Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.
Cybercrime
Next Generation Data Center Is Here!
Average Rating:
Rate this article:  
Hacking Contest Targets Apple Touch ID
Hacking Contest Targets Apple Touch ID

By Jennifer LeClaire
September 20, 2013 10:18AM

Bookmark and Share
Can the Touch ID biometric security feature in Apple's new iPhone 5s be hacked? In a word, probably. "The two primary mechanisms of defense here are that the fingerprint data is being stored in hashed form, and that the data is being stored in a supposedly secure portion of the device. Neither offers any real security," said analyst Kevin O'Brien.
 


No sooner did Apple become the first smartphone company to introduce biometrics security than a hacking contest got underway to try to crack the fingerprint-based security in Touch ID. Doubtless, plenty of hackers will join the competition but will anybody win the prize, which includes $10,000 from venture capital firm IO Capital?

Apple has billed Touch ID as an innovative way to securely unlock your iPhone with the touch of a finger. Built into the home button, Touch ID uses a laser cut sapphire crystal, together with the capacitive touch sensor, to take a high-resolution image of your fingerprint and intelligently analyze it to provide accurate readings from any angle. Every time you use it, Apple promised, it gets better.

The Web site hosting the competition, IsTouchIDHackedYet.com, offers a bold header that responds, "No!" But the following have offered a reward to the first person who can reliably and repeatedly break into an iPhone 5s by lifting prints (like from a beer mug). In addition to the $10,000, the list of prizes includes Bitcoins, a bottle of Argentine wine, and a free patent application covering the hack from @CipherLaw."

Why a Hack is Certain

We caught up with Kevin O'Brien, an enterprise solution architect at CloudLock, to get his thoughts on the contest. He told us the fingerprint security on iOS is almost certainly going to be compromised.

"The two primary mechanisms of defense here are that the fingerprint data is being stored in hashed form, and that the data is being stored in a supposedly secure portion of the device," O'Brien said. "Neither offers any real security."

First, he explained, hashed data can -- with dedicated access and time, and some insight -- typically be reversed. The ideal cryptographic hash would not be reversible, but he said it is often possible to bypass a hash function either by comparing the output and input data and determining what was being done to the data to generate the hash, or by exploiting a weakness in the system to gain access to the data during hash generation.

Isolated Chip Model Vulnerable

"Secondly, the "isolated chip" model of security is completely vulnerable to anyone with access to a phone. Assuming that someone was interested enough, it's possible to exploit any number of weaknesses on the device, and siphon off the fingerprint data while it is being written to, stored, or otherwise accessed," O'Brien said. "We can safely assume that Apple has put some form of defense into this process, but once a device is physically compromised, security is essentially impossible."

Finally, he said, there is the question of malware: The simplest route to gaining access to fingerprint data may be to bypass the device and operating system-level security entirely, and simply trick users into providing their fingerprints as part of some other application."

O'Brien offers an example: A "game" that required the user to press his fingers to the sensor to do something might actually be able to capture the input data and pass it to a third party. Presumably, he said, the sensor is restricted from an API perspective, but any manner of software attack may yield access.

"Time will tell exactly how Apple's attempted security measures will be bypassed, but the combination of access and attack possibilities almost guarantees that it will happen," O'Brien concluded.
 

Tell Us What You Think
Comment:

Name:

Dawesi:

Posted: 2013-09-20 @ 5:05pm PT
"simply trick users into providing their fingerprints as part of some other application."

Unfortunately only apple apps have access to use it ATM.



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Cybercrime
1.   Canada Says China Hacked Gov't
2.   Android 'Fake ID' Puts Millions at Risk
3.   Wall Street Journal Hacked Again
4.   Protect Yourself from Identity Theft
5.   Hackers Breached StubHub Accounts


advertisement
Android 'Fake ID' Puts Millions at Risk
Users: stick to apps from Google Play.
Average Rating:
Protect Yourself from Identity Theft
Even if your data was compromised.
Average Rating:
Banks Hit by Android-Skirting Malware
34 institutions, four European countries
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.