Can biometric verification systems be protected from attacks?

By Puja Sharma

New research from iProov reveals the latest attack trends on biometric verification systems and how they can be mitigated

iProov, the firm specialising in face biometric verification and authentication technology, has released first-of-its-kind Biometric Threat Landscape 2023 Report, sharing analysis and revealing the attack trends facing biometric systems.

Digital identities are rapidly becoming more widely used as organizations’ and governments’ digital transformation projects mature and users demand more remote accessibility for everything, from creating a bank account to applying for government services. To support this transformation, many organizations have adopted biometric face verification, as it is widely recognized as offering the most user-friendly, secure, and inclusive authentication technology solution.

Yet, as biometric face verification gains traction and becomes more widely adopted, threat actors are targeting all systems with sophisticated online attacks. To achieve both user-friendliness and security, organizations need to evaluate their biometric solutions for resilience in the face of these complex attacks.

Digital Injection Attacks are Rampant – and Evolving 

Mobile platforms were also identified as increasingly vulnerable, with attacks now using software called emulators, which mimic the behavior of mobile devices. The report warns organizations against relying on device data for security, with a massive 149% increase in threat actors targeting mobile platforms in the second half of the year compared to the first.

“Our analysis shows that the online threat landscape is always rapidly evolving,” said Andrew Newell, Chief Scientific Officer at iProov. “The 149% increase in attacks using emulators posing as mobile devices is a good example of how attack vectors arrive and scale very quickly. We have seen a rapid proliferation of low-cost, easy-to-use tools that have allowed threat actors to launch advanced, scalable attacks with limited technical skill.“

The Deepfake Threat is a Reality – and Novel Face Swap Attacks Emerge

Attacks using deep fake technology became far more common last year. The technology is hotly debated and becoming more mainstream, with bans on its non-consensual use forming an important part of the draft of the UK Online Safety Bill. Today, it is commonly used by cyber attackers to create 3D videos that trick systems into thinking the real consumer is trying to authenticate.

2022 also saw the first use of a new type of synthetic digital attack – novel face swaps – which combine existing video or live streams and superimpose another identity over the original feeds in real-time. This type of complex attack appeared for the first time in H1 of 2022 but instances of its use continued to soar throughout the rest of the year. These attacks are incredibly challenging to detect for both active and passive verification systems. After emerging in the first half of 2022, novel face swaps rapidly grew by 295% from H1 to H2.

“In 2020, we warned of the emerging threat of deep fakes being digitally injected into camera feeds to impersonate an individual’s biometric verification process,” said Andrew Bud, founder, and CEO of iProov. “This report proves that deep fake attacks are now a reality. Even with advanced machine-learning computer vision, systems are struggling to keep up in detecting and triaging these evolving attacks. Any organization that isn’t protecting its system against these threats needs to do so urgently, especially in high-risk identity verification scenarios.”

No One is Safe: Attacks are Happening En Masse, Indiscriminately 

Motion-based attacks launched en masse all over the world occurred three times a week last year, sending bursts of 100 to 200 verification attempts at a time to try and overwhelm platforms. Attacks targeted different systems at once and were indiscriminate of industry or geography, suggesting no organization is safe. Motion-based verification systems – which use active motions such as smiling, nodding, and blinking – were frequently targeted.

Key Findings

• Digital injection attacks occurred five times more than persistent presentation attacks (e.g., showing a mask to the camera) in 2022.
• Attackers are spoofing metadata and compromising even once-trusted device data, with a 149% increase in H2 of attacks targeting mobile platforms.
• Deepfakes are now a common tool in cybersecurity attacks, with a new iteration of these attacks – novel face swaps – emerging for the first time last year.