Sep 25, 2013

Biometric Security: Our Take on Apple's New Technology

In today's Whiteboard Wednesday, Patrick Hellen discusses the new biometric security features on the new iPhone 5S. Everybody is talking about how user friendly the new fingerprint scanner is but how is it from a security perspective? Watch this quick video to see what Patrick feels are the pros and cons of the new feature.

Read Video Transcript

Hi everybody, welcome to Whiteboard Wednesday. My name is Patrick Hellen, I'm the community manager here at Rapid7. And this week we're going to be talking about the new iPhone launch.

Specifically, we're going to be talking about the biometric security measure that's then added to the new iPhone. Number one, because we're a security company, that makes sense. But also number two, we have sort of a breakout of the pros and cons of this type of added security measures and some of the things you should be aware of some of the things you should be thinking about if you do decide to go out and buy the new iPhone.

So, starting right off with number one, the Pro, and I mean the only pro, so to speak. It's more secure than your average password. It's a good thing to have additional layers of security, those of you who are using Gmail or Twitter and using dual authentication. All these things are good movements in the right direction. And in this case, having a biometric scan of your fingerprint is definitely going to be more secure than your average password, especially when you look at the stat of over 50 percent of users of the iPhone itself don't have any PIN on their phone at all. They're just simply unlocking it with the slider.

So, from a security company, you know our position on this is going to be the any amount of security that you can add, generally better. It's usually a better thing, even though it's just something that's a relatively simple fix from a standpoint of you're scanning your thumb as opposed to sliding the slider. Excellent, still always in the realm of the more, the better in these cases.

Now that's kind of the only pro we're going to go with. We're going to jump into cons, which are even with this added security, hacks are still going to happen. It's just a matter of time. The greatest encryption in the world us only encryption until somebody figures a way around it, and it's the same thing with any security measures that come out.

So the hacks that are going to be happening are going to be happening because this is such a high profile piece of equipment. The first person to break into it is obviously going to make a pretty big name for themselves in the industry, and all of that being said and done, it's an Apple product, which means that if these hacks do occur, and when these breaches happen, and when people find a way around these types of security, the fix itself is going to take some time.

Now, Microsoft is really good at putting out code that needs to be fixed. I don't know if that's a compliment or not, but they're really good at updating that code over and over again to make sure that subsequent vulnerabilities and subsequent problems that have been found are taken care of.

Apple is not as good at it. It's sort of a compliment in that they haven't had a lot of practice in putting out product that needs a lot of fixes, but when they have, you actually end up with discussions about, "Well, you're holding the phone wrong," as opposed to an actual fix itself.

So this is a big con in that, let's say that this is a great added layer of security, but the timeframe on it, if it does fail, it potentially is significant.

Number two, and this is kind of my own personal feeling on this matter, is that it's a piece of ID that you can't change. So we have an example of the Social Security card and a Massachusetts license, and these two, it's information that exists externally from you.

So let's say your Social Security number gets stolen and someone opens 55 credit cards in your name. Worst case scenario, you can get a new one. You can adapt, you can change it. You can't change your thumb print.

So that's in and of itself potentially scary. Now yes this isn't storing a picture of thumb, it's not your actual thumbprint, it's some sort of algorithm about how your thumbprint is accessed, et cetera, but if this is the beginning, if is this is the first sell of biometrics really hitting the mainstream, then we're in for a potential problem where if some guy in Romania is a hacker and he's got my Social Security number, there's steps I can take to deal with that.

If someone has my thumbprint, there is nothing I can do other than never use a biometric device that needs a thumbprint from that point on. And that's the thing that worries me, is that it's not that the attack itself will somehow involve them making a fake latex thumb or any of these kinds of esoteric, wildly strange scenarios, it's that it's putting identification that I can't ever alter, into a position where it might become weaponized, so to speak. And then for me, it's a big kind of red flag.

Number three, this is a very interesting one. This is actually kind of more what if in an interesting way. Our lawyer Mark Choplin, wrote an article for Wired about the fact that this biometric scanner might remove any and all Fifth Amendment protection that your phone might have.

So, just to paraphrase, Fifth Amendment obviously a way around incriminating yourself in criminal matters. If I have a password stored in my brain, then in a criminal case or whatever, I'm not forced to incriminate myself if the device of that password locks, has to be revealed from my own brain.

The data is stored there, I don't have to give it to anybody as an anti-criminal nation measure. The problem is that your fingerprint is not in any way shape or form stored in your brain. It's a physical aspect of you. So, if you're getting booked, and those of you that watch crime dramas and Law and Order and things like that, you know the part of the booking process is that they do fingerprint you and a lot of these cases.

If you're booked and fingerprinted and you've got a mug shot taken, then that might be the only thing around how to unlock your phone. Today, if you have a [pattern] lock on your phone, and they say, "Unlock this." "Whoops. I forgot, Fifth Amendment, prove me wrong, et cetera."

They can just take your fingerprint, if they can just push your phone into your hand and make you touch it, that suddenly opens up an entire new Vista.

So, is this something you should worry about? Absolutely not. I don't think it's going to be anything that happens anytime soon, but I would definitely, if you're in the security industry and you're interested in this sort of stuff, let's hope you are because you're watching Whiteboard Wednesday. This is the kind of thing you'll probably see an upcoming court case about maybe in the near future, that specifically speaks to this kind of concern, which for me is pretty interesting.

Finally, let's end on. Apple says they're not going to be storing any of the biometric data anywhere but the phone itself which, that's great, but do you really buy that? Let's say, in a perfect world, they are in fact storing the data on the phone, but they also said that about their GPS information, and the last tower your cell phone had reached out to to speak to.

So, from a marketing standpoint, from a collecting data on their customers standpoint, Apple might not want to store this type of data because it might not give them anything additional and GPS data does, but at the same time, if someone gets a hold of your phone, it doesn't make me any more secure to think that this data now lives on a chip that you can slip into your pocket.

There's some sort of weird feeling of security about it living in a server farm under heavy guard in Apple Land, but it's not as secure as you want it to be.

So for me, it's not storing the data today, what if they change their mind later? What if someone figures out a way in this hacking ability to steal it? It all kind of ties together.

So for this week, one pro, four cons, Massachusetts ID. This has been Whiteboard Wednesday, we'll see you next week.

Live Webcast

Why Updating to iOS7 is a Must For Your Organization's Security

 Register Now