iPhone Hack Fools Touch ID with Hand Photos
A photo of your hand can be used to recreate a fingerprint that could unlock your TouchID-locked iPhone 6. So says German hacker Jan Krissler, who used public photos of German Defense Minister Ursula von der Leyen, taken at a press conference, to recreate the minister's fingerprints.
Krissler, who goes by the hacking pseudonym Starbug, previously showed that he could unlock a TouchID-locked iPhone 6 by forensically lifting a fingerprint from a surface such as a glass or the iPhone's own screen. But now Krissler has shown that he can thwart TouchID even without physical access to the iPhone owner's fingerprint.
MORE: Best Mac Antivirus Software
Speaking on December 27 at German hacking group Chaos Computer Club's annual convention in Hamburg, Krissler demonstrated that he used an photo of minister von der Leyen's thumb, taken at a distance of three meters with a 200er-Objektiv lens at a news conference in October, as well as several other photos from other angles, to recreate von der Leyen's fingerprint.
Then Krissler used a commercial software product called VeriFinger to synthesize these photos into a fully imaged fingerprint, which should then be able to fool biometric security devices such as Apple's TouchID fingerpting scanner. Krissler said that other image-processing software could be used as well.
Once he has the digital image, Krissler can use the same method he previously described for unlocking TouchID with physically-obtained fingerprints: he inverts the colors of the obtained print, so the ridges of the fingerprint are rendered in white and the grooves in black, then prints the image in black ink. The black ink on the paper provides just enough texture to recreate a fingerprint's three-dimensional shape, but inverted.
Krissler then pours glue or plaster over the print of the fingerprint. The ink print serves as a stamp, imprinting the fingerprint's whorls and ridges into the glue and creating a mold which can successfully unlock a TouchID-locked iPhone 6.
Krissler says that even mobile phone cameras, with the right lighting, could be used to capture the necessary photos. He's also working on using public photos of a person's face to image his or her iris.
So what should politicians and other security-minded people do to protect their biometric data? Wear gloves, says Krissler. The full video of Krissler's presentation (in German) is available on YouTube.
Jill Scharr is a staff writer for Tom's Guide, where she regularly covers security, 3D printing and video games. You can email Jill at jscharr@tomsguide.com, or follow her on Twitter @JillScharrand on Google+. Follow us @tomsguide, on Facebook and on Google+.
Copyright 2015 Toms Guides , a TechMediaNetwork company. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
