Hackers Break Apple Face ID

Vietnamese security firm Bkav created an improved mask to bypass Apple's Face ID

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involves a security vulnerability in Apple's Face ID AI system that allows unauthorized access to a device using a spoofed mask.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The Face ID system failed to perform robustly under spoofing attempts, failing to distinguish a static mask from a live face.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The vulnerability arose from the Face ID AI system's unintentional failure to correctly distinguish a composite mask from a living human face during post-deployment operation.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The Face ID system is a consumer biometric verification tool used for device security, which poses low or negligible risk to society at large.

AI system and alleged parties

• AI system: Face ID (Apple)
• AI purpose: Face Recognition; Identification
• Behaviour type: Autonomous
• Alleged developer: Apple
• Alleged deployer: Apple
• Alleged harmed parties: Device Owners, Apple

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 2

Potential causes

Management

• Overstating Security Claims: Marketing hyped a one-in-a-million safety rate, creating false confidence.
• Dismissing External Reports: Apple declined to comment on or publicly address the researchers' findings.
• Rushed Product Release: Releasing the iPhone X early may have limited thorough security validation.

Technology

• Liveness Detection Bypass: Static masks with 2D printed IR eyes successfully bypassed liveness detection.
• Partial Face Scanning: AI algorithm only scans half of the face, making it easier to spoof with masks.
• Adaptive Learning Flaw: Entering passcode after failed scans trains the AI to recognize the spoof face.

Data Inputs

• Insufficient 3D Depth Data: AI accepted flat 2D printed eyes and lips mounted on a basic 3D frame.
• Lack of Multi-Angle Scans: Face ID only uses a single portrait angle, unlike multi-angle solutions.
• Underdeveloped Facial Data: Children's facial features are not distinct enough, causing false positives.

Human Factors

• Passcode Sharing: Sharing passcodes allows the AI to retrain and accept unauthorized users.
• Overreliance on Biometrics: Users assume Face ID is infallible, ignoring the secure passcode fallback.
• Surreptitious Photo Capture: Target photos can be taken secretly to reconstruct a 3D model of the face.

Process and Methods

• Inadequate Spoof Testing: Apple's testing with Hollywood masks missed cheaper composite spoof materials.
• Lack of Coordinated Disclosure: Researchers did not share the bypass methodology with Apple before publishing.
• Unverified Testing Methods: Initial bypass claims were published without independent third-party validation.

Information quality

• Classification confidence: High
• Reason for confidence: The reports are detailed, from multiple reputable tech journalism sources, describing the same proof-of-concept bypass by Bkav. While there was initial skepticism, subsequent videos and demonstrations confirmed the feasibility of the mask bypass under specific conditions.
• Ambiguities identified: Some reports note that Bkav did not initially show the full setup process, leading to questions about whether the phone was pre-trained on the mask.
• Alternative interpretations: Some experts argued it was a stunt rather than a practical real-world hack due to the extreme difficulty of scanning a target's face and creating a precise mask.

Security researchers demonstrated a vulnerability in Apple's Face ID by using a composite mask to bypass authentication. While showing limitations in commercial facial recognition AI, the national security impact is minor, as exploiting the vulnerability requires physical access to a specific device and highly customized physical spoofing materials.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Alleged perpetrator: Bkav

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding biometric security robustness rather than an active national security crisis.
• Autonomy: Human-controlled. The AI system functions as an assistive authentication tool under direct human control, with no independent decision-making capabilities.
• Novelty: Evolved capability. Represents an evolved capability in spoofing biometrics, demonstrating that neural-network-based liveness detection can be fooled by composite physical masks.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety risks were identified in this biometric bypass demonstration.
• Information security: Minor. The bypass of a consumer biometric system poses a minor risk to intelligence security if government personnel devices are targeted, but it requires physical access and custom mask creation.
• Sovereignty: Negligible. No impact on state authority, territorial control, or core government operations was observed.
• Economic security: Minor. Represents a minor vulnerability in a major US tech company's commercial product, but does not threaten strategic technological competitive advantage or economic stability.
• Societal stability: Negligible. No threat to social cohesion, civil liberties, or population safety. Only minor, isolated privacy bypasses were reported.