Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
iPhone X Face ID Again Unlocked With Mask, Even With 'Require Attention' Turned On
Since the iPhone X launched earlier this month, people have been attempting to fool Face ID, the new biometric facial recognition feature built into the device as a primary security feature. Face ID has thus far been tricked by twins, children, and even a mask.
Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.
As described in an accompanying blog post, Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.
Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.
After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.
Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.
Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.
Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews for its security and ease of use.
Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.
As described in an accompanying blog post, Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.
Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.
After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.
Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.
Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.
Bkav researchers said that making 3D model is very simple. A person can be secretly taken photos in just a few seconds when entering a room containing a pre-setup system of cameras located at different angles. Then, the photos will be processed by algorithms to make a 3D object.Apple's Face ID security white paper [PDF] outlines several scenarios where Face ID has a higher probability of being fooled, including with twins, siblings that look alike, and children under the age of 13, but masks are of particular interest because Face ID features a neural network that was "trained to spot and resist spoofing" to protect against "attempts to unlock your phone with photos or masks." From Apple:
It can be said that, until now, Fingerprint is still the most secure biometric technology. Collecting a fingerprint is much harder than taking photos from a distance.
Face ID matches against depth information, which isn't found in print or 2D digital photographs. It's designed to protect against spoofing by masks or other techniques through the use of sophisticated anti-spoofing neural networks. Face ID is even attention-aware.When Touch ID, Face ID's predecessor, was first released in the iPhone 5s in 2013, there were many similar demonstrations of how it could be fooled with a fake fingerprint, but there's little evidence that these methods were ever used to unlock devices in the real world on a wide scale basis, and it turned out to be something most iPhone users did not need to worry about. The same is likely true of Face ID.
Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews for its security and ease of use.
Related Roundup: iPhone X
Tag: Face ID
[ 475 comments ]
Top Rated Comments
(View all)
21 months ago
“" but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face.”
If someone wants to go through all of this just to get into my phone. I would be so flattered I would just hand it to them unlocked.
If someone wants to go through all of this just to get into my phone. I would be so flattered I would just hand it to them unlocked.
21 months ago
I will bet you that you cannot, no matter how good your mask is, unlock my iPhone. (I have an 8 Plus)
21 months ago
Acid test. Give these guys a locked phone that they have no other access to, and a few minutes with an independent test subject, and let's see how successful they are given just FIVE attempts before the X disables the feature and requires a pass code instead.
21 months ago
To be fair, it sounds like these guys enjoyed an unfettered access to the phone and probably had hundreds of failures before this one mask worked. Correct me if I'm wrong, but won't the X disable Face ID after 6 odd failures (not got an X myself but I assumed it was the same logic as TouchID)?
21 months ago
It’s a technically interesting exercise but requires such a level of access to detailed photographs that it’s a non-issue.
My house has doors and windows that could be broken with no technical skills. They all do. I’m not going to be moving house.
I’m not going to be ditching my X or deactivating Face ID.
My house has doors and windows that could be broken with no technical skills. They all do. I’m not going to be moving house.
I’m not going to be ditching my X or deactivating Face ID.
21 months ago
Even if Face ID is able to be unlocked with a mask of Jabba the Hutt and Chewbacca, I’m still not downgrading back to the ugly and outdated iPhone 8
Hell no
Hell no
21 months ago
Find some iPhone X in a parking lot. Make a mask? Whose face do you start with? But one thing is for sure OF COURSE YOU CAN FOOL THIS!! gees. It's a convenience security feature, but mind you there is some security.
21 months ago
If you are worried about someone creating a mask to copy your face to break into your phone, you have bigger problems.
21 months ago
('https://www.macrumors.com/2017/11/27/face-id-iphone-x-fooled-by-mask/')
Since the iPhone X launched earlier this month, people have been attempting to fool Face ID, the new biometric facial recognition feature built into the device as a primary security feature. Face ID has thus far been tricked by twins ('https://www.macrumors.com/2017/10/31/iphone-x-face-id-twin-tests/'), children ('https://www.macrumors.com/2017/11/14/face-id-spoofed-by-child-and-mask/'), and even a mask.
Vietnamese security company Bkav made headlines ('https://www.macrumors.com/2017/11/14/face-id-spoofed-by-child-and-mask/') in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.
[MEDIA=youtube]rhiSBc061JU[/MEDIA]
As described in an accompanying blog post ('http://www.bkav.com/d/top-news/-/view_content/content/103968/bkav%92s-new-mask-beats-face-id-in-twin-way-severity-level-raised-do-not-use-face-id-in-business-transactions'), Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.
Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.
After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.
Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.
Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.
Apple's Face ID security white paper [PDF ('https://images.apple.com/business/docs/FaceID_Security_Guide.pdf')] outlines several scenarios where Face ID has a higher probability of being fooled, including with twins, siblings that look alike, and children under the age of 13, but masks are of particular interest because Face ID features a neural network that was "trained to spot and resist spoofing" to protect against "attempts to unlock your phone with photos or masks." From Apple ('https://support.apple.com/en-us/HT208108'):When Touch ID, Face ID's predecessor, was first released in the iPhone 5s in 2013, there were many similar demonstrations of how it could be fooled with a fake fingerprint ('https://www.macrumors.com/2013/09/22/chaos-computer-club-bypasses-apples-touch-id-system/'), but there's little evidence that these methods were ever used to unlock devices in the real world on a wide scale basis, and it turned out to be something most iPhone users did not need to worry about. The same is likely true of Face ID.
Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews ('https://www.macrumors.com/2017/10/31/iphone-x-review-roundup/') for its security and ease of use.
Article Link: iPhone X Face ID Again Unlocked With Mask, Even With 'Require Attention' Turned On ('https://www.macrumors.com/2017/11/27/face-id-iphone-x-fooled-by-mask/')
Anyone who is worried by this is already someone who doesn’t/shouldn’t use Touch ID either. For everyone else this is a non issue
[ Read All Comments ]
Apple today seeded the first beta of an upcoming tvOS 13 software update to its public beta testing group, giving non-developers a chance to try out the new software ahead of its fall public release....
Apple today seeded the fifth beta of an upcoming iOS 12.4 update to developers, two weeks after seeding the fourth iOS 12.4 beta, and over a month after releasing iOS 12.3, a major update that...
Apple today seeded the third beta of an upcoming macOS Mojave 10.14.6 update to developers, two weeks after seeding the second macOS Mojave 10.14.6 beta and more than a month after the release of...
Apple today seeded the fourth beta of an upcoming watchOS 5.3 update to developers, two weeks after releasing the third watchOS 5.3 beta and a month after the launch of watchOS 5.2.1, an update that...
B&H Photo is further discounting a set of previous generation iMacs, providing the lowest ever price for the 21.5-inch model with 8GB RAM and a 1TB Fusion Drive. You can get this model for...
Microsoft plans to launch a small foldable Surface tablet in the first half of 2020, according to Jeff Lin, an analyst at research firm IHS Markit.
Microsoft Surface Go
In an email shared...
Augmented reality game Harry Potter: Wizards Unite got a surprise early release last week in the U.S. and the U.K., and Niantic has now rolled the game out to a global audience.
Early Sunday...
For this week's giveaway, we've teamed up with Tap to give MacRumors readers a chance to win one of the company's wearable keyboards, which Tap believes is the keyboard of the future.
...
