Nowadays, face recognition technology has become ubiquitous in our lives, from mobile phones to access control systems in some public places, to high-speed train stations and airports in many countries. It can be said that face recognition applications have significantly enhanced everyday convenience. But is face recognition truly secure?
Recently, researchers used a pair of glasses to bypass the face recognition capabilities of 19 Android phones, leaving everyone stunned. The experiment was based on the idea that if an attacker obtains a photo of a victim and creates a special pair of “glasses” from it, could they unlock the victim’s phone by tricking the recognition feature?
The experiment was conducted by Real AI, a group formed by the Institute of Artificial Intelligence at Tsinghua University, China. The results were astonishing, as these glasses successfully bypassed the face recognition unlock system of 19 Android phones through spoofing attacks. Additionally, more than 10 financial service apps and government applications met the same fate.
According to the researchers, after obtaining a photo of the designated victim, the first step is to create an interference image of the eye area using artificial intelligence algorithms. Then, the pattern is printed, cut out, and attached to the glasses frame. This allows the perpetrator to complete the unlocking of phones and apps by wearing the glasses and presenting their face to the phone.
Reports indicate that the research team selected 20 mobile phones for testing. And except for one iPhone 11, all other Android phones were unlocked within just 15 minutes. The 19 Android mobile phones included 5 of the top Chinese mobile phone brands, ranging from budget models to flagships. One of these was the latest flagship product released by a well-known brand at the end of December last year.
In addition to bypassing the face unlock system of mobile phones, the research team also overcame several face recognition verification steps of many financial apps and government software, even impersonating the owner to complete online bank account openings.
According to reports, although it is very difficult to independently develop the aforementioned core algorithm, if hackers use the algorithms maliciously, it will significantly reduce the difficulty of unlocking.
In fact, the spoofing attack technique is not new. However, the ability to carry out the unlocking process from start to finish in less than 15 minutes shows that such attacks can pose real-life security threats.
RealAI also stated that the ultimate goal of their research is to identify vulnerabilities, then patch and protect them. Currently, they have developed corresponding products to assist mobile phone manufacturers in strengthening and upgrading this recognition feature.
Refer to Sina