Black Hat: Iris scanners 'can be tricked' by hackers
26 July 2012 Last updated
at 12:41
Iris scanners are widely
recognised as one of the most secure biometric security measures
Security researchers have
discovered a way to replicate a person's eye to bypass iris-scanning security
systems.
A team at the Universidad
Autonoma de Madrid was able to recreate the image of an iris from digital codes
of real irises stored in security databases.
The findings were shared
at the annual Black Hat security conference in Las Vegas.
It raises doubts over what
is considered to be one of the most secure methods of biometric security.
Researcher Javier Galbally
and his team, which included researchers from West Virginia University, were
able to print out synthetic images of irises.
In one experiment, the
researchers tested their fake irises against a leading commercial-recognition
system. In 80% of attempts, they said, the scanner believed it was a real eye.
While researchers have
been able to create realistic iris images for some time, it is thought that
this is the first instance where the fake image can be generated from the iris
code of a real person - a method which could be used to steal someone's
identity.
An iris code is the data
stored by recognition systems when it scans a person's eye. It contains around
5,000 different pieces of information.
Digital WMD
The research was explained
to an audience at the annual Black Hat conference, a meeting of the leading
figures in IT security from across the world.
Shawn Henry, the former
head of the FBI's cybercrime unit, gave a key speech at the event.
“If we understand who the
adversary is, we can take specific actions” Shawn Henry
Former FBI cybercrime
chief
He urged security experts
to counter-attack in their attempts to stamp out criminal activity.
"We need warriors to
fight our enemies, particularly in the cyber world right now," he told his
audience.
"I believe the threat
from computer network attack is the most significant threat we face as a
civilised world, other than a weapon of mass destruction."
He called on the computer
security industry to begin looking at ways of gathering intelligence on
possible attacks and attackers, rather than seeking simply to block them when
they happen.
"It is not enough to
watch the perimeter," Mr Henry said.
"We have to be
constantly hunting, looking for tripwires.
"Intelligence is the
key to all of this. If we understand who the adversary is, we can take specific
actions."
Apple appearance
For the first time, Apple
representatives will be speaking at the Black Hat event.
The company is expected to
outline security features in the coming release of its latest mobile operating
system, iOS.
The appearance comes at a
crucial time for Apple. Earlier in the year, the company's Mac range suffered a
malware attack, with more than 500,000 machines infected.
The fallout put a dent in
Apple's reputation for producing computers that were safe from the kind of
attacks which are common on PCs.
According to Black Hat's
general manager Trey Ford, Apple was scheduled to appear at the event in 2008,
but pulled out after the company's marketing team intervened.
"Bottom line - no-one
at Apple speaks without marketing approval," Mr Ford wrote in an email
quoted by Bloomberg.
"Apple will be at
Black Hat 2012, and marketing is on board."
Comments
Post a Comment