Chaos Computer Club breaks Apple TouchID

Post by andreyf » Sun, Sep 22, 2013, 11:33 PM UTC

s_q_b wrote: post #146

lawnchair_larry wrote: post #62

Earlier quoted context omitted.

Really, how do you trivially break a passcode on an iOS device? There is a way that I know about, and it is very much non-trivial.

Just use brute force or dictionary attack over the wire. Given that most users use 4-digit pass codes, this can be done usually in minutes, almost always in less than an hour. Or, if your target is paranoid and uses a very long passcode, target the charger rather than the device itself. iOS assumes any physical device to which it is connected when unlocked is secure. Replace the usb brick with a small computer (e.g.…

Post by smrtinsert » Sun, Sep 22, 2013, 11:35 PM UTC

siglesias wrote: post #186

jonknee wrote: post #166

Earlier quoted context omitted.

Here's Apple's main marketing text on the subject: > Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. It is definitely intended to replace passwords. Pretty good security would be to requir…

"you don’t have to enter your password" != "you don't need a password" As I understand it every now and again Apple will prompt you to enter your passcode/password, such as when you restart your device or if you haven't unlocked it in two days. Hardly a signal that passwords are done.

Post by abalone » Sun, Sep 22, 2013, 11:46 PM UTC

JohnDotAwesome wrote: post #239

abalone wrote: post #233

Earlier quoted context omitted.

> Pretty good security would be to require both the fingerprint and a PIN You're missing the point. Right now lots of people have no password at all. Touch ID is a big improvement over having no password.

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article at all (not a single damn word), so maybe the hack only applies to phone unlocks. If that is not the case however, then I think _you_ are missing the point. This would compromise all passwords replaced by finger print scans, right?

Post by javajosh » Sun, Sep 22, 2013, 11:55 PM UTC

Steko wrote: post #238

abalone wrote: post #155

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of…

This seems correct. Apple's moved the bar to breaking into those phones from having the phone and a 4 digit or no passcode to having: -- the phone -- a 2400 dpi resolution image of the correct fingerprint -- a 1200 dpi laser printer & transparent paper -- pink latex milk or white woodglue -- a non-trivial amount of time

Post by solarmist » Mon, Sep 23, 2013, 12:05 AM UTC

vdaniuk wrote: post #219

mike-cardwell wrote: post #173

Earlier quoted context omitted.

I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security. I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint. I'd also be willing to bet that these figures are…

But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.