1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

News Chaos Computer Club demonstrates simple Galaxy S8 iris scanner hack

Discussion in 'Article Discussion' started by Gareth Halfacree, 24 May 2017.

  1. Gareth Halfacree

    Gareth Halfacree WIIGII! Lover of bit-tech Administrator Super Moderator Moderator

    4 Dec 2007
    Likes Received:
  2. edzieba

    edzieba Virtual Realist

    14 Jan 2009
    Likes Received:
    It still boggles the mind that Android does not natively support multi-factor unlock: e.g. fingerprint + PIN, iris + PIN, fingerprint + iris + password, etc. The hell of it is, the functionality is already there and enabled for the first reboot - which requires a PIN/password/pattern to unlock before you can use a fingerprint again, there is just no option to enforce both at every unlock.
  3. GeorgeK

    GeorgeK Swinging the banhammer Super Moderator

    18 Sep 2010
    Likes Received:
    ^Are there apps which enable that?
  4. Guinevere

    Guinevere Mega Mom

    8 May 2010
    Likes Received:
    To be fooled by a flat photograph with a contact on top seems like such a basic hack. Obviously not enough testing was done to see what could be done to bypass the security. How about:

    * Doing a basic check to see if the image is 'mostly flat' not just convex over the iris.
    * Looking for edges of a photograph.
    * Checking if the image is monochrome.
    * Checking the image isn't running on an LCD

    And the really obvious one...

    * Checking to see if the eye is moving. Check for blinks, micro movements etc. Maybe ask for a number of blinks

    Any visible light/ir based scanning is going to be hackable, but better checks to ensure the scanned image is coming from something head shaped and ALIVE isn't hard.

    Add in some checks for eye movements and blinks, and add some basic photogrammetry to look at headshape while asking for a bit of head movements and blinking will tighten things up a bit and at least make it harder to hack.

    Until someone comes up with the idea of a back projection based head that live replaces an iris onto previously configured sequences of videos...
  5. sandys

    sandys Multimodder

    26 Mar 2006
    Likes Received:
    Really nice phone though, wish I had heard of this early I locked myself out of mine :rolleyes: and had to use remote wipe ....doh :D

    Actually, there are a number of cases where the S8 won't take biometrics and requires the pin, like first boost up/restart or first use of the day or something, that's how I end up locked out, forgot what pin I used and none of the biometrics would let me in....grrr, so perhaps the hack is not entirely useful.

Share This Page