iPhone X: Apple’s Face ID tricked using $150 mask

A Vietnamese cybersecurity firm claims to have bypassed Apple’s new face-scanning security system using a $150 (£115) mask, reports Tech Crunch.

Researchers at Bkav say they created a mask that replicates the features of the user’s face to fool the Face ID system.

The mask was made “using a consumer-level 3D printer, a hand-sculpted nose, normal 2D printing and a custom skin surface designed to trick the system”, they added.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

While the hack highlights that Apple’s Face ID is by no means foolproof, the news “shouldn't alarm the average iPhone owner, given the time, effort, and access to someone's face required to recreate it”, Wired says.

Additionally, Ars Technica says Bkav’s video demonstrating the hack had insufficient evidence to determine if the results were “a true bypass of an authentication system Apple has spent years developing”.

For instance, continues the site, it is not known whether the mask is able to fool the security system directly after the user activates Face ID on their iPhone X or whether a certain period of time passed after the initial set-up.

This is ���crucial” to assessing the hack’s authenticity as the security system re-scans the user’s face over time to improve its accuracy, Ars Technica adds. Consequently, the security firm could have “trained Face ID over time to work with the mask” – an advantage real-world hackers don’t have.

Face ID is only available on Apple’s iPhone X flagship, which launched on 3 November. While the smartphone activates the feature during its set-up phase, it is an optional and can be disabled in the settings menu.