As consumers flocked to stores nationwide for Apple’s iPhone 5S release on Friday, hackers raced to claim a growing bounty for cracking the product’s “Touch ID” fingerprint reader.
Security researchers Nick Depetrillo and Robert David Graham
launched IsTouchIDHackedYet.com on Wednesday, wherein the pair
challenged anyone to offer video evidence of recreating one’s
fingerprint and using it to unlock that person’s iPhone 5S.
Depetrillo originally pledged US$100 to anyone who could
successfully prove the hack. Since his offer, others have added
cash rewards and bitcoins collectively approaching $20,000. Booze
and various other prizes have also been added to the pile.
“I put my money where my mouth is and it really took off,”
Depetrillo said.
Meanwhile, Sen. Al Franken has sent a letter to Apple asking how
the company’s new product will protect the privacy of users.
“The iPhone 5S reportedly stores fingerprint data locally ‘on
the chip’ and in an encrypted format,” Franken wrote to
Apple’s CEO Tim Cook. “It also blocks third-party apps from
accessing the Touch ID. Yet important questions remain about how
this technology works, Apple’s future plans for this technology,
and the legal protections that Apple will afford it.”
Franken posed pointed questions on whether fingerprint data could
be extracted - remotely or not - by third parties, if Apple will
allow third parties to use the data, and if Apple considers
fingerprint data to be a "tangible thing" as defined in
the Patriot Act.
Such fingerprint-based scanners have been cracked in the past
using the likes of gelatin and silly putty. Yet Apple maintains
its sensor is unique in its “liveness” verification
standards, so much so that even a severed finger could not be
used to unlock a phone, the company claims.
The “Touch ID” sensor is 170 microns thin and scans
sub-epidermal skin layers with 360-degree reliability, Apple
said. In addition, the company says fingerprints will be stored
in the device only - not in the cloud easily accessible to
hackers and government spies.
Facebook, Google, and other companies have in the past created
contests that pay users who “pinpoint security loopholes,”
though Apple has never offered prizes for flagging bugs.
"I think Apple is quietly amused," Graham told CNET.
"I'm sure their engineers are confident in their abilities to
address all conceivable weaknesses - yet worried about
inconceivable techniques hackers might come up with.”
Depetrillo said he started the idea not necessarily to see the
iPhone hacked, but more to show how difficult the fingerprint
sensor will be to invade.
“Basically people criticized the TouchId sensor as being
insecure, thinking it was a typical fingerprint sensor from five
years ago,” he wrote to Forbes. “In reality it’s a lot
harder, and I was part of a vocal minority of security
researchers who argued Apple did a good job.”
The pair said they are only responsible for their own pledges,
and the winner must go after the other bounties themselves,
though Depetrillo said he’s keeping track of any
“deadbeats” that may skip paying out.
But connected hackers could likely sell any information on how to
unlock the iPhone 5S for more than what is currently offered at
IsTouchIDHackedYet.com, Forbes reported.
“Nothing is hack proof,” Depetrillo said. “I honestly
don’t know if someone will claim it…If they do I’ll be pleasantly
surprised.”