On Sunday, the Berlin-based Chaos Computer Club announced that one of its members, nicknamed Starbug, had successfully hacked the new Apple Touch ID fingerprint scanner.
An unofficial fingerprint scanner hacking contest, IsTouchIDHackedYet, launched last week ahead of the iPhone 5S on-sale date. The contest's organizers verified Starbug's hack and declared him the winner on Monday. Starbug's real identity still remains unknown.
See also: Facebook Hacker Breaks Into Zuckerberg's Timeline to Report Bug
Now, we finally have video evidence of how Starbug pulled it off.
The video, embedded below, shows the step-by-step process of foiling Apple's new authentication system.
The procedure in the video requires several steps and equipment that may not be available to the average thief, such as graphite coating and tracing paper.
But Starbug wasn't impressed by Touch ID's advertised security, he says, and found the hacking process fairly simple.
"I was very disappointed, as I hoped to hack on it for a week or two," he told Ars Technica. "There was no challenge at all; the attack was very straightforward and trivial. "
"It's very easy," he added. "You basically can do it at home with inexpensive office equipment like an image scanner, a laser printer, and a kit for etching PCBs [Printed Circuit Boards]. And it will only take you a couple of hours. The techniques are actually several years old and are readily available on the Internet."
The very first step in the process — lifting the fingerprint — seems incredibly easy.
Starbug turned a fingerprint left on the display into a computer image file by scanned his own iPhone 5S. He then inverted and mirrored the file in black and white, and printed it to tracking paper. After that, exposed the fingerprint in a PCB, then developed and etched it. Finally, after applying graphite coating on it, the hacker made a dummy print from wood glue.
The dummy print can then be put onto any finger and used to unlock the phone.
The hack has already been reproduced by others. Lookout's security expert Marc Rogers tried it himself and reported his method and findings in a blog post. For Rogers, however, reproducing the attack wasn't as easy.
"Hacking Touch ID relies upon a combination of skills, existing academic research and the patience of a Crime Scene Technician," he wrote in the post.
Another group of hackers at Security Research Labs replicated the hack following Starbug's technique. In this case, the group was able to lift a fingerprint without a scanner; it just used an iPhone 4S camera, as you can watch here.
The group reached the same conclusion as Starbug: Fingerprints aren't a safe way to authenticate a user.
"Users leave copies of their fingerprints everywhere; including on the devices they protect," the group wrote in a blog post. "Fingerprints are not fit for secure local user authentication as long as spoofs ('fake fingers') can be produced from these pervasive copies."
Do you trust Apple's Touch ID fingerprint security more than using a passcode? Share your thoughts in the comments below.
Image: Glenn Chapman/AFP/Getty Images
অনলাইনে ছড়িয়ে ছিটিয়ে থাকা কথা গুলোকেই সহজে জানবার সুবিধার জন্য একত্রিত করে আমাদের কথা । এখানে সংগৃহিত কথা গুলোর সত্ব (copyright) সম্পূর্ণভাবে সোর্স সাইটের লেখকের এবং আমাদের কথাতে প্রতিটা কথাতেই সোর্স সাইটের রেফারেন্স লিংক উধৃত আছে ।