Recently we talked about how the Face ID system works, Apple's confidence in its protection capabilities, and some isolated attempts to overcome it. One of the most recent comes from the Vietnamese security firm Bkav, which claims to have defeated Face ID with a mask combining silicone, 3D printing, and makeup. Apparently, the cost of the mask does not exceed 150 dollars, however, its demonstration video leaves much to be desired...
A fingerprint trick
Last week, a Qatar Airways flight was forced to make an emergency landing after one of its passengers, an Iranian woman, discovered mid-flight that her husband was being unfaithful to her. How did she obtain that information? Apparently, the woman waited until her husband fell asleep, took his smartphone, and unlocked it by placing his finger on the fingerprint reader. Other reports suggest that the woman was a bit drunk, and that assaults against her husband and the crew led to the landing, but what interests me here is the smartphone. Apple has said on more than one occasion that its Touch ID can fail 1 in 50,000 times, although it has some weaknesses, including the Iranian woman's maneuver.
Bkav's claim
That led to the creation of Face ID, a controversial facial recognition system on the iPhone X that reduces the probability of errors to one in a million. As soon as it was announced, several security companies expressed interest in evaluating Face ID, which was also reflected in posts on several websites. However, the Vietnamese company Bkav claims to have beaten Face ID with a mask that combines 3D printing, makeup, and two-dimensional images. At first glance, the mask simulates the appearance of an injured and bandaged person, but Bkav representatives say that is "a special treatment" on the surface.
Doubts about the demo
Bad news for Apple, right? Actually, not so much, because the web doesn't seem to believe Bkav, and personally I have doubts. The demo was executed under very specific conditions, and as the camera approaches, I never see the unlock animation on the lock, which does happen when he unlocks it with his face. The logical thing would be for Bkav to repeat the test by recording the face from scratch, unlocking the phone with that same face to verify it works, and then placing it in front of the mask. Not using the equivalent of a pumpkin to film would also help a lot.
