Apple Face ID’s Attention Detection Safeguard Fooled By 3D-Printed Mask

Looks like Apple’s Face ID technology isn’t really that secure after all. After being previously tricked by a $150 mask, the Cupertino giant’s new biometric system that was introduced with iPhone X is once again fooled by a 3D-printed mask even when the “Require Attention” feature is turned on.

On Monday, Vietnamese security company Bkav once again proved that Apple’s Face ID can easily be tricked when one has the right resources. The company apparently shared a video clip showing an iPhone X getting unlocked by a $200 3D printed mask made of stone powder.

Bkav’s new video comes 2 weeks after the company made headlines in mid-November for showing that a mask could easily bypass Face ID. At the time, many doubted Bkav’s video since the “Require Attention” feature was assumed to be inactive when the clip was made.

In Bkav’s update, it made sure that the “Require Attention for Face ID” and “Attention Aware Features” were both shown in the video as enabled on the iPhone X used in the demo. “Require Attention” is supposed to assure users that Face ID is totally safe since it provides an extra layer of security against masks, photographs and the like. It also ensures that the handset wouldn’t get unlocked when the user is looking away.

For the new demonstration, Bkav used a 3D printed mask and 2D infrared images of eyes that were taped over the mask to emulate the real eyes of the user. Right away, the setup was able to unlock the iPhone X at the first try. It didn’t even have failed attempts. In a blog post, Bkav stated that the materials and tools it used in creating the mask are “casual for everyone.”

MacRumors, however, countered that Bkav only managed to come up with a perfect copy of the user’s face because it had access to the right resources. Not everyone has access to a 3D printer, several hundred dollars worth of materials and detailed photographs of a user for the reconstruction of the owner’s face. Moreover, this would require physical access to the owner’s iPhone X. The publication also pointed out that if the 3D printed mask and 2D infrared eyes aren’t perfect, Face ID will fail after five attempts.

Nevertheless, Bkav strongly believes that Apple’s Face ID isn’t the best security feature for smartphones used in business transactions. “About 2 weeks ago, we recommended that only very important people such as national leaders, large corporation leaders, billionaires, etc. should be cautious when using Face ID. However, with this research result, we have to raise the severity level to every casual users: Face ID is not secure enough to be used in business transactions,” VP of cyber security at Bkav Ngo Tuan Anh said.

Bkav maintains that fingerprint-based biometric security systems are still far more superior to facial recognition technology like Apple’s Face ID. To prove its point, the security firm said fingerprints cannot be collected by hackers at a distance, while photographs can. “It can be said that, until now, Fingerprint is still the most secure biometric technology. Collecting a fingerprint is much harder than taking photos from a distance,” the firm stated.

According to Apple Insider, Bkav’s new video is just one of the successful endeavors to fool Face ID. Earlier this month, a 10-year-old boy was documented to have unlocked his mother’s iPhone X. There are also reports of twins unlocking their sibling’s handset. All these strongly prove that Face ID couldn’t really distinguish between family members, especially when they do strongly resemble each other.