It’s been noted that Apple’s the iPhone X’s Face ID feature can be fooled by an identical twin. Now it looks like a mask might do the trick as well.
On Friday, Vietnamese security firm Bkav released a blog post and video showing that—by all appearances—they’d cracked Face ID with a composite mask of 3-D-printed plastic, silicone, makeup, and simple paper cutouts, which in combination tricked an iPhone X into unlocking. That demonstration, which has yet to be confirmed publicly by other security researchers, could poke a hole in the expensive security of the iPhone X, particularly given that the researchers say their mask cost just $150 to make.
The hack stands as a proof-of-concept for the time being, so the average iPhone owner isn’t at grave risk.
Bkav, offered the following comments:
“Apple has done this not so well. Face ID can be fooled by mask, which means it is not an effective security measure.”
In the following video, one of the Bkav members showed how with the right mask mounted on a stand, the Face ID system could be fooled. In spite of the sophisticated infrared mapping used by Face ID, the group noted that the system seems to focus on the user’s nose, eyes and lips, all of which were printed on paper and mounted on a 3-D-printed plastic frame made from a digital scan of the would-be victim’s face.
The researchers concede, however, that their technique would require a detailed measurement or digital scan of a face of the target iPhone’s owner. The researchers say they used a handheld scanner that required about five minutes of manually scanning their test subject’s face. That puts their spoofing method in the realm of highly targeted espionage, rather than the sort of run-of-the-mill hacking most iPhone X owners might face.
While the average user isn’t especially at risk, the Bkav group as stated that public figures, billionaires, leaders of major corporations, nation leaders, and federal agents need to understand the Face ID’s issue.
“It was even simpler than we ourselves had thought,” noted the group.
The Bkav researchers say they were able to crack Face ID with a cheap mix of materials, 3-D printing rather than face-casting, and perhaps most surprisingly, fixed, two-dimensional printed eyes. The researchers haven’t yet revealed much about their process, or the testing that led them to that technique.
Stay tuned for additional details as they become available.