Pages

Monday, April 21, 2014

Samsung's Galaxy S5 can be tricked by the same lifted fingerprint hack as the iPhone 5s







Remember in my previous post when a couple of researchers figured out how to bypass the iPhone 5S' fingerprint lock with a fancy fake rubber finger?
Turns out, the fingerprint sensor on Samsung’s new Galaxy S5 falls victim to the very same trick. They didn’t even have to make a new mold.


While the executions are nearly identical, the end result is somewhat more severe in Samsung’s case. Apple limits fingerprint-authenticated payments to the App Store, whereas Samsung’s PayPal tie-in (allowing users to log in to PayPal with their fingerprint) potentially puts a user’s larger financials at risk. But of course, tricking either phone’s fingerprint sensor opens up access to any email account configured on the device and really, that’s about as bad as it gets.
The big lesson here: a fingerprint password is better than no password at all, but it’s not bulletproof. If you’re a secret spy shuttling important documents around on your phone? Maybe pick something else.
For the curious, here’s the original iPhone 5S video that shows the entire finger-faking process:


Sunday, April 20, 2014

Hackers Bypass Apple's Touch ID with Lifted Fingerprint

Fingerprint scanners have always been vulnerable to hackers who are willing to go the extra mile to bypass them. Over the years, we've seen everything from peoples using sophisticated techniques to bypass these biometric scanners. It's not really a surprise them, that Apple's Touch ID fingerprint scanner on the new iPhone 5s is vulnerable to these kinds of hacks as well. As Germany's Chaos Computer Club (CCC) announced last September, it has managed to bypass Touch ID by creating a fake finger that uses lifted prints to fool the scanner into perspective. Getting this ti work isn't quite as easy as CCC hackers make you think it is in their press release or this video:


First you need some kind of colored powder or superglue to lift the fingerprint. Then you have to scan the fingerprint, invert it and print it with a resolution of 1200dpi or more onto a transparent sheet. After that, you build your fake finger by smearing pink latex milk or white wood glue into the pattern that the toner created onto the transparent sheet and wait for it to set. Finally, the CCC writes, “the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone.” This method should work for virtually every fingerprint scanner on the market today.
If somebody is willing to go through all of this to break into your phone, chances are you have bigger issues than fingerprint security. Also, given that most iPhone users probably don’t even use a PIN code to secure their devices today, Touch ID still marks a massive step forward in smartphone security — even given the remote chance that somebody would lift your fingerprint and go through the trouble of bypassing it.