iPhone 5S fingerprint spoof could lead to ID theft, German researchers says

A photograph of the fingerprint used to open an iPhone 5S could lead to identity theft, researchers say. Photograph: Jason Lee/Reuters

A German security company says spoofing the iPhone 5S's fingerprint reader can be used to beat the phone's "remote wipe" facility to carry out identity theft.

SRL demonstrates the hack on its website. It relies on the phone's owner using a number of defaults in the setup of the phone. It does not work against iPhones without a fingerprint reader.

The identity theft relies on the user enabling Touch ID on the iPhone 5S, having the "Control Center" facility available in the lockscreen so that the Airplane mode can be enabled rapidly, and not having two-factor authentication turned on for email accounts, especially their Apple iCloud account which is required to set up the device. Touch ID is an optional setting, but the others are default settings for the device.

SRL points out that Airplane mode can be enabled on a stolen phone from the lockscreen, which turns off wireless connectivity and so defeats the remote wipe facility.

It then shows that a photo taken with an older iPhone 4S of the phone owner's fingerprint can be good enough to create a "fake finger" on a laminated sheet, which is then lightly stuck to a real finger. That method was demonstrated by the Chaos Computer Club soon after the iPhone 5S's release.

Having created a spoof fingerprint to unlock the device - which must be done within three attempts or a passcode request is triggered, which is not available through a stolen phone - SRL points out that the attacker can see the owner's email address in the settings, and so can use an Apple website to request a password reset. That will be sent to the phone - and by rapidly turning off the Airplane mode to collect the email and then grabbing the password reset, and taking over the account. They could then put the phone back in Airplane mode.

Without two-factor authentication - which is an optional safeguard for iCloud, Gmail, Yahoo and Hotmail accounts - there would be no way for the phone's owner to prevent the account takeover. Two-factor authentication provides a method to revoke permissions for various devices and accounts. It is presently available for iCloud accounts in the US, UK, Ireland, Australia and New Zealand.

The Control Center facility can also be removed from the lock screen in the Settings.

SRL said that the hack proved that "using fingerprints as credentials for local user authentication has two shortcomings when compared to passwords - limited revocation" (because fingerprints cannot be changed) and "credential spread" (because we leave copies of our fingerprints anywhere we touch).

They suggest that fingerprint readers still need to improve further. "Fingerprint spoof prevention would better be based on intrinsic errors in the spoof-creation process or on fingerprint features not present in latent prints (and become much harder to steal). Examples of such spoof-detection features are air bubbles contained in the glue often used for spoofs and minute details that are visible through a fingerprint sensor but not in a latent print," the researchers write. It suggests that a simple comparison of such air bubbles - which show up in their sensor data as white bubbles, which aren't found with real fingerprints - would "challenge hackers to improve their spoofing techniques