Laptop facial recognition defeated by Photoshop White hat security researchers have demoed how to bypass the facial recognition systems on several laptops. The facial recognition software on Lenovo, Asus and Toshiba laptops (known as Veriface III, SmartLogon 1.0.0005 and Face Recognition 2.0.2.32, respectively) was compromised by security researchers including Duc Nguyen, …
If the laptop is not even bother to check biometrics in 3D then there is little point.
Also the laptop could change the brightness of the screen from dark to light and the webcam look for the pupil of the eye to react. This would also prevent a 'Demolition Man' style hack involving a fountain pen and eye.
Cheap facial recognition software has been highlighted before as being unable to distinguish between a photograph and the real thing. Don't know where I read it, might have been NPL or CESG papers freely available from their web sites.
But then any decent security bod would tell you never to rely on biometrics alone.
Quite apart from the previously pointed out problem of not being able to change biometrics when they're compromised, biometrics are broken as a concept.
Anyone who works with biological systems know that they constantly change. There is natural change with aging, accidental change with injury or illness, people change weight and shape through exercise and diet (good and bad), even bony structures can be changed with surgery (nose job anyone?). Basing any kind of authentication on such a vastly variable thing as measurements of a biological system is really deeply stupid. Thusly, expect it to come to a government project near you soon. Oh shit, wait...
I have one of the Asus laptops with facial recognition logon. I gave it a quick try - it's amusing, but obviously easy to fool. My laptop also has a fingerprint reader which can be used to logon. Along with a shiny smooth plastic cover on the top side that always shows a crystal-clear copy of my fingerprints. :-)
......you are a national police force or transport authority with an uplink to an international database of wanted individuals faces. You deploy facial recognition software and hardware. Suddenly your systems draw a hit.
He's in Thailand. No wait.... New York. Hang on.... Glasgow.... No No No he's at Heathrow - quick get him. Hang on we shot the wrong bloke.....
Bugger.
Mines the one with the V for Vendetta mask.
Yes, but at the border, the security guy can see if someone is holding up a photo in front of their real face...
What we really need is for everyone to be implanted at birth with a unique identifying device that can't be removed or compromised, which can then be used for all identification purposes!
;-¦
... that anyone is surprised by this... how high tech is it really going to be with a fuzzy webcam on a laptop... it's hardly military grade is it.
I have always wondered where was voice pattern matching in all this, you could press the login button and the computer show you a word, which you then say (this defeats pre recorded statements being played back) and it can check your voice patterns.
Still I wouldn't want to trust any one of these methods alone, perhaps we should use fingerprint, face, voice together... if people find it SO hard to type out a password then leave that out.. It would be a fair challenge to photograph someone, chop off their thumb, record the correct word in their voice and also torture their password out of them... and hell why not add a smart card in their too (or the future way, a programmable chip in your thumb, read at the same time as the print... perhaps a chip which shuts down if it detects the thumb is dead - i.e. chopped off).
From the description, it appears that they are taking a single image of a 2-dimensional source (webcam) to validate a 3-dimensional object (face). From that it is trivial to conclude that a sufficiently good 2-dimensional copy (printout) of the face would fool the webcam.
The obvious hardware solution would be to use 2 webcams and produce a 3-dimensional image to compare against. But it should be possible to produce a software solution with a single webcam taking multiple images if the software can vary the exposure and/or focus.
Neither of these would stand up against a well-crafted bust, however. But then, neither can I...
AC: "Biometrics CAN'T [be changed]" Ever heard of plastic surgery? Having said that, the difficulty in changing biometrics is exactly what makes them [when well-implemented] ideal for identification systems.But don't get me started on identification vs. authorization. Suffice to say the system should first identify you [biometrics], then ask for authorization [password/PIN].
This is really just another manifestation of Schneier's Law.
The fact that you are unable to defeat a security system you invented does *not* mean that it is impossible to defeat. It could more probably mean that you are just not smart enough to defeat it, but you don't know that nobody else is.
that prosthetics have not been mentioned.
surely facial recognition is something that can be easily circumvented by the careful application of facial prosthetics.
Additionally how many celebrities have lookalikes that make money from the originals fame? Facial features while unique, the general look and shape of your face could be shared with many other people.
Paris, because she loves the prosthetics.
@ Anonymous Coward Posted Thursday 19th February 2009 14:07 GMT
> I wonder how this facial recognition compares with the "standard" logins like text passwords.
Poorly, as pointed up in the article early on. Um, is this your coat?
Asus dear, I love you honey, but your feet have started to stink. Gimme' me loggin'-in wi' an incomprehensible and non-guessable string o' gib'rish any day and leave the cam-play to the cam-girls, willye' just?
No such toy in ol' Tux's playroom so far - wouldn't use it if there were. Now, a proper open-source *voiceprint* login module - cor blimey, that'd be an improvement. It were "Speak friend and enter" that baffled ol' Gandalf the Greyhat all day long an' 'arf th' night too, wa'n't it?
Not that the Orcs Within much cared, as I remember. 'Ad their own not-sodding-authentic (but in is in) NSA-key all registered already, them 'orrid stinking beasts did. ORC: Only Really Crafty... But voice recog surely's more secure than any FR approach if it simply must be tricked-out, I think.
I also think the Amarok pkg already contains the core of that voice recognition engine. It's earning its minimal keep right now on my KDE desktop (while the Eternal Tibetan Temple Bells and Singing Bowl ensemble ambientizes me entire Secret Main Street Dangerous Research Laboratory) as an eyecandy "analyzer" item known as "Voiceprint" - I've played with its possibilities for years up in the ol' noggin's attic; always meant to break it out for authentication/forensic purposes of my own if ever needs be. (Oval tuit ain't round enuf yet, is all.)
