Bypassing facial recognition: The means, motive and opportunity
Researchers bypassed Apple's facial recognition authentication program, Face ID, in under a week. Expert Michael Cobb explains why it's not a major cause for concern for users.
Anyone who has just invested in a high-end smartphone that uses facial recognition to protect its contents from prying eyes or digital spies might be worried by news reports that access controls based on facial recognition can be defeated. For example, a team of researchers at Bkav Corporation, a Vietnam-based security company, was able to physically construct a mask that fooled Apple's Face ID. The researchers did so within a few days of getting their hands on an iPhone X, despite its use of AI and 3D infrared mapping.
Security-minded users may well be concerned about the level of risk this presents to their data or that of their employer. Regular readers of newsfeeds related to cybersecurity are likely to have developed their own heuristics for assessing the risk factors of fresh vulnerabilities, but for those who haven't, there are three main factors to consider.
Means
There is no need to panic every time a headline declares that a particular control has been defeated.
The of these factors is cost, the monetary value of all the resources needed to mount an attack exploiting the vulnerability, including hardware and software, plus human effort and knowledge. For example, what was the likely cost of the actual mask that defeated Face ID's facial recognition technology? According to Bkav, the mask was built using "a 3D-printed frame, a handmade silicone nose and some 2D pictures layered on top of the mask." This is certainly more costly than just using a photograph of the phone's authorized user -- a technique that was found to be effective against early, 2D facial recognition systems.
However, this cost could be deemed low relative to a high-value target, like the iPhone of a financial services CEO who has the power to authorize large wire transfers, or possesses inside information that could influence share prices. But there is more to cost than physically constructing the mask. According to the CEO of Bkav, Nguyễn Tử Quảng, making a successful mask requires specialized knowledge. He said he and his team were able to trick the AI that Apple developed for Face ID, "because we understood how their AI worked and how to bypass it." This type of knowledge takes time to acquire. Bkav reseachers have been working in this field for more than a decade; they presented research on defeating facial recognition software at Blackhat Europe 2009.
Motive
At this point, the cost of the attack is looking quite high, and it has a corollary in the second risk heuristic factor: motive. As in, what would motivate someone to expend resources on attempting to access a particular phone without permission? For the aforementioned financial services CEO, the answer may be obvious and a top-of-mind concern, but many people walk around in causal ignorance of how useful their phones could be in the commission of a wide range of high-value crimes, like theft of intellectual property, remote network penetration, social engineering of senior executives and so on, which brings us to the third factor: opportunity, the conditions that need to be met before the attack can be carried out.
Opportunity
Unlike brute-forcing the password on an internet-connected server, defeating facial access control on a smartphone requires the attacker to have physical access to the device. Not only that, they need detailed knowledge of what the owner looks like. They also need to be able to defeat the access control before the owner remotely wipes the device. Creating opportunity by meeting all three conditions is by no means impossible, but it is challenging, and, when considered together with the cost and motive factors, it strongly suggests that attacks on Face ID are not going to be carried out at scale. For those who do think that they may be at risk, possible defensive measures include quick access to remote tracking or wiping of a stolen or missing smartphone. A further defensive measure for high-risk targets would be to keep sensitive data and valuable credentials off any phone that will be used in a high-risk environment.
While "hacking your face" may sound like an extreme attack, and guessing passwords is old news, using both authentication methods instead of just one will always be more secure. Keep in mind that Face ID itself does not constitute two-factor authentication. If a system grants access based purely on a biometric -- like faces, fingerprints, signatures or voiceprints -- that is single-factor authentication using just one of three factors, something you are. The others are something you know, like a password, and something you have in your possession, like a physical key. The point of requiring two factors -- for example, your face and your PIN -- is to increase the effort and cost required to obtain unauthorized access. At present, the iPhone X does not allow users to require both to access the phone.
The recognition to be gained from defeating security measures based on biometrics means the industry can expect researchers to continue to look for weaknesses, from false positives, a realistic mask of a face, to false negatives, a real user being adjudged to not look closely enough like themselves. But there is no need to panic every time a headline declares that a particular control has been defeated, just apply the cost-motive-opportunity model and adjust the risk assessment accordingly.
