Apple has marketed TouchID both as a convenience and as a security feature. “Your fingerprint is one of the best passwords in the world,” says an Apple promotional video.
A European hacker group has announced a simple, replicable method for spoofing Apple’s TouchID fingerprint authentication system.
The Apple TouchID it the technology developed by Apple to replace passcode on its mobile and help protect users’ devices, it is based on a sensor placed under the home button and it is designed to substitute the four-digit passcode to unlock the handset and authorize iTunes Store purchases.
“We hope that this finally puts to rest the illusions people have about fingerprint biometrics,” “It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token.” added CCC spokesperson Frank Rieger.
The hack is embarrassing, in recent days a series of bugs and security issues were found on the last version of the popular Apple OS, iOS 7, in particular the lockscreen features is affected by serious flaws.
“The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access.” hacker said.
These are the exact same steps that the CCC published in 2004 on its web site and the same process that can be used, with minor tweaks, to trick the vast majority of fingerprint sensors on the market.
At this point the only question to be clarified is if the hackers will claim to the bounty of more than $16,000 in cash offered to the first person to hack the Apple TouchID fingerprint sensor.
IsTouchIDhackedyet.com is the brainchild of Nick DePetrillo, an independent security researcher whose last major public research was 2010’s Carmen San Diego Project, it announced on its Web site that it was waiting for the group to upload video of the hack as proof of the hack.
Rewards include also a patent application from CipherLaw for the hack process, some Scotch, and a book of erotica.
Lesson learned … nothing is secure!