Pierluigi Paganini September 23, 2013

Chaos Computer Club claims to have bypassed the biometric security technology Apple TouchID by making a copy of a fingerprint photographed on a glass surface.

Hackers members of the Chaos Computer Club claim to have defeated Apple TouchID fingerprint sensor for the iPhone 5S, just after the start of its sale to the public. The Chaos Computer Club in Germany announced late Saturday to have successfully bypassed the biometric security on the Apple’s Touch ID fingerprint sensor by using materials that can be found in almost every household, it seems that they made it by photographing an iPhone user’s fingerprint from a glass surface and using that captured image to verify the user’s login credentials.

The hack is embarrassing, in recent days a series of bugs and security issues were found on the last version of the popular Apple OS, iOS 7, in particular the lockscreen features is affected by serious flaws.

The Apple TouchID it the technology developed by Apple to replace passcode on its mobile and help protect users’ devices, it is based on a sensor placed under the home button and it is designed to substitute the four-digit passcode to unlock the handset and authorize iTunes Store purchases.

“Your fingerprint is one of the best passcodes in the world. It’s always with you, and no two are exactly alike. Touch ID is a seamless way to use your fingerprint as a passcode. With just a touch of the Home button of your iPhone 5s, the Touch ID sensor quickly reads your fingerprint and automatically unlocks your phone. You can even use it to authorize purchases from the iTunes Store, App Store, and iBooks Store.” advertise Apple.

But is it really so? Apple TouchID technology had caused a lot of controversy in recent days, according to some experts it is a threat to privacy being used to manage fingerprint users. The Snowden case and the revelations about the PRISM surveillance program brought down the confidence of users in companies that have been overwhelmed by the scandal, Apple included.

Now the hackers at popular Chaos Computer Club have demonstrated the inadequacy of the proposed solution even in technical, the Apple TouchID could be avoided as they have written in a blog post:

“This demonstrates — again — that fingerprint biometrics is unsuitable as access control method and should be avoided,” the group wrote in a blog post detailing its bypass:

First, the fingerprint of the enrolled user is photographed with 2400 dpi resolution. The resulting image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting. Finally, pink latex milk or white woodglue is smeared into the pattern created by the toner onto the transparent sheet. After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone. This process has been used with minor refinements and variations against the vast majority of fingerprint sensors on the market.

“We hope that this finally puts to rest the illusions people have about fingerprint biometrics,”  “It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token.” added CCC spokesperson Frank Rieger.

According the hackers at the Chaos Computer Club the new Apple Touched sensor has just a higher resolution compared to the previous version, the hacker with nickname Starbug remarked that fingerprints should not be used to secure anything.

Following a video posted on the hack:

At this point the only question to be clarified is if the hackers will claim to the bounty of more than $16,000 in cash offered to the first person to hack the Apple TouchID fingerprint sensor.

IsTouchIDhackedyet.com is the brainchild of Nick DePetrillo, an independent security researcher whose last major public research was 2010’s Carmen San Diego Project, it announced on its Web site that it was waiting for the group to upload video of the hack as proof of the hack.

Rewards include also a patent application from CipherLaw for the hack process, some Scotch, and a book of erotica.

Lesson learned … nothing is secure!

Pierluigi Paganini

(Security Affairs –  Apple TouchID, privacy, hacking)