Chaos Computer Club breaks Apple TouchID

Really? You think a four digit security code that users have to enter repeatedly is more secure than obtaining a 2400 dpi clean image of a specific fingerprint and a nontrivial lab procedure? It might require some patience but if you have an excuse for being around the target, it doesn't require great skill to see the digits as they are entered. In either case the adversary has to deal with Activation Lock which has been introduced with iOS7.

I've read there is already something like 35% adoption of iOS7 so we may see soon how effective Activation Lock is at deterring theft.

This doesn't really translate to an everyday attack vector.

They had to have served the minister a drink that would not cause precipitation to form on the surface of the glass and specifically target him. Then you need to actually process the print.

A better measure would be how easy it is to lift a usable print from a crime scene. But even this has problems. You need to target a person to know whose prints you have.

If you just randomly pick pocket a phone. How do you get the print? How do you identify which finger was used? You need to get lucky or get 10 good prints.

I agree with others. The real question here is, "Is this better than no password?" I think the answer is, yes.

They're clearly referring to storing some kind of "hash"/mathematical representation of your fingerprint vs a plain photo/"digital image".

(Huge discussion here - lets add to it. ;-)

There are several things here that people in discussion seems to miss och confuse. I've been working with biometrics and can at least try to clear things up.

For authentication (and identification) of a user we have three types of information: Things you have (a hard token generator), things you know (password) and things you are (shape of face, gait, voice, pattern in the iris, arteries in the back of the eye, hand, DNA. And fingerprints). Measuring what you are info and using it is called biometrics.

For good security we normally want to have a combination of at least two of the types. OpenID using for example a Yubikey is a good example.

The good thing with biometrics is that the user always carry the info needed with him/her. There are a few drawbacks though:

(1) The information is not very stable. It changes during the lifetime of the user. Sometimes it can be pretty rapid.

(2) The information is not very unique. Some types of biometrics is better than others. There is also differences in informational quality between individuals and ethnic groups. Depending on type of biometrics we get anything from a few bits to a few ten of bits. This means that it is not better than a good password that is 8 characters or more, but as good as or a bit better than a normal PIN code.

(3) The information is not under the users control and can't readily be replace. This is one thing many here and elsewhere seem to have missed in the CCC announcement. The point is that you as a user can't decide at any given time that you don't trust you token anymore, invalidate it and get a new token. That is why biometrics is foremost a tool _for others_ to identify you (passports, forensics).

The reason fingerprint based biometrics is so popular (compared to other types of biometrics) is that it is possible to build compact, cheap sensors that are pretty easy to use and are simple to integrate into digital systems.

All types of biometrics are fuzzy. We normally talk about False Acceptance Rate (FAR), that is how often do we accept a biometric ID as valid when in fact it is not. And correspondingly we have False Rejection Rate, where a valid ID is rejected. Good biometric systems have FAR, FRR under 10%. But for a busy airport there is still quite a few mistakes during a day.

The way a fingerprint based biometric system normally works is that you have a sensor that creates an image (256 levels of gray scale or similarly). The image is then processed (differential filters etc) followed by feature extraction. The features are called minuae:

https://en.wikipedia.org/wiki/Minutiae

Typically sworls, where lines end, merges splits. Normally we find 8-10-15 or a few more good minutae in the image. Based on the location of the minutae we create a graph.

The graph is then stored (if registering a user - called enrollment) or compared to stored graphs. And here comes the fuzziness. The graph will not be similar so we simply can't do a SHA-1 digest and match. The graph will be rotated, scaled, stretched, have fewer or more points. Basically fuzzy congruence matching with threshold.

The feature extraction can be done directly in the sensor. But in the case of TouchID I don't think so. Apple bought Authentec and their area sensors (that can capture a whole image directly. Sweep sensors detect movement of a finger over the sensor, estimate speed and stitch image slices together) simply delivered a raw image. This means that the filtering, feature extraction and matching is done inside A7.

Apple has touted the security of the processing. Basically it is ARM Trust Zone used in several other devices.

http://www.arm.com/products/processors/technologies/trustzon...

TZ is good, but there has been attacks published. And there is nothing that says that Apple has not added a read port from the untrusted enclave into the memory of the trusted enclave. For efficient debug reasons for example.

So. Biometrics is fuzzy and will give false acceptance (as the main problem. rejextion is less of a problem). There is quite probably an image available in the A7 and we really don't know if it and/or the graph database is in fact accessible.

When it comes to the CCC attack - we simply don't know if they tried lower resolution before ending up with 2400 dpi. I wouldn't be surprised if it works (at least sometimes - fuzziness again) with lower resolution. Also attack always gets better. I'm prepared to bet a good IPA that someone within 2 years will show how he/she can unlock a 5S just by smartly pressing on the home button while breathing to activate residue as fingerprint. It has been done with area sensors such as Authentecs before.

TouchID is good if it makes users without PIN to use it. But if it gets users with PINs stop using PINs, it is not as good. What would be great if we could combine TouchID with PIN or password. All the time.

I hope all this explains a few things. And remember, once again, the main problem with biometrics is that it can't be changed at will by the user. Good for others, less so for the user.

It's a shame really, because all evidence is fuzzy on some level. DNA could be planted, videos can be a of a lookalike, or being at a particular location at a particular time could be a coincidence. I don't know exactly how law enforcement works, but they really should be looking for connections and try to explain why a suspect is not the right guy, instead of the other way around. Maybe that is just wishful thinking.