The Living Dead: Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks
summary
Researchers demonstrate practical attacks that bypass mobile liveness checks by unpacking SDKs, hooking app code (Frida-style), and replacing or replaying captured frames and signed results; they analyze 18 SDKs and find 11 insecure implementations. Vulnerabilities include configurable action sequences and thresholds on-device, plaintext or separably encrypted frames enabling result malleability, hardcoded keys, and insecure integration libraries. A live demo shows an attacker-controlled device passing blink/nod checks and uploading a victim photo to complete account opening, proving the attacks are low-cost and effective.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 2:17Face recognition security
- 6:35System architecture and demo
- 11:06Architectural vulnerabilities
- 17:01Exploitation techniques
- 21:28Empirical study results
- 23:40Practical attack methodology
- 34:57Conclusion and takeaways
related talks
25mBiometric Authentication Under Threat: Liveness Detection Hacking
08mAdvancements in facial recognition
27mAl-Generated Attacks: The New Era of Threats to Authentication
26mVirtual U: Defeating Face Liveness Detection by Building Virtual Models...
21mWhen Attackers Go Mobile-First: What Developers Need to Know
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
24mRecent Mobile App Security Incidents from Real-World Cases
16mThe Threat of Deepfakes to Remote Identity Verification Systems