Face ID: iOS 15 removes vulnerabilities in Apple’s facial recognition

Apple has fixed a security gap in the Face ID biometric authentication system with iOS and iPados 15: the attacker with the 3D model of the owner’s face can sign in with Face ID, Apple announced after the release of the operating system updates. The problem was eliminated by improving anti-spoofing technology, which aims to detect and prevent such fraudulent attempts.

Some known attacks on Face ID

Further details on the Face ID gap have not yet been released. Accordingly, it is unclear how complex it is to create such a mask and whether it will be used beyond Apple’s “attention check” to verify that the device is viewed with open eyes when logging in. Found the weak point According to Apple Wish Wu, a Chinese defense researcher at the Ant-Financial Light Annual Defense Laboratory.

Wu has long been involved in cracking down on biometric authentication systems such as Face ID. In 2019, the hacker announced a lecture at the Black Hot conference that would show how Facebook ID can be thwarted – but abruptly withdrew it and sparked speculation. He is said to have used only black and white photo and tape for his hack, but it may not work reliably. In 2017, Vietnamese security researchers caused a stir with a dual mask that Face ID could be used to unlock iPhones – but questions remain unanswered.

iOS 14.8 (more) Closes vulnerabilities

According to Apple’s previous report, it removes a total of 22 vulnerabilities, including kernels and serious gaps in the kits that allow iOS and iPadOS 15 to process malicious code. The Federal Office for Information Security (BSI) has bugs at high risk level 5 and recommends updates soon. Apple has already removed many of these vulnerabilities with iOS 14.8, and it is only now known – users have the option to stay on iOS 14 without dropping security updates. According to Apple, the Face ID gap has only been fixed in iOS 15.

(LP)