Red Flag On Biometrics: Iris Scanners Can Be TrickedRebecca Bowe When it comes to the collection and storage of individuals digital fingerprints, iris scans, or facial photographs, system vulnerability is a chief concern. A social security number can always be cancelled and reissued if its compromised, but its impossible for someone to get a new eyeball if an attacker succeeds in seizing control of his or her digital biometric information. Among all the various biometric traits that can be measured for machine identification such as fingerprints, face, voice, or keystroke dynamics the iris is generally regarded as being the most reliable. Yet Galballys team of researchers has shown that even the method traditionally presumed to be foolproof is actually quite susceptible to being hacked. The project, unveiled for the first time at the security researchers conference, made use of synthetic images that match digital iris codes linked to real irises. The codes, which are derived from the unique measurements of an individuals iris and contain about 5,000 pieces of information, are stored in biometric databases and used to positively identify people when they position their eyes in front of the scanners. By printing out the replica images on commercial printers, the researchers found they could trick the iris-scanning systems into confirming a match. This is the first time anyone has essentially reverse-engineered iris codes to create iris images that closely match the eye images of real subjects, creating the possibility of stealing someones identity through their iris. This revelation not only exposes a security hole in a commercial iris-recognition system, but also proves that prominent tech firm and FBI contractor B12 Technologies which is building a database of iris scans for the Next Generation Identification System was wrong when it when it noted on its website that biometric templates cannot be reconstructed, decrypted, reverse-engineered or otherwise manipulated to reveal a persons identity. Any new detection of biometric system flaws is relevant in the context of the massive governmental identification programs moving forward at the global level. Theres Indias bid to create the worlds largest database of irises, fingerprints and facial photos, for example, andArgentinas creation of a nationwide biometric database containing millions of digital fingerprints. Just this week in Israel, High Court justices criticized a planned biometric database as a harmful and extreme measure. Lawmakers who approve such identification schemes should give serious consideration to any new information surfacing about biometric system vulnerabilities. Visit the Electronic Frontier Foundation for the latest in biometrics, privacy, and security. You can support this information by voting on Reddit HERE linkwithin_text=Related Articles: 