Old tricks help German hackers bypass iPhone 5s Touch ID security

Apple's Touch ID authentication system can be defeated using a well-honed technique for creating a latex copy of someone's fingerprint, according to a German hacking group.

The Chaos Computer Club (CCC), which hosts an annual hacking conference and publishes computer security research, wrote on its blog that their experiment shows that fingerprint authentication "should be avoided."

Apple introduced Touch ID with its latest high-end iPhone 5S on Sept. 10. A person's "fingerprint is one of the best passcodes in the world. It's always with you, and no two are exactly alike," according to the company's website.

A hacker who goes by the name Starbug found that while Touch ID scans at a higher resolution, it can be beaten by increasing the resolution of the victim's fingerprint.

The CCC posted a video of what it wrote is a successful attack. Faking the print involves photographing the victim's fingerprint at 2400 DPI. The image is inverted and laser printed at 1200 DPI onto a transparent sheet using a "thick toner setting," according to the CCC.

Pink latex milk or white wood glue is smeared into the pattern created the toner. After it cures, a sliver of latex is lifted from the sheet, and blowing on it gives a bit of moisture like that on a human finger. It then can be placed on the iPhone's fingerprint sensor, the CCC wrote.

The technique is not new. "This process has been used with minor refinements and variations against the vast majority of fingerprint sensors on the market," the CCC wrote. Apple officials did not have an immediate comment on the CCC's findings.

Security experts have long warned that fingerprint authentication should not be solely relied upon, but rather used in concert with other technologies. Photos of fingerprints and molds have successfully bypassed fingerprint checks.

Touch ID is intended to reduce the number of times a person must enter a passcode, but Apple still requires a passcode in some circumstances, such as restarting the phone and if the devices hasn't been unlocked in two days.

Changes to the fingerprint settings also require a passcode, which can be configured to be longer and more complex than four digits.

View the original article here

Facebook's new face recognition policy astonishes German privacy regulator

A German privacy regulator is astonished that Facebook has added facial recognition to a proposed new privacy policy it published on Thursday.

"It is astonishing to find the facial recognition again in the new proposed privacy policy that Facebook published yesterday. We therefore have directly tried to contact officials from Facebook to find out if there is really a change in their data protection policy or if it is just a mistake of translation," Hamburg Commissioner for Data Protection and Freedom of Information Johannes Caspar said in an email on Friday.

The Hamburg data protection commissioner, already at odds with Facebook over its use of face recognition technology, reopened its proceedings against the company in August last year, telling the company to either obtain explicit consent for face recognition from users, delete the data, or face a lawsuit, Caspar said at the time.

Facebook turned off facial recognition for all European users in September last year, and said it would delete all face recognition templates for existing users in Europe.

The German commissioner stopped its proceedings against Facebook in February, when it confirmed that the company had deleted the facial recognition data gathered on German users without their consent.

Facebook founder Mark Zuckerberg.

Turning on facial recognition again in Germany might be illegal, Caspar said, adding that it depends on how Facebook implements it. The social network should ask for the explicit and informed consent of the user, Caspar said.

"That means that there has to be offered an opt in for users," he added.

Facebook initially deleted the face recognition data in response to recommendations from the Irish Data Protection Commissioner that it adjust its privacy policy. The company's Irish subsidiary is responsible for the data of users outside the U.S. and Canada, and therefore falls under the jurisdiction of the Irish DPC, which also confirmed independently that Facebook had deleted the face recognition data .

On Thursday, Facebook proposed changes to its privacy policy on Thursday, including one related to the tag suggest feature that uses facial recognition in order to let users easily tag friends in photos they upload.

Tag suggest is used in the U.S. in the same way it was used in Europe before it was turned off. Facial recognition software is used to calculate a unique template of a user's appearance based on facial features using variables such as the distance between the eyes, nose and ears.

"We are able to suggest that your friend tag you in a picture by scanning and comparing your friend's pictures to information we've put together from your profile pictures and the other photos in which you've been tagged. You can control whether we suggest that another user tag you in a photo using the 'Timeline and Tagging' settings," the proposed change reads.

Facebook proposed the change in its U.S. privacy policy, and also in translated versions of the policy for European countries, including Germany.

However, according to the Irish DPC, Facebook does not yet intend to offer the service in Europe.

Facebook Ireland consulted the Irish DPC in relation to its proposed privacy policy changes and confirmed that this feature is not yet available in Europe, said Ciara O'Sullivan of the Office of the Data Protection Commissioner in an email. "Any proposed changes to this position would be discussed with our Office," she said.

The Irish DPC suggested to Facebook Ireland that it clarify to its users that the tag suggest feature is not currently available in Europe, she added.

Facebook is still working with regulators to find a way to turn face recognition back on in Europe, a Facebook Germany spokeswoman said in an email.

Loek Essers focuses on online privacy, intellectual property, open-source and online payment issues.
More by Loek Essers, IDG News Service

View the original article here

Is Windows 8 a Trojan horse for the NSA? The German Government thinks so

The German Government is now deeply suspicious that the Trusted Platform Module (TPM) technology built into a growing number of Windows 8 PCs and tablets is creating a gigantic back door for NSA surveillance, leaked documents have suggested.

