As the Black Hat 2012 security conference explores the ever-shifting cyber security battle between black-hats and white-hats, one of the more compelling developments to have come out of the event has been in the field of biometrics. Javier Galbally and his team at the Universidad Autonoma de Madrid, Spain, claim to have tricked an iris-scanner into validating a fake image of someone’s eye.
In the past, researchers have been able to reproduce images of irises that merely looked realistic to iris scanners. This time, Galbally has been able to forge real ones, throwing up the possibility of copying someone’s identity to get through one of the most stringent security checks out there.
Galbally’s research showed that 80% of the time, a commercial scanner validated his forged prints as real. According to Wired, Galbally and his team, which included researchers from West Virginia University, tested print-outs of synthetic images of irises against VeriEye, an iris-scanner made by Nerotechnology.
White-hat hackers have for years been looking for vulnerabilities in biometric scanning — which covers everything from iris, to voice to finger-print recognition — part and parcel of making sure that makers of high-end scanning systems keep ahead of the crackers. Galbally, an assistant researcher at Universidad Autonoma, is himself involved with European projects to asses vulnerabilities in biometric scanning, notably one called Tabula Rasa.
On blackhat.com he says that his forged irises, or “binary iriscodes” probably wouldn’t get past a human expert, but “there is a high chance that they can break into an iris recognition system.”
It’s an area that security experts are still feeling out. Earlier this year two airports in the United Kingdom — in Manchester and Birmingham – said they were shelving their iris scanners to review other ways of advancing and automating airport security technology. British airports like Heathrow now use full face-recognition scanners in conjunction with biometric e-passports being distributed to U.K. citizens.
In the United States however, the FBI is reportedly testing a database which by by 2014 will let it run nationwide searches on iris scans to more quickly track criminals. According to NextGov.com, the Next Generation Identification system is a multiyear $1 billion program that will expand on the FBI’s current fingerprint database to include and aggregate other biometric features like facial images, palm prints and even tattoos. The database is reportedly 60% complete.
