What is the threat of biometrics theft and how to avoid it

[root]

Don't lose your "face"​

What is the threat of biometrics theft and how to avoid it

Information security experts urge to be extremely selective in trusting companies with their biometric personal data. Without increased liability in processing such information, the risks of face, fingerprint and corneal leaks can be catastrophic for consumers.

DANGEROUS CONVENIENCES

In early October, in an interview with the agency RIA News InfoWatch President Natalya Kasperskaya urged Russians not to submit biometric data. “They will be stolen, sold, and merged almost with a guarantee. Let’s first explain to us how this data is planned to be protected, including from our employees, ”she said, advising“ not to be carried out for convenience ”.

In May, Deputy Finance Minister Alexei Moiseev at RBC conference stated that "compromising biometric data is the worst thing that can happen."

Alexey Moiseev, Ministry of Finance:

- If a person entrusts his bio-data to a private or public ecosystem, and it does not meet his expectations, then the user's life in the digital future will be broken. You can change the PIN code on the card or passport, last name, but not biometric data. Not everyone is ready to change their face. Therefore, the authorities must ensure the security of such personal data (PD) when banking clients work through remote communication channels.

As Irina Zinovkina, Consulting Director of InfoWatch Group of Companies, explained to RSpectr, if some biometric feature is compromised, then theoretically you can use others: the retina of the eye, fingerprint, voice. But human physiology is limited, unlike the endless number of new passwords.

World statistics show how high the risks of leaks are. The largest of the public sector occurred in 2018 in India. Then the information of 1.2 billion people was compromised, whose identification data, including biometrics, fell into the hands of cybercriminals.

Anastasia Fedorova, information security expert at CROC, also reminded RSpectr of a number of large thefts. For example, in Ghana, during the elections, four computers with biometric registration data of voters were stolen. In the Philippines, a server containing fingerprints of 55 million citizens of the country has disappeared from the electoral committee. In Zimbabwe, attackers stole voter information by hacking into network storage.

“In Russia, it is known about the leak of the archive of audio recordings of Sberbank clients' requests to technical support. Voice samples also refer to the data on the basis of which the biometric identification of the subject is carried out, ”A. Fedorova said.

In April 2021, Chinese fraudsters were caught who, using biometrics, stole $ 76 million from citizens​

For several years they have been deceiving the tax service's face recognition system using deepfakes (fake videos and photos). This allowed criminals to set up shell companies to steal money. To turn the scam, the scammers came up with a scheme that helped create fake companies on behalf of fake people and issue fake tax invoices to customers.

“The swindlers bought photographs of people and their personal identity. Then they were processed in deepfake applications, with the help of which it was possible to hide your face behind the “purchased” faces with the safety of facial expressions, ”said Alexei Drozd, head of the information security department at SearchInform, to RSpectr.
The scammers also used specially prepared smartphones that could mimic the operation of the front camera. She did not turn on, but sent a video made in advance to the tax office.

Alexey Drozd, SearchInform:

- The face recognition system perceived people as real, which made it difficult to identify the scammers. If these processes were lined up differently and organizations relied not only on biometrics, but also on additional data or personal presence, then such scams could be avoided.

Six years ago, at the International Hacking Congress in Germany, the well-known Internet hacker Jan Chrissler showed how easy it is to gain access to sensitive information not only for ordinary users, but also for high-ranking officials. He managed to recreate the fingerprints of German Defense Minister Ursula von der Leyen from a photograph, as well as to photograph her face in a public speech with a smartphone.

The hacker found other bio-data vulnerabilities - for example, there are ways to obtain passwords from gadgets, having access only to the front camera of the device. You can track the movement of the owner's eyeballs when he enters the password, or see the reflection of the phone in the dialers' pupils. The resolution of smartphones allows you to get a very clear picture. J.Krissler is sure that biometrics as a method of data protection is completely irrelevant.

Stolen “faces” and “voices” in the future can be actively used by hackers to create video and audio messages on behalf of “relatives” with a request to urgently transfer money to help out of trouble. If people believed the strangers who called on behalf of the "security" of the banks, then it is logical to assume that the "divorce" by voice and face would be even more effective.

Hackers can use neural networks to create algorithms to maintain simple dialogues with a potential victim on behalf of "relatives" and "acquaintances"​

N. Kasperskaya noted that many people do not even suspect that their bio-data is already in someone's use, which means that there are risks of their illegal use.

Natalya Kasperskaya, InfoWatch:

- People first submit fingerprints and photographs of faces, then they are taken without permission in public places. This data can be used in large real estate transactions, when managing a bank account or going to closed objects.

Deepfakes are taken very seriously in the US. The development of programs for identifying fake videos and photos was taken up by the Department of Advanced Research Projects of the US Department of Defense DARPA. RSpectr previously wrote about methods of dealing with a new hacking tool.

