Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Hello bypassed using infrared image

therecord.media

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Windows Hello bypassed using infrared image

#41

Post by user-the-name »

mavhc wrote: post #38
quenix wrote: post #32

Earlier quoted context omitted.

A few thoughts: Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital. This is contrasted to Samsung and Microsoft'…

iPhone X(box Kinect) Still nowhere near as secure as they make out though

What vulnerabilities are you referring to?

Re: Windows Hello bypassed using infrared image

#42

Post by user-the-name »

mrjin wrote: post #24

The problem is really how can we be sure that a device claimed to be a camera is really a camera and can be trusted? But yeah, as the device is already physically compromised, there is not much can be done in OS' perspective.

A "physically compromised" iPhone will still not let you in, no matter what devices you plug into it, including removing the camera module and replacing it.

Re: Windows Hello bypassed using infrared image

#43

Post by mavhc »

user-the-name wrote: post #41
mavhc wrote: post #38

Earlier quoted context omitted.

iPhone X(box Kinect) Still nowhere near as secure as they make out though

What vulnerabilities are you referring to?

If you have relatives that look like you the chance goes down from one in a million. And they're also the most likely people to have access to your phone, and by interested in what's on it.

Also the younger you are the less likely it is to differentiate.

Re: Windows Hello bypassed using infrared image

#44

Post by andrewmackrodt »

SilverRed wrote: post #21
chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Windows Hello does require an IR camera AFAIKA, so a "basic webcam" is not enough. However, it's not clear if this exploit would still work if the custom USB device presented a moving IR video as opposed to a static image.

Re: Windows Hello bypassed using infrared image

#45

Post by lrvick »

gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device.

QubesOS does this by quarantining your USB controllers in a dedicated virtual machine.

https://www.qubes-os.org/doc/usb-qubes/

Usb-guard for Linux also uses kernel features to accomplish similar.

I dont know of any methods to do this on MacOS or Windows though.

Re: Windows Hello bypassed using infrared image

#46

Post by vladvasiliu »

gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?"

There's USBGuard on Linux that seems to do some of this. Can't vouch for it, as I've never used it, though.

https://wiki.archlinux.org/title/USBGuard

https://github.com/USBGuard/usbguard

Re: Windows Hello bypassed using infrared image

#47

Post by hnbad »

quenix wrote: post #32
stinos wrote: post #31

Earlier quoted context omitted.

Can you explain why Apple's implementation is semi secure and others' implementations aren't? All of them have been bypassed at one point or another IIRC but that's probably not what you mean? (also: if it's semi secure then being able to build trust based on that means the other part is PR I guess, outrageous as well?)

A few thoughts: Apple's Face ID takes a 2-dimensional infrared image of your face as well as projects 30,000 IR dots to form a 3D depth map of the face. It feeds this into a NN in a separate Secure Enclave processor to determine whether the face is attentive and authorised. I believe they also implement specific NNs just to perform anti-spoofing, both physical and digital. This is contrasted to Samsung and Microsoft'…

Microsoft's solution requires an (near) infrared camera and will not accept a regular USB camera, though. But it does seem to rely on simple facial recognition rather than building a depth map. The main use of the near infrared seems to be to work around lighting issues and simple spoofing though.

https://docs.microsoft.com/en-us/windows-hardware/design/dev...

Re: Windows Hello bypassed using infrared image

#48

Post by colejohnson66 »

mavhc wrote: post #37
tyingq wrote: post #26

Earlier quoted context omitted.

Yes, you could prompt for every USB device detection. You would have to do that on boot too, though, which would probably give users security notice fatigue. There's basically no persistence, serial numbers, etc.

What input device do you use to accept the prompt?

A PS/2 mouse would work, but who has those anymore?

Re: Windows Hello bypassed using infrared image

#50

Post by djrogers »

user-the-name wrote: post #42
mrjin wrote: post #24

The problem is really how can we be sure that a device claimed to be a camera is really a camera and can be trusted? But yeah, as the device is already physically compromised, there is not much can be done in OS' perspective.

A "physically compromised" iPhone will still not let you in, no matter what devices you plug into it, including removing the camera module and replacing it.

I think this comment is being downvoted unfairly - yes, there are mechanisms to get into an iPhone with physical access (see greykey) - but those rely on leveraging a vulnerability to allow brute forcing the PIN, they do not break FaceID.
Post reply on HN