Documents from the German Ministry of Economic Affairs obtained by German title Zeit Online uncover the alleged unease of officials at the direction of version 2.0 of the standard being developed under the auspices of the multi-vendor Trusted Computing Group (TCG).

TPM has been marketed as a security technology since its appearance in 2006, but version 2.0 would embed a chip on every PC that has complete control over which programs can and can’t run, a setting that can’t be over-ridden under Windows 8. The chip is also where the cryptographic data is stored for Windows BitLocker and it enables remote administration.

Windows 8 security going forward will be founded on TPM 2.0 and the ability to access or break it would be of huge value to any intelligence service.

TPM has been marketed as a security technology since its appearance in 2006, but version 2.0 would embed a chip on every PC that has complete control over which programs can and can’t run, a setting that can’t be over-ridden under Windows 8.

During TCG meetings, German officials appear to have expressed concern about the potential for abuse but were “rebuffed,” Zeit claims. The documents also refer to the NSA having representation at the meetings and the statement “the NSA agrees” in the context of leaving the technology in its current (presumably unreformed) state.

The context of this reference is not clear from the Zeit article but the implication is disturbing; the NSA thinks that TPM 2.0 does not offer a barrier to its operations.

German officials, including members of the Federal Office for Information Security (Bundesamt fr Sicherheit or BSI) concluded that “the use of trusted Computing technique in this form ... is unacceptable for the federal administration and the operators of critical infrastructure,” and would represent a “loss of full sovereignty over information technology.”

A second document expresses the belief that TPM 2.0 under Windows 8 is no longer usable while Windows 7 “be operated safely until 2020,” after which alternatives will need to be sourced.

Is the story overblown Teutonic paranoia or a valid concern about the growing power of state surveillance? Until recently, the presumption might have been to the former but the Snowden affair changed the dimensions of the debate.

The NSA has if not the capability then certainly the ambition to eavesdrop on every communication event on the Internet, and the willingness of large US firm to go along with that, or not, has generated huge controversy. Meanwhile, allegations that Microsoft has co-operated with the NSA to bypass the encryption used in some of its services are a matter of public record.

For cost reasons, TPM is rarely built into consumer PCs although the advent of Windows 8 is supposed to extend version 2.0 to all PCs over time.

For cost reasons, TPM is rarely built into consumer PCs although the advent of Windows 8 is supposed to extend version 2.0 to all PCs over time. Newer devices such as Windows 8 tablets and some phones are likely to have a TPM although getting precise data on this is not easy. Linux supports Intel’s TPM 1.0, although unlike 2.0 this can be loaded and unloaded from the endpoint.

Ironically, an expert quoted in the Zeit article goes on to worry that the Chinese Government as well as the NSA might be able to access data through TPM 2.0; many TPM chips are manufactured in the country.

After years of low-level discussion among security experts, worries over surveillance backdoors have suddenly become a mainstream topic. Last month an Australian report claimed that intelligence services in the ‘five eyes’ alliance (the US, UK, Canada, Australia and New Zealand) had refused to use PCs made by Chinese-founded Lenovo over concerns about “backdoor hardware and firmware vulnerabilities.”

View the original article here

Bitcoin can be used for private transactions, German government says

The German Federal Ministry of Finance said on Monday that Bitcoin is not a full-fledged currency but that it is permissible to use it in private transactions.

But if companies want to use Bitcoins for commercial transactions, they need the permission of the Federal Financial Supervisory Authority (BaFin), said Martin Chaudhuri, ministry spokesman.

Bitcoin is a digital currency that can be exchanged electronically. But like other virtual currencies it lacks the backing of a government entity or a central bank.

In Germany, Bitcoin is not seen as a real currency by the Ministry of Finance, said Chaudhuri. Bitcoin rather falls under the classification "Rechnungseinheiten als Finanzinstrument" which is a unit of account, he said.

The government clarified its position on Bitcoin at the request of a member of parliament (MP) a couple of weeks ago, said Chaudhuri.

While Bitcoin can be legally used for private transactions in Germany, the Ministry also has the position that the virtual currency has many disadvantages, according to Chaudhuri, noting above all Bitcoin's instability. But because Bitcoins don't have a great impact on the market due to their limited use, the risks are also limited, he added.

Along similar lines, the European Central Bank (ECB) concluded last October that at present, virtual currency schemes such as Bitcoin do not pose a risk to price stability, provided that money creation continues to stay at a low level.

Though virtual currencies tend to be inherently unstable, at the moment they cannot jeopardize financial stability due to their limited connection with the real economy, their trading low volume and lack of wide user acceptance, the ECB said at the time.

But because they are currently not regulated and are not closely supervised, participation in virtual currencies exposes users to credit, liquidity, operational and legal risks, according to the ECB. These currencies could also represent a challenge for public authorities because of the legal uncertainty, it added. And they can also be used by criminals, fraudsters and money launderers to enable their legal activities, the ECB noted.

While the impact of the risks is relatively small, the ECB will periodically revisit developments in virtual currencies to reassess risks.

A similar risk assessment is underway in the U.S. where last week it was revealed that a prominent U.S. Senate committee has launched a formal inquiry to investigate criminal activity and other risks tied to the use of virtual currencies like Bitcoin.

Loek Essers focuses on online privacy, intellectual property, open-source and online payment issues.
More by Loek Essers, IDG News Service

View the original article here