Jump to content

Windows Hello facial login gets tricked by printed photo on older Windows 10 versions


Recommended Posts

If you log into your PC using facial recognition on Windows 10 (otherwise known as Windows Hello), then be aware that older versions of Microsoft’s OS can be easily fooled with a simple printed photo of the user. Even those running the latest Fall Creators Update could potentially be victims here.

German security firm Syss discovered this exploit, which circumvents Windows Hello security on Windows 10 PCs running versions which are older than the Fall Creators Update.

But, crucially, it can affect even fully up-to-date Windows 10 machines running builds of the Fall Creators Update known as 1703 or 1709, if facial recognition was set up in a previous version. In other words, to avoid the exploit, you’ll need to set up Windows Hello again even on PCs using the latest version of Microsoft’s desktop OS.

According to a few proof of concept videos released by the security researchers (see the first clip below), Windows Hello can be spoofed with a relatively low resolution laser-printed photo of the user taken with a near IR (infrared) camera, although the image must be slightly modified.

The spoof is out there

As The Register reports, Syss claims that even if Windows Hello has its enhanced anti-spoofing mode enabled, a somewhat differently modified photo can still be used to successfully log onto the target machine. Even in this case, the researchers say that the “additional effort for an attacker is negligible.”

All this sounds like a very worrying hole in Microsoft’s facial recognition login procedure, for sure, assuming the security firm is on the money here.

We’ve contacted Microsoft for comment on the matter, and we’ll be sure to update this story if we receive a response.

It would seem, though, that if you use facial recognition for logging in to your Windows 10 PC, then it might be a prudent idea to set it up once again. Or, if you’re running an older version of Windows 10, you’ll first want to update to the new Fall Creators Update, and then set up Windows Hello again.

http://feeds.feedburner.com/~r/techradar/software-news/~4/YV8m54yGV_Y
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...