Skip to main content

Hackers manage to fool the Galaxy S8’s iris scanner with a photo

Samsung says tricking the Galaxy S8's iris scanner is 'unrealistic'

galaxy s8 active
Image used with permission by copyright holder
Germany’s venerable Chaos Computer Club (CCC) takes no prisoners — especially when it comes to smartphone security. After successfully fooling a fingerprint sensor using high-resolution images of a hand, specialized computer software, and a standard printer last year, the hacker collective set their sights on a new target: The Galaxy S8’s iris scanner.

In a video released on Monday, the white-hat team of hackers demonstrated how Samsung Galaxy S8’s iris sensor, supplied by security firm Princeton Identity, can be tricked into unlocking the phone with a cropped picture of a person’s irises and a pair of contact lenses. After toying around with the photo’s brightness and color contrast, printing out a high-resolution copy, and placing the contact lenses on top of the print, the CCC was able to unlock the Galaxy S8.

Recommended Videos

A spokesperson for Samsung told The Korea Herald that fooling the Galaxy S8’s iris sensor is “unrealistic,” and that it would require a “camera that can capture infrared light” and a photo of the owner’s iris. “It is difficult for the whole scenerio to happen in reality.”

It was a little more challenging than it looks. In a blog post, CCC spokesperson Dirk Engling conceded that most selfies won’t fool the Galaxy S8’s iris scanner — a hacker would have to capture a person’s iris with a digital camera in night-shot mode or the infrared filter removed.

“In the infrared light spectrum — usually filtered in cameras — the fine, normally hard to distinguish [sic] details of the iris of dark eyes are well recognizable,” Engling wrote. “[We were] able to demonstrate that a good digital camera with 200mm-lens at a distance of up to five meters is sufficient to capture suitably good pictures to fool iris recognition systems.”

Still, the CCC’s workaround would appear to contradict Samsung and Princeton Identity’s messaging. In marketing materials, Samsung’s highlighted the Galaxy S8’s iris scanner as a “secure” alternative to PINs and passcodes. In an interview with Business Insider in April, Princeton CEO Mark Clifton characterized the Galaxy S8’s iris scanner as “better” than the FBI’s fingerprinting technology.

“[The FBI] uses 13 points of identification per fingerprint, so with all 10 finger you might have 130 unique identifiers,” Clifton said. “[The] Galaxy S8’s iris scanner can register up to 200 identifying features from a single iris.”

It is not the first time the CCC has demonstrated flaws in iris-scanning technologies. In March, the group fooled a commercial system with a 75-pixel image of an iris printed at a resolution of 1,200 dpi (dots per inch).

“If you value the data on your phone, and possibly want to even use it for payment, using the traditional PIN-protection is a safer approach than using body features for authentication,” Engling said.

Article originally published on 05-23-2017. Updated on 05-25-2017 by Kyle Wiggers: Added statement from Samsung spokesperson. 

Kyle Wiggers
Former Digital Trends Contributor
Kyle Wiggers is a writer, Web designer, and podcaster with an acute interest in all things tech. When not reviewing gadgets…
A surprise phone just beat the Galaxy S24 Ultra in a big way
Digital render of a silver Realme GT Neo 6 SE held in bionic hand.

The global Android phone market is expansive beyond comprehension, and brands continually jockey to establish supremacy. Today, it's Realme's turn to lead one such race as it has unveiled the brightest smartphone display that has ever been launched to the general public.

Realme, a spinoff of the Chinese phone brand Oppo (which also birthed OnePlus), announced the GT Neo 6 SE earlier today in China. The phone boasts an impressive juxtaposition of internal hardware, but one that instantly stands tall is the new display. The Realme GT Neo 6 SE features a 6.78-inch OLED display with a spectacular 6,000 nits of brightness -- brighter than the displays on any other phone or consumer device with a screen built into it.

Read more
5 phones you should buy instead of the Samsung Galaxy S24
Samsung Galaxy S24 in Marble Gray standing on park bench.

In the market for a new phone? You might be considering the latest offering from Samsung, which includes the Galaxy S24. It’s the entry level model for the S24 lineup, but still packs great performance and power with Snapdragon 8 Gen 3 chip and 8GB RAM, a beautiful LTPO AMOLED display with up to 120Hz refresh rate and 2,600 nits peak brightness. And even though it’s a base model, you get a triple lens camera system.

But the Galaxy S24 isn’t the only option you have out there. Here are five great alternatives to consider if you’re thinking about the S24.
Samsung Galaxy S24 Plus
Samsung Galaxy S24 Plus Joe Maring / Digital Trends

Read more
5 phones you should buy instead of the Samsung Galaxy S24 Ultra
A person holding the Samsung Galaxy S24 Ultra.

It's hard not to lust after the biggest and most powerful smartphone on the market, and at the moment, that's the Samsung Galaxy S24 Ultra. Samsung's new flagship is here, and it's simply one of the best smartphones you can buy today. The Galaxy S24 Ultra isn't just another smartphone; it's extremely powerful and has some of the most advanced AI features we've ever seen on a phone, along with an excellent camera and battery life. Simply put, it's great.

But you know what? You don't have to buy it. As good as it is, the Galaxy S24 Ultra is only one of a number of smartphones you can buy, and many of them are as good as the S24 Ultra — and may even exceed it in a few key ways.

Read more