How to get past the fingerprint-scanner of the iPhone 5S:

[DetlefK]

The german hacker-community CCC (Chaos Computer Club) has found a way to trick the fingerprint-scanner of the iPhone 5S: Steal the fingerprints and print them on a transparent foil. They method is actually pretty old. They admitted, they only had to increase the resolution.

They also lambasted Apple for even considering something that unreliable as a security-measure.

Step 1: make a digital photo of the fingerprint

Step 2: enhance quality with software (and adjust for size)

Step 3: print on a transparent foil

Step 4: spread a very thin layer of glue or latex-milk on the foil; the liquid will amass on the printed areas, forming a relief when solidifying

Step 5: carefully moisturize the relief a little bit before use


http://www.spiegel.de/netzwelt/netzpolitik/fingerabdruck-scanner-ccc-hackt-apples-touch-id-a-923797.html

[Renew Deal]

1. Isn't it easier to use the threat of bodily harm?

To compel the person unlock it?

What about getting someone drunk and pressing their finger on it?

[DetlefK]

2. Yes, if you happen to have person and smartphone in the same place.

But the victim could always suspect that someone tampered their iPhone.

[Paulie]

3. It's still better than a PIN or nothing at all

It's easy to get through a PIN if it's not set to wipe the device, just look at the screen smudges, and people will often start with 19... Swipe PINS are even easier as the smudge goes between numbers and persists longer even with use.

[dipsydoodle]

4. Its a gimmick.

So treat it as such.

[trumad]

5. Exactly

a pretty convenient gimmick if you ask me.

Everyone is all in a huff about this gimmick---but hell....it's just as secure as the four digit code.

[dipsydoodle]

6. Next up

may be farting on the screen or something equally ridiculous.

[trumad]

7. That would be hard to hack.

[DetlefK]

9. AFAIR the tongue-surface is also unique for each person.

Of course it's unhygienic, but on the other hand it's hard to steal and useless for any other purposes.

[Stargazer09]

8. That "feature" is the reason I won't buy the 5s

I love my current iPhone. It's given me four years of reliable service, but it's starting to have trouble recognizing input and loading apps. It's time for a new one, and I was very interested in the 5s.

I really do not want my fingerprints stored on any device. I know the government has them, due to my military service, but I have to have a little faith that their data systems are a little more secure than Apple's.

The 5c isn't as powerful as the 5s, but it doesn't collect and store my fingerprints, and I'm sure it will be a better phone than the aging one I have now.

[frazzled]

10. First of all, it's optional on the 5s, second, the phone doesn't store your fingerprint

All this stuff about "hacking" your fingerprint and reusing it is apparently bull:

. First of all, there's a dedicated "enclave" in the iPhone 5s processor that's used solely for the purpose of storing encrypted data related to Touch ID. Its only connection to the rest of the iPhone's hardware is a function to say, "Touch ID check OK/Fail." The notion that someone could grab this data via a Bluetooth connection is ludicrous Hollywood "hacking" BS.

Second, the iPhone doesn't actually store fingerprint data in the first place. The iPhone 5s maps your fingerprint and converts that into a string of data (a one-way hash), then holds onto that chunk of data. The next time you put your paws on the phone, the same hashing process produces another data chunk; the two chunks -- not the two fingerprint images -- are matched up to allow access. In fact, assuming the hashing process works the same way as it does for existing iPhone passcodes, the fingerprint data is encoded in a way that's specific to that individual phone (salted). Copying it anywhere else would be useless. [Have we been hearing about hacker gangs remotely stealing iPhone passcodes via magical processes to use them elsewhere? No, we have not -- and if we had, it would almost certainly be via social engineering or visual spying as the phone is unlocked, both of which are impossible with Touch ID. –Ed.]

Anyone who somehow managed to access the iPhone's Touch ID circuitry and extract the hashed data would just find a string of alphanumeric gibberish, not a 3D-printable set of whorls and ridges ready to be turned into a latex Mission:Impossible-style fake finger. My TUAW colleague Dr. Richard Gaywood, who knows a thing or two about this stuff, says turning that data back into a readable fingerprint "would be like taking a cake, eating half of it, smashing the rest up with a fork, then giving it to someone and asking them, 'How much did the whole cake weigh, and what message was written on the icing that was on top of it?' "

http://www.tuaw.com/2013/09/22/iphone-5s-fingerprint-sensor-gets-completely-misunderstood/

[Stargazer09]

11. Oh, okay

I guess I stand corrected.