[ad_1]
Biometric authentication is A key part of the technology industry plan Let the world be passwordless. But a new way to copy Microsoft Hello windows Facial recognition systems show that a little bit of hardware fiddling can trick the system into unlocking when it shouldn’t.
Service like Apple’s face ID In recent years, with the popularity of Windows Hello, facial recognition authentication has become more common. Apple only allows you to use FaceID with cameras embedded in recent iPhones and iPads, and Macs still don’t support it at all.But due to the diversity of Windows hardware, Hello facial recognition can be used with a range of third-party WebcamHowever, researchers at the security company CyberArk found that some people might think it’s easy to adopt Potential vulnerability.
That’s because you can’t believe that any old webcam will provide strong protection for the way it collects and transmits data. Windows Hello facial recognition is only available for webcams that have infrared sensors in addition to regular RGB sensors. But it turns out that the system does not even look at RGB data. This means that through a direct infrared image of the target’s face and a black frame, the researchers found that they could unlock the victim’s device protected by Windows Hello.
By manipulating a USB webcam to provide an image of the attacker’s choice, researchers can trick Windows Hello into thinking that the device owner’s face is present and unlocking.
Omer Tsarfati, a researcher at the security company Cyber A complete map of the process, and found that the most convenient for an attacker is to pretend to be a camera, because the entire system depends on this input.”
Microsoft called this discovery a “Windows Hello security feature bypass vulnerability.” Release patch Solve this problem on Tuesday. In addition, the company recommends that users enable “Windows Hello Enhanced Sign-in Security”, which uses Microsoft’s “virtualization-based security” to encrypt Windows Hello face data and process it in a protected memory area that cannot be tampered with. The company did not respond to WIRED’s request for comment on CyberArk’s findings.
Tsarfati will announce the findings at the Black Hat security conference in Las Vegas next month. He said that the CyberArk team chose to check the Windows Hello facial recognition authentication, especially because there have been many industry-wide studies. PIN cracking with Fingerprint sensor deceiveHe added that the team was attracted by the large Windows Hello user base. In May 2020, Microsoft stated that the service had more than 150 million users. In December, the company Add to 84.7% of Windows 10 users log in using Windows Hello.
Although it sounds simple-show two photos to the system and you are in-these Windows Hello bypasses are not easy to implement in practice. Hacking requires the attacker to have a high-quality infrared image of the target’s face and physical access to its device. But as Microsoft continues to promote the adoption of Hello in Windows 11, this concept is important. The diversity of hardware between Windows devices and the poor state of IoT security may combine to create other vulnerabilities in the way Windows Hello accepts facial data.
“A truly motivated attacker can do these things,” Tsarfati said. “Microsoft is happy to work with it and develop mitigation measures, but the deeper issue of trust between the computer and the camera itself still exists.”
[ad_2]
Source link
