#BlackHat: Researchers bypass iris scanners with biometric clones

Powered by SC Magazine
 

Researchers tap templates.

View larger image View larger image View larger image

See all pictures here »

An international team of researchers has devised a method of reverse engineering code stored in biometric databases to fool iris recognition systems.

Iris recognition systems are currently deployed by corporations and law enforcement entities around the world, including at Amsterdam's Schiphol Airport and Google's data centres.

Such systems typically scan individuals' irises to produce code that is then filed in a database and used for future matching. 

Black Hat 2012 coverage

Professor Javier Galbally of the Universidad Autonoma de Madrid told the Black Hat conference last week that his team had developed a genetic algorithm to reproduce images of individuals' irises by reverse engineering the database code.

Hackers could then fool security systems by printing the image out to be scanned by the recognition system, for example, by patching the image onto a contact lens to be worn by the attacker.

Galbally said the iris provided among the most reliable forms of identification -- even better than fingerprints -- but "the main problem with the iris is the acquisition".

"Sensors are more expensive, and it's more difficult to acquire because you need more cooperation from the users," he noted.

"The commercial [iris] system only looks for the iris [code] and not an actual eye."

Galbally said there had not been any breaches reported as a result of a bypassing iris recognition systems through synthetic iris images.

"You never know if it's going to be dangerous or not, but the vulnerability is there," he said. "It's good that people are aware that these vulnerabilities exist."

Galbally's research was done in partnership with the West Virginia University in the US and the Biometric Recognition Group-ATVS.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1801

Vote
Do you support the abolition of the Office of the Information Commissioner?