No sooner did Apple become the first smartphone company to introduce biometrics
than a hacking contest got underway to try to crack the fingerprint-based security in Touch ID. Doubtless, plenty of hackers will join the competition but will anybody win the prize, which includes $10,000 from venture capital firm IO Capital?
Apple has billed Touch ID as an innovative way to securely unlock your iPhone with the touch of a finger. Built into the home button, Touch ID uses a laser cut sapphire crystal, together with the capacitive touch sensor, to take a high-resolution image of your fingerprint and intelligently analyze it to provide accurate readings from any angle. Every time you use it, Apple promised, it gets better.
The Web site hosting the competition, IsTouchIDHackedYet.com, offers a bold header that responds, "No!" But the following have offered a reward to the first person who can reliably and repeatedly break into an iPhone 5s by lifting prints (like from a beer mug). In addition to the $10,000, the list of prizes includes Bitcoins, a bottle of Argentine wine, and a free patent application covering the hack from @CipherLaw."
Why a Hack is Certain
We caught up with Kevin O'Brien, an solution architect at CloudLock, to get his thoughts on the contest. He told us the fingerprint security on iOS is almost certainly going to be compromised.
"The two primary mechanisms of defense here are that the fingerprint data is being stored in hashed form, and that the data is being stored in a supposedly secure portion of the device," O'Brien said. "Neither offers any real security."
First, he explained, hashed data can -- with dedicated access and time, and some insight -- typically be reversed. The ideal cryptographic hash would not be reversible, but he said it is often possible to bypass a hash function either by comparing the output and input data and determining what was being done to the data to generate the hash, or by exploiting a weakness in the system to gain access to the data during hash generation.
Isolated Chip Model Vulnerable
"Secondly, the "isolated chip" model of security is completely vulnerable to anyone with access to a phone. Assuming that someone was interested enough, it's possible to exploit any number of weaknesses on the device, and siphon off the fingerprint data while it is being written to, stored, or otherwise accessed," O'Brien said. "We can safely assume that Apple has put some form of defense into this process, but once a device is physically compromised, security is essentially impossible."
Finally, he said, there is the question of malware: The simplest route to gaining access to fingerprint data may be to bypass the device and operating system-level security entirely, and simply trick users into providing their fingerprints as part of some other application."
O'Brien offers an example: A "game" that required the user to press his fingers to the sensor to do something might actually be able to capture the input data and pass it to a third party. Presumably, he said, the sensor is restricted from an API perspective, but any manner of attack may yield access.
"Time will tell exactly how Apple's attempted security measures will be bypassed, but the combination of access and attack possibilities almost guarantees that it will happen," O'Brien concluded.
Posted: 2013-09-20 @ 5:05pm PT
"simply trick users into providing their fingerprints as part of some other application."
Unfortunately only apple apps have access to use it ATM.