conductors. The thinner the insulator is, the higher the capacitance. In the case of a capacitive fingerprint reader, the conductors are the reader itself on one side, and the subdermal layers on the other side. In between them, the skin works as an insulator. Hence, by measuring the capacitance, one is effectively measuring the thickness of the skin. I.e. the pattern of ridges and valleys visible on your fingers. This is the layer you claimed wasn't measured in the first place.
> How long does it take to etch a PCB (mould) and
> how long does it take for gelatine to cool down
> (finger cast)?
I don't know. How long does it take to use Google and learn that your method won't fucking work?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Apple's been working on the dock port problem as well: IIRC, Recent OS updates will alert the user if you plug into a device that attempts to treat the phone as a USB storage device (instead of a battery), and require the user to allow it. (After unlocking the screen, of course, which means if it's locked and requires a password or fingerprint, you need the password or fingerprint.)
It's not a high-security device by any means, but the obvious pitfalls are being taken care of. I don't expect this bounty to be particularly hard, but it's probably going to be beyond the average thief.
'Sensible' is a curse word.
Didn't the manufacturer make similar claims about the Mythbusters lock too? That turned out to be hogwash.
Let's wait and see how it actually works.
It's The Golden Rule: "He who has the gold makes the rules."
Higher distance gives lower capacitance, not higher. This does not change the argument, though.
Just take close in photos of all the smudges on the "retinal" display screen extrapolate 3d from it and print it with a 3d printer. Presto access.
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
Laptops have had fingerprint login authentication for years. Why all the fuss over what seems to be a more secure method than the one on my wife's four year old HP?
Some mornings it's hardly worth chewing through the restraints to get out of bed.
Hmm, so how many things did Apple patent that they didnt bother to implement? ... have to take your word for it?
And givent he fact that most testers probably wont find a test candidate to chop a finger off ill guess i just
The sensor in the iPhone 5s utilizes two methods to sense and identify your fingerprint:
Capacitive -- A capacitive sensor is activated by the slight electrical charge running through your skin.
Radio frequency -- RF waves do not respond to the dead layer of skin on the outside of your finger -- the part that might be chapped or too dry to be read with much accuracy -- and instead reads only the living tissue underneath. This produces an extremely precise image of your print, and ensures that a severed finger is completely useless.
This means that the Touch ID sensor should be remarkably accurate for living creatures, but it also means that only a finger attached to a beating heart will be able to unlock it.
Why a disembodied finger can't be used to unlock the Touch ID sensor on the iPhone 5s
We all have a small amount of electrical current running through our bodies, and capacitive technology utilizes that to sense touch.
If you fail that hard in your understanding of such a basic smartphone technology as capacitance, then your opinion on technical matters will be considered irrelevant and background noise. They then go ahead and fail at biology:
Once the tissue is dead -- which, in the case of someone chopping your finger off without your consent, should happen within a matter of minutes.
A chopped off human finger can be successfully re-attached to the person after 12 hours if kept warm and up to four days if kept refrigerated. This claim is thus patently false.
for i in `facebook friends "=bday" 2>/dev/null | cut -d " " -f 3-`; do facebook wallpost $i "Happy birthday!"; done
Assuming that you protect your phone from the random thief, I would recommend installing a tracing app and leaving the phone unlocked - a locked phone will just encourage the thief to hard reset it or turn it off immediately. Same with a laptop - I had some tracing software installed but unfortunately I forgot to enable the guest account so the thief could not use the laptop... and therefore never gave me a chance to locate it.
The whole point of the scanner is that the 90% of iPhone users who don't even use a code because it wastes too much time, might turn it on because it's convenient.
No kidding!!! What do you say at this point?
False! If it requires a pulse (which I doubt) it would be simple to emulate this with a very easy circuit varying the capacitance which is the only thing a normal capacitive reader can sense. If it is a combination of a capacitive reader for the fingerprint and an IR oximeter for sensing pulse the solution is to have a pulsed IR lightsource. But it is unlikely that it's anything more than a flat capacitive reader possibly with a higher resolution than normal readers. But realistically this is the normal "Apple" exaggerations* coupled with normal "Apple" fanboyism. The standard for PC notebooks with fingerprint readers is capacitive reading in a scanner configuration which is more secure than non-scanning reader as the scanning removes most of the fingerprint automatically. And the technology does improve there too unlike what Apple fanboys like to think... (* Anybody remember the G4 supercomputer claims? The GCD claims? The retina claims? The list goes on...)
I would not be surprised if someone would have broken it within mere hours after they have become available.
How long does it take to etch a PCB (mould) and how long does it take for gelatine to cool down (finger cast)? (The method that Mythbusters used)
The iPhone 5s went on sale in Australia about 21 hours ago in Australia, shortly after that in China and Japan, More than 13 hours in Europe - still not hacked yet.
Of course news about a fake are Fake News.
yes, but only the cat can unlock it! actually i don't know, if one cat is registered can others unlock it as well?
Second paragraph: ". Note that no other paw pads would unlock the device, and that cats essentially have unique “fingerprints” just like people, so this doesn’t make the Touch ID sensor any less secure."
Of course news about a fake are Fake News.
Second paragraph: ". Note that no other paw pads would unlock the device, and that cats essentially have unique “fingerprints” just like people, so this doesn’t make the Touch ID sensor any less secure."
i don't worry so much about a cat paw fooling the sensor that it is a person's finger print. Just trying to make sure that my two cats won't be able to unlock each other's phones.
Exactly. The inclusion of the sensor is not about being 100% secure all the time, it's about encouraging the use of some level of security by the majority who currently have none. Since it is quicker to use the sensor than to swipe to unlock without a PIN, that is the metric to consider.