According to the researchers, devices upgrading from Windows 10 versions 1511 and 1607 using hardware that doesn’t support Enhanced Anti-Spoofing are vulnerable to their photo-based approach. This method relies on a head-on shot of the device owner in a near-infrared state. They also manually changed the brightness and contrast levels to meet the requirements of Windows Hello, and printed the image using a laser printer.
Typically, Enhanced Anti-Spoofing isn’t toggled on by default. On Windows 10 Pro and Enterprise, you can load up the Local Group Policy Editor and enable the feature by navigating to Administrative Templates > Windows Components > Biometrics > Facial Features. In Windows 10 Home, you can turn it on by editing the registry. But regardless of the Windows version, the camera must still provide support on a hardware level.
The proof-of-concept hack relies on the Dell Latitude E7470 with a LilBit USB camera. When testing with Windows 10 versions 1709, 1703, 1607, and 1511, the researchers were even able to break into the laptop with Enhanced Anti-Spoofing turned on.
Meanwhile, Microsoft’s Surface Pro 4 supports Enhanced Anti-Spoofing on a hardware level. With the feature enabled, the researchers couldn’t get into Windows 10 versions 1709 and 1703, but they did access the device on Windows 10 version 1607.
“In the spring of 2018 we will publish further results and details of our research project, for example on different variations of the attack,” Syss reports. “For example, our proof-of-concept video ‘Biometrics: Windows Hello Face Authentication Bypass PoC II’ shows two variants of the spoofing attack using different means.”
The takeaway from this discovery is that if your device doesn’t support Enhanced Anti-Spoofing on a hardware level, then it’s susceptible to photo-based access on all versions of Windows 10. If the device does support Enhanced Anti-Spoofing, then you should upgrade the platform to 1703 at the very least (1709 is the latest).
Of course, the second takeaway is that to gain access, you need a compatible, hard-to-acquire photo of the device owner. The proof of concept, as shown in the video above, relies on someone enabling facial recognition on the Surface Pro 4, and then converting what appears to be the same image to a near-IR form on a second PC. Using that second PC, he printed out the image at a 340 × 340 resolution, and successfully unlocked the Surface Pro 4.
Windows 10 device owners may want to remain somewhat wary about facial recognition for now. Even Apple’s Face ID technology on the recent iPhone X isn’t exactly perfect, and can even succumb to children who closely resemble iPhone X owners. That said, fingerprint scanners still appear to be the best option for gaining access to Windows 10 without the need for a password or PIN.