Penguin mask loose-fitted o'er ol' Roger the Jolly. Arr-r-r.
> So these guys suggest not using facial recognition because it's not entirely secure? I wonder how this facial recognition compares with the "standard" logins like text passwords.
I'd imagine it doesn't compare here in CCTV land, since your not flashing your text password at the government on every street corner.
You might get noticed holding a sheet of A4 in front of your face ...
I used it at Stanstead before Christmas. It's pretty cool actually. The paranoid conspiracy theorist in me wondered if they were grabbing a sneaky snapshot of my fingerprints at the same time though. If they were then they just know what my knuckles look like ...
OK, it's not a military grade authentication... but more than enough in a home environment. Also, I'm reading shit about 2d vs. 3d and the such. Guys, you don't know the state of the art of face recognition, as it seems:
1) Lenovo engineers aren't quite as stupid as you think. Of course, the dumb 'Hey, let's wave a photo in front of the webcam' was tested. It doesn't fool the system. WTF, it was the first thing they tested.
2) The biometrics authentication systems in commercial laptops are toys. IPhoto (which admittedly, is a toy too) after a dozen of training photos or so, can recognize someone in a timespan of all the person's life. So aging, accidents and all that crap is a moot point.
3) In fact, recent systems are better at recognizing humans than humans themselves. They can distinguish identical twins better than humans. And, let's face it, *any* id system, in the end, goes down to biometrics: a policeman or government officer certifying, looking at ID's photos, fingerprints... that someone is who he claims.
As an example, in Spain you can get a government X509 certificate that for all purposes is as valid as a written signature. You go to the police, hand them you ID card, and here you are. But, wait a minute, isn't the police officer looking at your photo to authenticate you? Isn't your office boss lookng at you to assign you a system password? Have I mentioned that the newest systems are better than humans at recognizing humans? If you ask me, I think that this is a very promising field.
BTW, I don't get what those folks did to cheat the machine. I simply don't believe they bruteforced the webcam waving photos at it. And if they circumvented the wecam... c'mon, the whole thing is more than flawed.
I would dispute that it is good practice to insist on changes of passwords at regular intervals. It causes decreases in password complexity, increased likelihood of passwords being written or stored by users and a huge inconvenience to users.
It gives technically challenged managers a warm fuzzy feeling that their systems are secure but it makes security worse. You should assume that once a malicious user has access to another users credentials, the first thing they will do is to ensure they no longer need them.
Password expiry sucks. Biometrics suck. Chip & PIN for the win.
"The researchers claim that the log-in approach can be defeated using nothing more sophisticated than a photograph of a PC's registered user"
"Nguyen and his team created a large number of images to run what they described a "fake face bruteforce" attack to fool the systems"
So yes, they were waving photos at the webcams. RTFA
Proper facial recognition relies on metrics that can't be easily changed, even by surgery. Though if you want to have your eyes sockets moved I can recommend a good sledgehammer.
Its nonsense to attack biometrics on the basis of some very cheap and shoddy implementations of them. That's not to say that facial recognition is appropriate for use as a single authentication token but then what secure system would only use a single token?
"Please look at the camera."
"Identity confirmed - you look like my user. By the way, my hard drive lost five bad sectors overnight so that report for the MD you worked on until 4:30am is irretrieveable."
"You are not crying. You are not really my user. You are a photograph! Hah! One more point to me, fleshy hacker weaklings!"
Ok, so I have all my pr0n stashed on my computer with facial recognition protecting access to it..
While driving my car, I have a particularly nasty accident and my face gets mangled pretty bad.. so bad, my wife won't want to look at me, so I'll need emergency access to all my smut.. but how do I get in if my face is distorted??
... and what if my evil twin steals my laptop??
It's a shit idea and it'll never work.. but I bet the government have already earmarked my hard earned income tax to fund it's implementation for their next hairbrained scheme.
What happens when your voice changes significantly? -- as it often will if you have a cold. Or, for that matter, surgery of some types
Mine once dropped at least an octave, from it's usual Highly Butch low voice to a much deeper Gubernator style one. I amused myself by recording a new message on my answering machine that no one could recognize as me.
And I'm sure we've all had laryngitis that prevented any speech except a high-pitched whisper.
PS: As for facial recognition, what happens when a woman changes her usual makeup significantly? There are women who use so much mascara and eye shadow that they look like raccoons, but sometimes they wake up to the awfulness of their appearance, and switch to the well-scrubbed look.
Are biometrics and facial recognition perfect? Of course not. No security solution is. With enough time and access to your PC, any and all security can be bypassed eventually.
What bothers me about this article is the implication that facial recognition in general doesn't work. As with all security solutions - or even all software in general - it's not the technology concept itself that counts, but the specific IMPLEMENTATION of that concept that matters. Just because Notepad is a terrible word processor doesn't mean that they all are.
I've actually worked as a vendor of facial recognition security software for PCs for several years now (Sensible Vision). We've successfully protected PCs in security critical organizations such as hospitals and banks - even a maximum security prison - for years. Our consumer platform on Dell computers (not examined in this study) is both easy to use and has very real security benefits (including automatic locking of the desktop when the user is NOT there....typically a much bigger threat in most environments than a sophisticated, time consuming "replay attack" ).
Bottom line - despite the implications of the article, by minimizing weaknesses, publicizing those that remain and then providing tools to address them, convenient and secure facial recognition for PCs can actually be done and done well.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
