iPhone Hack Fools Touch ID with Hand Photos

Jan Krissler, a.k.a. Starbug, demonstrates how he used a public photo of German Defense Minister Ursula von der Leyen to recreate her fingerprint.

Jan Krissler, a.k.a. Starbug, demonstrates how he used a public photo of German Defense Minister Ursula von der Leyen to recreate her fingerprint.

A photo of your hand can be used to recreate a fingerprint that could unlock your Touch ID-locked iPhone 6. So says German hacker Jan Krissler, who used public photos of German Defense Minister Ursula von der Leyen, taken at a news conference, to recreate the minister's fingerprints. 

Krissler, who goes by the hacking pseudonym Starbug, previously showed that he could unlock a Touch ID-locked iPhone 6 by forensically lifting a fingerprint from a surface such as a glass or the iPhone's own screen. But now Krissler has shown that he can thwart Touch ID even without physical access to the iPhone owner's fingerprint.

MORE: Best Mac Antivirus Software

Speaking on Dec. 27 at German hacking group Chaos Computer Club's annual convention in Hamburg, Krissler demonstrated that he used a photo of  von der Leyen's thumb, taken at a distance of 3 meters with a 200er-Objektiv lens at a news conference in October, as well as several other photos from other angles, to recreate von der Leyen's fingerprint.

Then Krissler used a commercial software product called VeriFinger to synthesize these photos into a fully imaged fingerprint, which should then be able to fool biometric security devices such as Apple's Touch ID fingerprint scanner, found in the iPhone 5S, iPhone 6 and 6 Plus, iPad Air 2 and iPad Mini 3. Krissler said that other image-processing software aside from VeriFinger could be used as well.

Once he has the digital image, Krissler can use the same method he previously described for unlocking Touch ID with physically obtained fingerprints: he inverts the colors of the obtained print, so the ridges of the fingerprint are rendered in white and the grooves in black, then prints the image in black ink. The black ink on the paper provides just enough texture to recreate a fingerprint's three-dimensional shape, but inverted.

Krissler then pours glue or plaster over the print of the fingerprint. The ink print serves as a stamp, imprinting the fingerprint's whorls and ridges into the glue and creating a mold that can successfully unlock a Touch ID-locked iPhone 6. 

Krissler says that even mobile phone cameras, with the right lighting, could be used to capture the necessary photos. He's also working on using public photos of a person's face to image his or her iris.

So what should politicians and other security-minded people do to protect their biometric data? Wear gloves, says Krissler. The full video of Krissler's presentation (in German) is available on YouTube

Jill Scharr is a staff writer for Tom's Guide, where she regularly covers security, 3D printing and video games. You can email Jill at jscharr@tomsguide.com, or follow her on Twitter @JillScharr and on Google+. Follow us @tomsguide, on Facebook and on Google+.

TOPICS

Jill Scharr is a creative writer and narrative designer in the videogame industry. She's currently Project Lead Writer at the games studio Harebrained Schemes, and has also worked at Bungie. Prior to that she worked as a Staff Writer for Tom's Guide, covering video games, online security, 3D printing and tech innovation among many subjects. 

Latest in iPhones
iPhone 17 Pro render
iPhone 17 Ultra just tipped to replace Pro Max in new leak — with these key upgrades
RCS messaging on an iPhone
Forget green bubbles — iPhones will soon get encrypted RCS messaging to Androids
an iPhone 15 Pro playing ambient music in iOS 18.4
My favorite iOS 18.4 addition is the productivity booster I've always needed
iPhone 17 Pro render
iPhone 17 Pro Max leak claims it’s ready for production — and seems to confirm its new design
iPhone 16e review.
iPhone 16e is facing Bluetooth problems — here's what's going on
iPhone 17 Air vs iPhone 17 Pro Max
iPhone 17 Air vs iPhone 17 Pro Max: Everything we know so far
Latest in News
iOS 19 logo on an iPhone
Apple WWDC 2025: iOS 19 and everything we know so far
Siri
Siri 2.0 features reportedly only working ‘two-thirds to 80% of the time’
NYTimes Connections
NYT Connections today hints and answers — Sunday, March 16 (#644)
Nintendo Switch 2
New Nintendo Switch 2 FCC filing suggests this beloved Nintendo controller could make a comeback
(From L to R) Rohan (Nik Dodani), Josh (Brandon Flynn), Dorothy (Edie Falco), John (Dean Norris), and Liddie (Lisa Kuthrow) in The Parenting
Max top 10 movies — here’s the 3 worth watching right now
NYT Strands on a cellphone
NYT Strands today — hints, spangram and answers for game #378 (Sunday, March 16 2025)