Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 8 MINUTES AGO.
You are here: Home / Mobile Security / Iris Scanner Fooled by Hackers
Samsung Galaxy S8 Iris Scanner Fooled by German Hackers
Samsung Galaxy S8 Iris Scanner Fooled by German Hackers
By Alex Hern Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MAY
25
2017
The iris-recognition feature in Samsung's new Galaxy S8 smartphone has been defeated by German hackers, less than a month after the device hit shelves around the world.

A video posted by the Chaos Computer Club, a long-running hacker collective formed in Berlin in 1981, shows the security feature being fooled by a dummy eye into thinking that it is being unlocked by a legitimate owner.

The artificial eye -- which is made using just a printer and a contact lens to match the curvature of the eye -- can be created using pictures of the owner's eye taken from social media, the group said, though for highest quality fake irises, a digital photograph taken in night mode works best.

"The security risk to the user from iris recognition is even bigger than with fingerprints, as we expose our irises a lot," said the group's spokesperson, Dirk Engling. "If you value the data on your phone -- and possibly want to even use it for payment -- using the traditional pin-protection is a safer approach than using body features for authentication."

The Galaxy S8 also ships with a facial recognition feature, which was defeated before the phone was even on sale : it can be tricked with something as simple as a printed-out picture of the owner. The ill-fated Note 7 also had the same infrared iris scanner as the Galaxy S8.

CCC is the same group that first fooled Apple's TouchID fingerprint sensors, just weeks after the first iPhone 5s hit the market. That hack was carried out with graphite powder, a laser etching machine and wood glue, all to trick Apple's systems for ensuring that a real finger was being used, but required physical access to something the target had touched (a year later, another hacker demonstrated a way to generate working fingerprints from high-resolution photos).

This hack is even simpler, and could conceivably be pulled off with just a photo lifted from Facebook, a conventional laser printer and a contact lens. "By far most expensive part of the iris biometry hack was the purchase of the Galaxy S8 smartphone," the hackers said. "Ironically, we got the best results with laser printers made by Samsung."

Samsung claims "the patterns in your irises are unique to you and are virtually impossible to replicate, meaning iris authentication is one of the safest ways to keep your phone locked and the contents private."

The revelation will add more fuel to the debate over the use of biometric features as security passes. While biometrics can be more convenient, and harder to steal or fake than passwords, they come with one large trade-off: users cannot change them if they do get compromised.

© 2017 Guardian Web under contract with NewsEdge/Acquire Media. All rights reserved.

Image credit: Product shots by Samsung.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
MORE IN MOBILE SECURITY
ENTERPRISE SECURITY TODAY
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2017 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.