Passwords: 4 Biometric Tokens and How They Can Be Beaten

Passwords present many security concerns. Users still choose short and obvious passwords or use the same ones across all their accounts. Meanwhile, the organizations we trust to safeguard our data often suffer breaches and end up losing millions of customer credentials. All this results in an authentication standard we can't trust.

But don't fret yet! Passwords aren't the only possible factor for authentication. You can use many other factors to identify yourself, including digital certificates, hardware tokens, and biometrics. Right now, biometrics are in vogue, primarily because they're more convenient. Rather than having to remember a hundred different, long passwords, isn't it great to just push your finger against a sensor, or look at your computer or phone to log in? As you've probably noticed, this seems to be the future of authentication, with new examples like Microsoft's Hello and Apple's FaceID.

But do biometrics really solve all our authentication security problems?

I would say no. While biometrics are fairly accurate, they're not infallible. Over the years, hackers and researchers have beaten biometric solutions many times. Let's look at the top four biometric hacks from the past.

1. Gummy Bears Beat Up Fingerprint Readers
When you think biometrics, you probably think fingerprints. Fingerprint readers were one of the first forms of biometrics used in computing, and they're pretty ubiquitous today. However, they were also one of the first biometrics that researchers figured out how to defeat on the cheap.

In 2002, a researcher named Tsutomu Matsumoto shared how to defeat fingerprint readers with plain old gummy bears. Matsumoto pulled prints from a glass using the same techniques as law enforcement, and then used the prints to make a finger out of the gummy materials. With a little work, many of these crafty creations tricked the fingerprint sensors.

Of course, over time biometrics have become more advanced. Modern sensors read at higher resolutions or look for new factors such as heat or heartbeat. However, the techniques researchers use to defeat them have also evolved. In 2013, the Chaos Computer Club defeated the iPhone's TouchID reader shortly after its release. Even more recently, researchers hacked fingerprint readers with paper and glue.

While I love that fingerprint readers have made accessing our smartphones easier, we can't totally trust them yet.

2. Faking Out Iris Scanners
We've all seen fancy iris scanners in the movies, but these eye-based biometrics don't just exist in fiction.

Unfortunately, they're no more foolproof than fingerprint readers. In 2012, researchers shared how they could bypass iris readers with replica images of irises. The most interesting aspect of this research was how they replicated the fake irises based on the iris data stored in the biometric system's database. In the same way that password database leaks result in hacked passwords, an iris database breach could result in fooled eye scanners.

3. Paper Faces Fool Facial Scanners
The latest hot trend in biometrics is facial scanning. With features like Microsoft's Hello, you can unlock your computer or phone by looking at it. This sounds like a usability dream, but it's still trivial to beat.

Back in 2011, a blogger and researcher quickly learned that you could easily fool Android facial scanners with a still picture. You take a still picture of yourself, show it to the phone, and voila, you're in. To vendors' credit, they updated their facial scanner technology to perform "liveness" checks, looking for some sort of motion to make sure the face looking at the camera was a real person. Unfortunately, a Photoshopped blink could bypass that new check. Just by editing your eyes closed and then switching between two still photos, you could get past those early liveness checks. The good news is that facial recognition is still evolving.

4. 3-D Printers Crack 3-D Facial Scanners
In 2017, Apple released a new facial scanning feature called FaceID. On the surface, the user's experience is like any other facial reader. However, underneath the phone's glass is technology that should make facial recognition much more accurate and hard to beat. Essentially, the phone includes a sensor (TrueDepth) that sends out thousands of infrared beams of light, which accurately map your face. This allows the phone to store a kind of 3-D digital representation of your face, which it can recognize from many angles. Apple reinforces this feature with machine learning, which can recognize you even when you wear hats, glasses, or other accessories that might confuse classic facial scanners.

All this should make facial biometrics pretty bulletproof, and it does make it stronger. However, about a week after Apple released FaceID, a Vietnamese security group claimed to have cracked it. The hack required a 3-D printer, 2-D infrared images of eyes, stone powder, and lots of handcrafting to create a mask that could fool FaceID. To be fair, no other research group (to my knowledge) has independently verified this attack yet.

I suspect we might see updates that make it harder to fool, but so far both 2-D and 3-D facial scanning are not perfect.

It may seem I'm painting a bleak picture for the future of biometrics, but that's not true. Biometric vendors are learning from these mistakes and will add new features that make their systems more robust. Meanwhile, new biometrics options continue to emerge, such as heartbeat, typing cadence, and even brain waves.

History has shown us that motivated attackers can find a way to copy, steal, or bypass the factors they need. If we rely on biometrics alone, we'll likely suffer the same types of issues passwords have experienced. Only now, when a hacker replicates your fingerprint or face, you can no longer use it for authentication.

Biometrics will play an important role in the future of authentication. However, no authentication token is infallible. Rather than depending entirely on some new form of advanced biometrics, the safest course of action is to implement multifactor authentication — using more than one factor — for anything you want to secure.

Related Content: