The flaw, discovered by researchers at Syss (via The Register) allows Windows Hello to be spoofed on Windows 10 releases older than the Creators Update (build 1703). However, even if your PC is currently running the Creators Update or Falls Creators Update, facial recognition needs to be set up again to circumvent the flaw.
Matthias Deeg and Philipp Buchegger, the researchers who discovered the attack, say that Windows Hello can be fooled by using printed photos of an authorized user that has been modified. Using a frontal photo taken with a near-infrared camera, facial recognition on the affected Windows 10 versions could be fooled. Deeg and Buchegger tested the spoofing attack with Windows Hello's standard setup, as well as with "enhanced anti-spoofing" enabled, and were able to bypass both. From the report:
Both, the default Windows Hello configuration and Windows Hello with the enabled "enhanced anti-spoofing" feature on different Windows 10 versions are vulnerable to the described spoofing attack and can be bypassed. If "enhanced anti-spoofing" is enabled, depending on the targeted Windows 10 version, a slightly different modified photo with other attributes has to be used, but the additional effort for an attacker is negligible. In general, the simple spoofing attack is less reliable when the "enhanced anti-spoofing" feature is enabled.
While worrying, the attack requires a pretty specific set of steps to work. The best way to stay protected is to make sure you're PC is current with either the Creators Update or Fall Creators Update. Once updated, you'll want to set up Windows Hello's face recognition from scratch to guard against spoofing.
You can view demonstrations of the exploit in action in the videos below.
Thanks, Daniel, for the tip!
Get early access to Windows 10 October 2020 update – here's how.
In this guide, we'll show you the steps to upgrade your computer to the final release of the Windows 10 October 2020 Update before it's officially available to everyone.
Windows 10 October 2020 Update moves closer to launch with Release Preview
The Windows 10 October 2020 Update is nearly ready for primetime. Microsoft began shipping the update to Release Preview Insiders today, which is the last stop before it will start its full rollout to the public.
Join us LIVE for the Windows Central Video Podcast today at 2:30PM ET
We're LIVE with the Windows Central Video Podcast today at 2:30pm ET, make sure you're there!
The NFL is back! Check out these must-have Windows apps for football fans
After months of waiting through a unique offseason and no preseason games, the NFL is finally back this week. With these Windows 10 apps, you won't miss a snap of the NFL action.