Hello, welcome to the Tuesday, November 14th, 2017 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich and the day I'm recording from Jacksonville, Florida.

Vietnamese security company BKAV has released a YouTube video showing how researchers at the company were able to bypass

Face ID on Apple's new flagship iPhone 10 by using a mask.

Now if you remember during the introduction of the phone, Apple pointed out the process

it went through to ensure that face ID systems

can be fooled and masks were actually particular pointed out as a way they tested. But like any

biometric security system, a good enough representation of the features tested can be used

to impersonate the users.

The researchers had to go through a reasonable substantial effort to create a mask that worked.

The face of the user had to be scanned via a 3D scanner to create a three-dimensional replica of the face, then they colored parts

of the face that the phone uses in its facial recognition algorithm.

It helped that the phone will recognize even a partially obscured face.

For example, if half the face is covered up or if the user does for sunglasses,

face ID still works. So the mask only needs to imitate a partial face. The researchers stated that their

attack, unlike others, worked because they looked closer into the way the face ID algorithm

is attempting to figuring whether or not a particular face matches.

They state that the cost of the mask was $150, but this likely only includes the cost of printing the mask itself,

not necessarily the time and cost in collecting the data necessarily to create the mask.

They state that theoretically it's possible for an artist to create a mask based on regular photographs of an individual, but that's not

actually what they did. So if face ID doesn't work, what else is there for biometrics?

Researchers at the University of Buffalo had another idea for biometric off occasion. They developed a low-level radar system

that can be used to identify heart movements, which are apparently unique enough to use them

...