iPhone X Face ID Again Unlocked with Mask, Even with “Require Attention” Turned On

Megalith

Megalith

24-bit/48kHz
Staff member
Joined
Aug 20, 2006
Messages
13,000
Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Now, Bkav has shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.

Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars’ worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.
 
I think it's also fair to assume that people (criminals, government, whatever) who are interested in this method will almost certainly have access to a 3d printer and a decent camera. The remark about requiring physical access is just...odd. If you want to call that a "deterrent", then having no locking feature at all has security because they still need your phone. Is this ever going to be a widespread problem? Almost certainly not. It does show that the security isn't as great as claimed though, and should you and/or your business transactions prove to be worth the time and effort involved then you should perhaps think about using a different security system on your phone.
 
Paladin21 said:
I think it's also fair to assume that people (criminals, government, whatever) who are interested in this method will almost certainly have access to a 3d printer and a decent camera. The remark about requiring physical access is just...odd. If you want to call that a "deterrent", then having no locking feature at all has security because they still need your phone. Is this ever going to be a widespread problem? Almost certainly not. It does show that the security isn't as great as claimed though, and should you and/or your business transactions prove to be worth the time and effort involved then you should perhaps think about using a different security system on your phone.
Click to expand...

Tap the power button five times when you get arrested, then the cops need your passcode.
 
Again, I'm not saying it's worthless or there aren't ways to work with the system, I'm saying that it isn't as bulletproof as advertised and consumers should realize this. Also, do you really want to trust your privacy against law enforcement to having time and presence of mind to hit the button? I can think of all sorts of scenarios in which that might not be the case (or you get shot/tased for failing to drop your crap and put your hands up).

There's no perfect security. This demonstrates flaws in FaceID. Consumers should be aware of this and know what the security parameters actually are instead of just blindly accepting the marketing-speak about how unbreakably awesome it is.
 
Paladin21 said:
I think it's also fair to assume that people (criminals, government, whatever) who are interested in this method will almost certainly have access to a 3d printer and a decent camera. The remark about requiring physical access is just...odd. If you want to call that a "deterrent", then having no locking feature at all has security because they still need your phone. Is this ever going to be a widespread problem? Almost certainly not. It does show that the security isn't as great as claimed though, and should you and/or your business transactions prove to be worth the time and effort involved then you should perhaps think about using a different security system on your phone.
Click to expand...

Don't even need a decent camera as the people likely targeted for this are out in public a lot anyways. Hey I just stole Jennifer Lawrence's cellphone! Let's visit Google Image Search! Plenty of photos around to reconstruct the face of celebs and other important people. So all you really need is a 3d printer and a stolen phone.
 
Why 3d print when a manequin head and some clay will do?

Dang kids and their fancy spool medium printers. Spirograph from jelly I say
 
viper1152012 said:
Why 3d print when a manequin head and some clay will do?

Dang kids and their fancy spool medium printers. Spirograph from jelly I say
Click to expand...

Well clay won't do. In the previous video the guy pointed out that the mask was shaped from multiple 2d image sources and then dicked with with the silicone skin that looks liek an attempt to replicate bandages to me. This one they specifically omitted that and the mask looks of MUCH higher quality and accuracy. I suspect beyond the fact you aren't 3d printing in stone as they mentioned on some cheap 3d printer, that they have also added 3d scanning to the process as well as adding infrared imaging to the process.
 
Wouldn't police or a robber just point the phone at your face after they carefully clubbed the back of your skull? Never the front, duh.
 
remember when you're a kid and you watched spy movies where iris ( and face) scanners are mentioned to be able to detect capillaries and blood flow, so as to not be easily fooled.

this so called problem and fix had been thought of how many decades before now?
 
You must log in or register to reply here.
Back
Top