Facial recognition technology defeated by photographs

It's all the rage on TV and in the movies; cameras pick out a face from the crowd, run the image through a software package, and after a series of dots and lines cover the image (showing computers at work, I suppose) the face is anonymous no more, identified from biometric data stored in a database. But what if the technology isn't so infallible? What if, as a team of Vietnamese researchers maintain in a paper they're presenting at Black Hat DC, a technical information security conference, facial recognition software can be fooled by ... a photograph?

Your face is NOT your password: Face Authentication Bypassing Lenovo – Asus – Toshiba (PDF), the paper presented by Nguyen Minh Duc and Bui Quang Minh from Bach Khoa Internetwork Security Center (Bkis) at Hanoi University of Technology, focuses not on TV-style picking a face from the crowd, but rather on the increasingly prevalent use of facial recognition technology as a security measure used like a password. Specifically, the technology is used to control access to secure computers made by several companies, including Lenovo, Asus and Toshiba.

What the researchers found is that the technology just isn't that hard to fool. Even photographs that have previously been digitized and distributed, like those on Web pages or transmitted through videophone conversations, will do the job.

The model exploits the flaw in image processing. In other words, it uses a photo of a person instead of his/her real face. It works because the algorithms will process in effect digital information.

Provided those conditions, an attacker might take some photos of one user within the system, perform some image editing, regenerate “special pictures” and penetrate into the system.

The paper points out that photos of most people are fairly easy to come by. Sources they suggest include:

• Webcam chat (MSN, Yahoo Messenger, AOL, Skype, ... )
• Searching on the Internet, especially on personal website or blog making use of
• Web 2.0 Technologies (Flickr, Yahoo Blog, Facebook ...).
• Using camera with tele-lens to get a photo of the target from long distances.
• Hacker asks that person to take a picture with him directly.
• And many other methods ...

To work, though, the image used to spoof the technology has to somewhat resemble the image stored by the system in terms of angle and lighting. That means images may have to be manipulated and tried in turn until one works -- a technique the researches call "fake face bruteforce." They point out, though, "It is just easy to do that with a wide range of image editing programs at the moment."

The team was able to break through the facial recognition security technology of all three computers with relative ease, with only the Toshiba software requiring the somewhat more-sophisticated "bruteforce" approach.

Biometric data, including facial recognition, is increasingly being built into passports, drivers licenses and other forms of ID. Australia and Germany both use facial recognition to control access and determine identity at border crossings, and the U.S. and other countries are moving in that direction. Not all of these applications are susceptible to bypasses involving a portfolio of photographs flashed in front of a cameral lens.

But, especially for uses where people aren't watching closely, facial recognition technology apparently has way to go before it provides the security its boosters promise if it can be spoofed by a candid snapshot and a few minuted with Photoshop.

Contact J.D.: civilliberties (at) tuccille.com