7 Reasons Why iPhone Fingerprint Security Might Not Be So Secure
albund/Shutterstock.com
NSA, pockets and wood slicers can all foil Apple’s iTouch biometric ID tool, security pros say.
Apple's latest smartphone, the iPhone 5S, contains a sensor for unlocking the device with a tap of the finger, including those belonging to a growing number of federal employees. The Defense Department and Immigration and Customs Enforcement are just a couple of the agencies that issue personnel iPhones for work.
Access control is key for any government-owned mobile device, federal security standards stress.
It’s unclear whether federal employees will be required to use the new TouchID safety mechanism, but cybersecurity researchers voiced some skepticism about the tool’s protections upon its Tuesday debut.
1. Stephen Ebbett, global director of smartphone insurer Protect Your Bubble, told antivirus provider ESET that “this could turn out to be more a gimmick than an impenetrable security measure at this stage. . .While biometrics are typically seen as more robust than password protection – sweat, dirty pockets, hot and cold environments, sun exposure, and other factors can affect the sensitivity and working conditions of the sensor surface. Earlier gadgets that have sported fingerprint scanners proved temperamental, and mobile fans will have to wait until they can get their fingers on the 5S to determine if Apple can deliver biometric functionality that is vastly improved.”
2. "One of the problems they'll have to deal with is that your fingerprints can change. I experienced this when I was a kid by sticking my finger into a 'router,' a device that shaves off the corners of wood to round them," begins a tale by Robert David Graham, chief executive officer of Errata Security, in which he describes finger reconstruction surgery and ponders whether iTouch will consider his disfigured digit valid identification.
3. On Monday, before the phone was unveiled, crypto virtuoso Bruce Schneier posited on Wired.com: "If the system is centralized, there will be a large database of biometric information that’s vulnerable to hacking. A system by Apple will almost certainly be local — you authenticate yourself to the phone, not to any network — so there’s no requirement for a centralized fingerprint database. . .It’s fine if your fingers unlock your phone. It’s a different matter entirely if your fingerprint is used to authenticate your iCloud account. The centralized database required for that application would create an enormous security risk.”
(The next day, Apple officials stated each fingerprint will be stored inside a chip on the iPhone, not on Apple servers or in iCloud. The prints can be used to authenticate purchases from iTunes, the App Store or iBooks Store, they added.)
4. Guillaume Lovet, senior manager for FortiGuard Threat Response, wrote on his company’s blog that “from the point of view of a cybercriminal who has [sent malicious code to] your phone, there is little difference between a fingerprint and a password. If the device is compromised, it can intercept and reuse the digital form of both (say, to complete a money transfer), which boils down to a series of 0s and 1s.” Other FortiGuard researchers noted that, “While Apple claims there to be a dedicated stronghold within the new A7 processor [chip] where this data will be stored, a breach into that secure layer would usher the biometric authentication method complete useless.”
6. Computer security consultant Graham Cluley, formerly with Sophos, said hackers can't wait to get their hands on the technology: "It’s inconceivable that malicious hackers and data thieves won’t try to subvert Apple’s Touch ID fingerprint scanning technology. How capable they will be at doing that, remains to be seen. But expect hackers to start looking at the system as soon as they can get their hands on one of the new iPhone 5S smartphones.”
7. Cyber commentator Asher Wolf tweeted that citizens’ prints, like most other personal data, probably will be subject to National Security Agency surveillance: "Even if Apple claims it won't store fingerprint in the cloud - they're a U.S. company, it's subject to the Patriot Act. NSA stops at nothing."