Hackers manage to fool the Galaxy S8’s iris scanner with a photo

Samsung says tricking the Galaxy S8's iris scanner is 'unrealistic'

galaxy s8 active
Germany’s venerable Chaos Computer Club (CCC) takes no prisoners — especially when it comes to smartphone security. After successfully fooling a fingerprint sensor using high-resolution images of a hand, specialized computer software, and a standard printer last year, the hacker collective set their sights on a new target: The Galaxy S8’s iris scanner.

In a video released on Monday, the white-hat team of hackers demonstrated how Samsung Galaxy S8’s iris sensor, supplied by security firm Princeton Identity, can be tricked into unlocking the phone with a cropped picture of a person’s irises and a pair of contact lenses. After toying around with the photo’s brightness and color contrast, printing out a high-resolution copy, and placing the contact lenses on top of the print, the CCC was able to unlock the Galaxy S8.

A spokesperson for Samsung told The Korea Herald that fooling the Galaxy S8’s iris sensor is “unrealistic,” and that it would require a “camera that can capture infrared light” and a photo of the owner’s iris. “It is difficult for the whole scenerio to happen in reality.”

It was a little more challenging than it looks. In a blog post, CCC spokesperson Dirk Engling conceded that most selfies won’t fool the Galaxy S8’s iris scanner — a hacker would have to capture a person’s iris with a digital camera in night-shot mode or the infrared filter removed.

“In the infrared light spectrum — usually filtered in cameras — the fine, normally hard to distinguish [sic] details of the iris of dark eyes are well recognizable,” Engling wrote. “[We were] able to demonstrate that a good digital camera with 200mm-lens at a distance of up to five meters is sufficient to capture suitably good pictures to fool iris recognition systems.”

Still, the CCC’s workaround would appear to contradict Samsung and Princeton Identity’s messaging. In marketing materials, Samsung’s highlighted the Galaxy S8’s iris scanner as a “secure” alternative to PINs and passcodes. In an interview with Business Insider in April, Princeton CEO Mark Clifton characterized the Galaxy S8’s iris scanner as “better” than the FBI’s fingerprinting technology.

“[The FBI] uses 13 points of identification per fingerprint, so with all 10 finger you might have 130 unique identifiers,” Clifton said. “[The] Galaxy S8’s iris scanner can register up to 200 identifying features from a single iris.”

It is not the first time the CCC has demonstrated flaws in iris-scanning technologies. In March, the group fooled a commercial system with a 75-pixel image of an iris printed at a resolution of 1,200 dpi (dots per inch).

“If you value the data on your phone, and possibly want to even use it for payment, using the traditional PIN-protection is a safer approach than using body features for authentication,” Engling said.

Article originally published on 05-23-2017. Updated on 05-25-2017 by Kyle Wiggers: Added statement from Samsung spokesperson. 

Mobile

An unknown number of Sprint customers had their personal info stolen by hackers

Hackers stole an unknown number of Sprint users' data after breaching the Samsung.com “add a line” website, according to a letter Sprint sent to impacted customers. Names, addresses and other personal information was all taken in the…
Mobile

It's still worth boarding this fleet of old flagship phones if you want to save

Do you really need to blow your savings to get the latest smartphone, or is it worth looking at the top phones from yesteryear? We highlight some old flagships that are still worth buying and discuss new budget phones as an alternative.
Deals

The futuristic Samsung Galaxy S10 5G just got a price cut on Best Buy

Amazon Prime Day 2019 is finally here, bringing with it some of the best smartphone deals you're likely to see all year. In particular, there are some amazing deals on Samsung Galaxy phones, including the much-loved Samsung Galaxy S10.
Deals

The Samsung Galaxy Note 9 gets a 35% price cut for Prime Day

The Samsung Galaxy Note 9 is currently the latest model in the Galaxy Note range that normally lists for $1,000, but this is no ordinary day. You can get the Samsung Galaxy Note 9 for just $650 with Amazon's Prime Day deal.
Mobile

It’s World Emoji Day! Here are the emojis coming to Android and iPhone this year

It's World Emoji Day! Google and Apple are celebrating by releasing sneak previews of their new emojis. With new inclusions for those with disabilities and new gender-neutral options, here are some of the new emojis heading our way.
Mobile

Keep your phone flipping with the best Asus Zenfone 6 cases

With a seamless display and the innovative flipping camera system, the Asus Zenfone 6 is a unique device that proves not every phone needs to look the same. Protect it with one of the best Asus Zenfone 6 cases.
Photography

Oppo Reno 10x Zoom vs. Huawei P30 Pro camera shootout: Zooming in on the action

When Huawei introduced its zoom lens on the P30 Pro, it opened up a whole new world of photographic opportunity on a smartphone. Now, Oppo's challenging it with the Reno 10x Zoom, so we've found out which is best.
Mobile

The Galaxy Note 10 might not be equipped with Qualcomm's most powerful processor

The Samsung Galaxy S10 range isn't exactly old, but Samsung is already working on the next big release. Details about the Samsung Galaxy Note 10 are making their way online, and we've gathered them all for you.
Deals

Amazon Prime Day deals are ending, but you can still get great bargains

Prime Day 2019 has come to an end for Amazon, but that doesn't mean the Prime Day deals are over. With deals from Walmart, Best Buy, and Amazon still going on, this massive shopping event is continuing on through the week.
Product Review

You don't need a gaming phone, but the Red Magic 3 will make you want one

Gaming phones have arrived, and Nubia has pulled a tempting example from its top hat in the shape of the impressive Red Magic 3. A huge display, speedy performance, and more make this a dream phone for gaming.
Mobile

What's the difference between 4G and LTE ... and does it even matter?

Wireless standards are confusing -- it doesn't matter if you're talking about 4G, LTE, WiMax, or others. Here, we break down the differences between 4G and LTE so you can make sense of how they play out in real-world scenarios.
Social Media

Study suggests using emojis makes you appear more friendly — even at work

Can emojis be a clue into your personality? A recent survey suggests that emojis make a person seem friendlier and more approachable, even when used within a professional work environment.
Cars

There is no way to say pickup truck in emoji, and Ford wants to change that

Ford asked the Unicode Consortium to include a pickup truck in the database of emojis. The company is confident its request will be approved, and a blue pickup truck loosely shaped like an F-150 will be available in early 2020.
Emerging Tech

Buying on a budget? Here's all the best tech you can snag for $25 or less

We live in a world where you can get a cheeseburger for $1, a functioning computer for $5, and thousands of HD movies for $10 -- so it stands to reason that you should be able to pick up some pretty sweet gear for $25.