EVERYTHING WILL GO TO BASE

The movement towards the legalization of biometrics in Russia began four years ago. At the end of 2017 entered into force law on the possibility of remote identification, and during 2018 the Unified Biometric System (UBS) was created and various regulatory documents were adopted. In fact, banks have received another tool for working with clients. And at the end of 2020, a new one was released law regulating the use of biometrics.

The law fixed two main points:

1. Banks with a universal license are required to transfer customer data to the Unified Biometric System (UBS) and provide remote services with face and voice authentication.

2. The scope of biometrics and access to the EBS is expanding. Data can be received not only by banks, but also by government agencies, MFC, notaries, legal entities and individual entrepreneurs.

At the beginning of 2021, more than 13 thousand branches of credit institutions were equipped with this technology. Biometric identification is also at the heart of the face-pay system, which was recently launched in the Moscow metro.

In a conversation with RSpectr, Zaur Abutalimov, director of products at Ivideon, said that payment using bio-data will soon become as commonplace as with a bank card or smartphone.

Zaur Abutalimov, Ivideon:

- Already in 2020, the global volume of payments made using biometrics reached $ 404 billion, analysts at Juniper Research calculated.

Since this type of identification will not go anywhere, it is necessary to learn how to safely collect and use such data. A. Drozd believes that it is necessary to pay attention to the form in which biodata is initially stored and how it is used. “If they are encrypted in a certain numerical code, and do not lie in the form of a voice recording, then attackers will not be able to use them. As in the case when biometrics is not the only stage of authentication, ”the expert noted. According to him, there will be no special demand for theft of user bio-data, because they are stored not as a portrait, but in the form of a code mathematically transformed from a picture, where the password is a person's face. Moreover, each company has its own algorithm for creating such a code. “If criminals are going to use biometrics to log into“ State services, ”then they need to be stolen in the form in which they work for the service. This means you need to break the application, ”says A. Drozd.

The expert identifies responsibility for three subjects:

1. The gadget manufacturer (how it stores and encrypts data).

2. The developer of the application (what information does he use: additionally requests to show the face and encrypts or takes ready-made data from the phone's memory).

3. A user who can give his information to criminals himself.

Z. Abutalimov notes that

today, liveness detection is used to protect facial biometrics - a mechanism for determining the signs of a living person​

“You won't be able to outwit the system with a photo or a 3D mask. The likelihood of cheating Face ID on an iPhone is one in a million. Each neural network recognizes faces according to a certain set of features. That is, the algorithms train them according to different schemes and on different datasets. To deceive them, you need to know exactly how a particular neural network works, ”the expert explained.

INCREASE RESPONSIBILITY

Recall that government agencies, banks and other organizations apply the requirements for the protection of biometric PD, established in accordance with Article 19 Federal Law "On Personal Data" and by-laws.

“According to the law, biometrics is already a separate type of PD,” says A. Drozd. - However, it was written in passing about the nuances of losing it. It would be correct to oblige to store data not just in encrypted form, but at the level of protection against recovery, even using a mathematical method. This will reduce leaks as companies will not want to risk mishandling. "

Kirill Ugolev, head of the Tegrus information security division, agrees with him. “Despite the fact that biometric data is allocated in a separate category, the list of measures to ensure their protection is almost the same as other PDs, which include: full name, passport data, etc.,” he explained to RSpectr.

Experts note that the maturity of top management in the field of information security is extremely low, and not only in our country. The management of many companies tries either to ignore the presence of such categories of PD at all, or to carry out the minimum necessary list of measures, only to present them to the regulator in case of verification. At the same time, there are a lot of data protection methods.

Kirill Ugolev, Tegrus:

- Today there are both technical and organizational methods: encryption of databases, communication channels, blockchain technologies, depersonalization, electronic tags, access restriction and much more.

The expert is sure that

bio-data need to be given a higher status to make it more difficult to collect information, especially where it is not directly necessary​

Their processing must be subject to constant technical supervision by regulators. The responsibility of the employees of the processing company for the leakage of data of this category must be significantly increased, up to criminal.

In turn, A. Fedorova believes that protection measures are regulated by a fairly significant number of bylaws. “But the big challenge is getting operators to implement protection measures in a timely manner. And timely and sufficient control was exercised over the operators to comply with all norms, ”the expert noted.

Image: RSpectr, Freepik.com

A source

 

[Alexander Konovalenko.]

Informative article.

 

[Kiril Harchevnikov]

Thank you understood. Interesting post.

 

[Частный детектив Азербайджан]

Thanks for parsing the problem.

 

[Частный детектив. Москва.]

Thanks for the warning.

 

[Turdubaev Dastan]

Thanks for the warning and for the article.

 

[Детективное агентство Израиль.]

Interesting presentation in the post itself.

 

[alexsey1417]

Thanks for the interesting article.