Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Apple/Mac
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Hacking Contest Targets Apple Touch ID
Hacking Contest Targets Apple Touch ID

By Jennifer LeClaire
September 20, 2013 10:18AM

    Bookmark and Share
Can the Touch ID biometric security feature in Apple's new iPhone 5s be hacked? In a word, probably. "The two primary mechanisms of defense here are that the fingerprint data is being stored in hashed form, and that the data is being stored in a supposedly secure portion of the device. Neither offers any real security," said analyst Kevin O'Brien.
 



No sooner did Apple become the first smartphone company to introduce biometrics security than a hacking contest got underway to try to crack the fingerprint-based security in Touch ID. Doubtless, plenty of hackers will join the competition but will anybody win the prize, which includes $10,000 from venture capital firm IO Capital?

Apple has billed Touch ID as an innovative way to securely unlock your iPhone with the touch of a finger. Built into the home button, Touch ID uses a laser cut sapphire crystal, together with the capacitive touch sensor, to take a high-resolution image of your fingerprint and intelligently analyze it to provide accurate readings from any angle. Every time you use it, Apple promised, it gets better.

The Web site hosting the competition, IsTouchIDHackedYet.com, offers a bold header that responds, "No!" But the following have offered a reward to the first person who can reliably and repeatedly break into an iPhone 5s by lifting prints (like from a beer mug). In addition to the $10,000, the list of prizes includes Bitcoins, a bottle of Argentine wine, and a free patent application covering the hack from @CipherLaw."

Why a Hack is Certain

We caught up with Kevin O'Brien, an enterprise solution architect at CloudLock, to get his thoughts on the contest. He told us the fingerprint security on iOS is almost certainly going to be compromised.

"The two primary mechanisms of defense here are that the fingerprint data is being stored in hashed form, and that the data is being stored in a supposedly secure portion of the device," O'Brien said. "Neither offers any real security."

First, he explained, hashed data can -- with dedicated access and time, and some insight -- typically be reversed. The ideal cryptographic hash would not be reversible, but he said it is often possible to bypass a hash function either by comparing the output and input data and determining what was being done to the data to generate the hash, or by exploiting a weakness in the system to gain access to the data during hash generation.

Isolated Chip Model Vulnerable

"Secondly, the "isolated chip" model of security is completely vulnerable to anyone with access to a phone. Assuming that someone was interested enough, it's possible to exploit any number of weaknesses on the device, and siphon off the fingerprint data while it is being written to, stored, or otherwise accessed," O'Brien said. "We can safely assume that Apple has put some form of defense into this process, but once a device is physically compromised, security is essentially impossible."

Finally, he said, there is the question of malware: The simplest route to gaining access to fingerprint data may be to bypass the device and operating system-level security entirely, and simply trick users into providing their fingerprints as part of some other application."

O'Brien offers an example: A "game" that required the user to press his fingers to the sensor to do something might actually be able to capture the input data and pass it to a third party. Presumably, he said, the sensor is restricted from an API perspective, but any manner of software attack may yield access.

"Time will tell exactly how Apple's attempted security measures will be bypassed, but the combination of access and attack possibilities almost guarantees that it will happen," O'Brien concluded.
 

Tell Us What You Think
Comment:

Name:

Dawesi:

Posted: 2013-09-20 @ 5:05pm PT
"simply trick users into providing their fingerprints as part of some other application."

Unfortunately only apple apps have access to use it ATM.



Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.


 Apple/Mac
1.   Will OS X Beta Avoid Mavericks Grief?
2.   Earnings, Excitement Grow for Apple
3.   Mac OS Yosemite Beta 4 Released
4.   Apple Smart Watch Patent Surfaces
5.   iPhone 6: Bad for Apple Tablet Sales?


advertisement
Apple Digital Book Settlement Set
But company still appealing decision.
Average Rating:
Will OS X Beta Avoid Mavericks Grief?
Apple seeks user feedback on problems.
Average Rating:
Earnings, Excitement Grow for Apple
Momentum mounts as rumors swirl.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 
Dropbox for Business Beefs Up Security
Dropbox is upping its game for business users. The cloud-based storage and sharing company has rolled out new security, search and other features to boost its appeal for businesses.
 

Enterprise Hardware Spotlight
Microsoft Makes Design Central to Its Future
Over the last four years, Microsoft has doubled the number of designers it employs, putting a priority on fashioning devices that work around people's lives -- and that are attractive and cool.
 
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.