Biometric systems have been touted as the next big thing in computer security for the past several years, despite the fact that some of them—fingerprint scanners, for example—have proven to be incredibly easy to bypass, requiring little more, in some cases, than some scotch tape and a bit of patience. Facial-recognition scanners have been a hot commodity on laptops of late, but researchers scheduled to present at the ongoing Black Hat DC conference this week have demonstrated that current implementations have flaws of their own.The researchers were able to bypass Lenovo's Veriface III, Asus' SmartLogon V1.0.0005, and Toshiba's Face Recognition 2.0.2.32, even with each program set for maximum security. Information on exactly which programs were bypassed by which methods is presumably contained within the team's full documentation, which is not available as of publication time.According to Dark Reading, a variety of attack vectors ultimately proved successful, including photo substitution (using a photo of the actual owner) as well as brute-force attacks in which multiple images of different people were presented to the scanner. The latter technique apparently requires at least a moderate period of time to execute; the attacker has no way of knowing in advance which photo(s) will prove capable of bypassing the security sensor. Based on their findings, the security team recommends that the applications be overhauled.
One of the team members presenting at Black Hat, Nguyen Minh Duc, had harsher words for the various affected OEMs. "There is no way to fix this vulnerability," Dark Reading reports Duc saying. "Asus, Lenovo, and Toshiba have to remove this function from all the models of their laptops... [they] must give an advisory to users all over the world: stop using this [biometric] function." From; http://arstechnica.com/security/news/2009/02/black-hat-blank-face-researchers-crack-biometric-scanners.ars
EXPERIENCE IS NOT WHAT HAPPENS TO A MAN BUT IT IS WHAT A MAN DOES WITH WHAT HAPPENS TO HIM
