Apple's Touch ID system, which was introduced in the iPhone 5s earlier this month, has officially been hacked. Following a video by Chaos Computer Club demonstrating how the exploit was achieved, the full process has been detailed in a new video by CCC member Starbug. It didn't take long at all for the new system, which is more of a convenience rather than a surefire security Fort Knox, to get bypassed, but it apparently shouldn't worry the average consumer, according to security expert Marc Rogers.
When the hack was initially achieved, CCC claimed it was super simple, attained through everyday and inexpensive office equipment. Turns out that's only partially true; it's important to put things in perspective. According to Rogers, much of the equipment required to complete the hack can cost "over a thousand dollars," and none of that equipment is likely to be just lying around your house. Things such as an image scanner, laser printer and a kit for etching PCBs, among other things.
"The reality is these flaws are not something that the average consumer should worry about," Rogers explained. "Why? Because exploiting them was anything but trivial. Hacking Touch ID relies upon a combination of skills, existing academic research and the patience of a Crime Scene Technician.
Here's how the process works: after lifting a perfectly unsmudged print (using cyanoacrylate fumes, fingerprint powder and fingerprint tape), the print must then be photographed, edited and printed onto transparency film. After that, the film must be converted to an actual usable print, either through a PCB board or a laser printer. Even when a perfect print was lifted, and then printed, it was often prone to failure, and very tricky to use.
"It is certainly not something your average street thief would be able to do, and even then, they would have to get lucky," Rogers said. "Don't forget you only get five attempts before Touch ID rejects all fingerprints requiring a PIN code to unlock [the iPhone 5s]," he added.
Rogers does admit that a "dedicated attack" could be executed, though none of us are likely that important for that to even be a worry. During Touch ID's announcement, Apple said the sensors used are capable of reading a user's sub-epidermal layers, so it's a little worrying a fake print could be used to bypass the system. Still, the fact that it has been hacked should deter the average person from using it, unless you've got some very, very important information to hide.
