Apple's fingerprint sensor on new iPhones successfully hacked days after going on sale
Germany's Chaos Computer Club warns that Touch ID is not safe, showing in a video how prints lifted from a glass bottle can fool Apple's biometrics
Monday 23 September 2013
A group of German hackers known as the Chaos Computer Club (CCC) have successfully cracked Touch ID, the fingerprint sensor used to secure Apple’s new iPhone 5s. The hack was announced just two days after the smartphone went on sale.
In a post on their blog, the Chaos Computer Club provided details (including a video above) of their method. “A fingerprint of the phone user, photographed from a glass surface, was enough to create a fake finger that could unlock an iPhone 5s secured with Touch ID.”
The news will be worrying to businesses that may have hoped to secure company phones using Apple’s new technology, but will be of little surprise to the online security community, who have been sceptical about Touch ID since its introduction.
"In reality, Apple's sensor has just a higher resolution compared to the sensors so far. So we only needed to ramp up the resolution of our fake,” said a Computer Club hacker known as Starbug. "As we have said now for more than years, fingerprints should not be used to secure anything. You leave them everywhere, and it is far too easy to make fake fingers out of lifted prints."
The technique used by the CCC have been known for years and can fool nearly all fingerprint sensors, but the group did not access the copy of the print stored by the iPhone itself.
Apple’s own website describes individuals’ fingerprints as “one of the best passcodes in the world. It's always with you, and no two are exactly alike”, noting that the Touch ID system can be used to “approve purchases from the iTunes Store, the App Store and the iBooks Store”.
The method used to crack Touch ID has been detailed by the Chaos Computer Club on their website, with the process beginning by finding a fingerprint left on an object like a glass bottle. The fingerprints are made mostly comprised of fat residue and sweat and can be highlighted by sprinkling surfaces with coloured powders.
Cyanoacrylat (“the main ingredient of superglue”) is then applied to the print to sharpen its outlines. This is photographed at a 2400dpi resolution, imported into a computer, cleaned up with imaging software and then printed out at 1200dpi resolution onto a transparent sheet. Woodglue or latex is then smeared on the print to create a duplicate and left to dry. This can then be used to gain access to the iPhone 5s.
Frank Rieger, spokesperson of the CCC, said “We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can't change and that you leave everywhere every day as a security token.”
Although the CCC has successfully tricked the Touch ID sensor, their hack did not retrieve
A pair of security experts who set up a competition with a crowdsourced cash reward for the first individuals to hack Touch ID have said they are awaiting further information before confirming the method.
"We are simply awaiting a full video documentation and walk through of the process that they have claimed," Nick DePetrillo, a mobile security researcher told Reuters, "When they deliver that video we will review it."
Apple has yet to respond with comment.
Life & Style blogs
Watch what happened when food critics were unknowingly served McDonald's
From Miley Cyrus' bondage outfit to Rihanna's nipple pasties: Who wore what at the amfAR Inspiration Gala
Manuel Noriega fails in bid to sue Call of Duty makers for using his likeness in video game
Sex with more than 20 women 'reduces risk of prostate cancer'
Six months on bail – for being sent spoof video of a ‘tiger’ having sex, that was really a man in a tiger suit
Pope Francis declares evolution and Big Bang theory are real and God is not 'a magician with a magic wand'
Huge surge in Ukip support after EU funding row, according to new poll
Ukip ‘exploiting grooming scandal’ to secure party’s first police chief
Nigel Farage: 'There’s nothing wrong with white people blacking up'
Muslims, immigration and teenage pregnancy: British people are ignorant about almost everything
Nigel Farage and Frankie Boyle clash over Andrew Lawrence's 'Mock the Week' criticism
- 1 2015 General Election: Green party will not appear in TV debate alongside Ukip – says BBC
- 2 Canadian actor punched in face after 'Islamophobia' experiment goes wrong in wake of Ottawa shooting
- 3 Topshop at centre of row over body image as 'shocking' skinny mannequin photo goes viral
- 4 Kentucky gang rape: 15-year-old boy left in critical condition after sexual attack by group at party
- 5 Of course, teenage girls need role models – but not like beauty vlogger Zoella
iJobs Gadgets & Tech
£24000 - £25000 Per Annum plus company car and commission: Clearwater People S...
£25 - 32k DOE: Guru Careers: A digital-savvy Marketing Account Manager / Clien...
£23-30k (DOE) + Bonus: Guru Careers: We are seeking bright Business Developmen...
25-30k + Comms + Benefits: Sphere Digital Recruitment: A rapidly expanding tag...