Is iPhone X Face ID foolproof? Vietnamese researchers claim to have found a chink.

The News Minute ^ | Monday, November 13, 2017 | IANS

[ImJustAnotherOkie]

Using a 3D printer, the team at Vietnamese security firm Bkav created a mask that managed to fool Apple’s Face ID authentication system.

Using a composite 3D-printed mask, a team of Vietnamese researchers claim to have fooled Apple's Face ID authentication system in "super-premium" iPhone X, stressing that face recognition is "not mature enough" to guarantee security for smartphones.

At iPhone X launch event, Apple's Senior Vice President Phil Schiller had claimed that Face ID can distinguish human's real face from masks, thanks to its artificial intelligence (AI).

Using a 3D printer, the team at Vietnamese security firm Bkav created a mask that cost them $150.

"Nose was made by a handmade artist. We use 2D printing for other parts (similar to how we tricked Face Recognition nine years ago). The skin was also hand-made to trick Apple's Artificial Intelligence," Bkav said in a blog post.

"The mask is crafted by combining 3D printing with makeup and 2D images, besides some special processing on the cheeks and around the face, where there are large skin areas, to fool AI of Face ID," said Ngo Tuan Anh, Bkav's Vice President of Cyber Security.

The Bkav security experts who also posted a video on how they did this, said that Face ID can be fooled by mask, which means it is not an effective security measure.

In 2008, Bkav was the first company in the world to show that face recognition was not an effective security measure for laptops when Toshiba, Lenovo and Asus used this technology for their products.

"Many people in the world have tried different kinds of masks but all failed. It is because we understand how AI of Face ID works and how to bypass it," the firms said on its FAQ page.

"In the future, we might use smartphones with 3D scanning capabilities (like Sony XZ1); or set up a room with a 3D scanner, a few seconds is enough for the scanning (here's an example of a 3D scanning booth)," it added.

Face ID projects more than 30,000 invisible IR dots and claims to only unlocks iPhone X when customers look at it and is designed to prevent spoofing by photos or masks.

Apple's Face ID technology uses a TrueDepth camera system made up of a dot projector, infrared camera and flood illuminator, and is powered by A11 Bionic to accurately map and recognise a face.

According to the firm, the recognition mechanism is not as strict as one thinks and Apple seems to rely too much on Face ID's AI.

"We just need half a face to create the mask. It was even simpler than we ourselves had thought," Bkav said.

According to the firm, if exploited, Face ID can create problem.

[Swordmaker]

The title is the only thing that made it worth posting.

there I agree with you. . . what was the headline editor thinking? He may be out of a job before the end of the week. LOL!

At least he didn't call the researchers Charlies. . .

[Swordmaker]

One thing I just noticed looking at the photo above. What Bkav calls a 3D printed frame is not a printed anything. It shows no signs the typical artifcacting one would expect from a 3D printer. Instead you see what appear to be fiberglass or even plaster tape criss-crossed and even the cut outs show some ravels of the fibers. It's almost as blatant as a mummy's wrappings. Even the right-eye seems to have been crumpled before being placed into the cut-out in the "3D frame," as there are what appear to be creases running across the forehead, brow, and bridge area that run into the white taped area. There is no way that a 3D sensor would not pick up these edge ridges of the tapes.

A 3D printer does not criss-cross like this pattern shows, but rather makes raster line passes over the stage. IF this is a 3D printer made frame, it was made from a plaster mould of the persons face, but the outside of the mould, showing all the plaster tapes' rough edges. Not from the fill mould made from the inside of the plaster primary mould. This thing STINKS to like three week old fish.

No matter how hard I look, I cannot find anywhere where the "artist" applied skin texture might be located. . . especially on the cheeks as Bkav related. Nor can I see anything specially processed about the area above the bridge of the nose. This is all "smoke and mirrors" to explain why no one else can successfully replicate their hack. "You failed because you did not "specially processor, wrong 2D eyes, (etc) that area as we did. That's obviously why your attempt failed. Keep trying."

[Mark17]

At least he didn't call the researchers Charlies. . .

Or VC. Hey, my wife is Asian, not oriental, and I can assure you, they don’t all look alike. 😆🤠🤯🇵🇭

[BradyLS]

Ha, ha! I saw what they did there!

[SunkenCiv]

Yeah, it’s not much of an exploit, even if true. What does the hacker do, slip me a roofie, then take a mold of my face? Then what? Break into my house or car once in a while to use my phone?

[Chgogal]

Fox business showed two cases. The worst, the 10 year old son opened up his mother's iPhone X. Then a cyber security guy said the iPone’s security is bad. : (

[JohnyBoy]

>Fox business showed two cases. The worst, the 10 year old son opened up his mother’s iPhone X. Then a cyber security guy said the iPone’s security is bad. : (

That’s actually an indication that the phone works well. It was able to recognize the features of the son as closely matching the mother’s features and thus unlocked.

[Swordmaker]

Then a cyber security guy said the iPone’s security is bad. : (

The "Cyber security guy" is actually the VP of an Android phone maker who sells a competing phone called the BPhone which uses a fingerprint sensor they claim is better. . . but his demo is a hoax. See a thread on that here with an explanation of why it's bogus:

Face ID beaten by mask, not an effective security measure (with Video)

His mask is a joke looking like the user was swathed in mummy like bandages when he trained his iPhone X. . . and likely was. It has tape like ridges all over it that would make a true 3D sensor raise red flags all over the place.

Both Apple and Wired Magazine, and now the Wall Street Journal used professional accurately made masks that were indistinguishable from the real persons, not amateur jokes like this one, and all failed to unlock the owner's iPhones.

Apple's Hollywood Professionally Made Test Masks

"WE TRIED REALLY HARD TO BEAT FACE ID—AND FAILED (SO FAR)—Wired Magazine's Mask Tests of FaceID

Wall Street's YouTube iPhone X FaceID Testing

Except for Apple, these are independent tests. . . not a self-serving competitor.

Bkav, the phone maker, claimed that they based their hack by noticing that you could cover over 50% of your face and the iPhone would still unlock. That is completely false. I've tried it with various portions of my face 50% covered and my iPhone X WILL NOT UNLOCK. However, if one TRAINS one's iPhone with one's face covered, then it is MUCH more forgiving of a partial face.

No one has been able to replicate his hack using his description of how to do it, despite his claims of how easy it is. . . indicating it is a hoax.

I think that is possibly what that mother and son did. I notice their eyes are very similar. Train the iPhone to recognize only the eyes, and it will unlock for similar eyes.