The Living Dead: Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks

Discover how hackers are exploiting face recognition SDKs with non-deepfake attacks, compromising liveness detection and creating fake accounts for malicious purposes.

Key takeaways
  • Even in the AI era, face recognition SDKs can still be hacked.
  • Liveness detection, supposedly more secure, requires interactions between the app and the cloud.
  • 18 face recognition SDKs were analyzed, and 11 were found to have insecure design or implementation.
  • Attackers can bypass face recognition software by replacing the result with a fake image or video.
  • Some SDKs return unencrypted image data, making it vulnerable to attacks.
  • Hooking is used to bypass liveness detection on device and conduct attacks.
  • Face recognition SDKs can be compromised to create fake accounts for tax evasion, etc.
  • Commercial packers can defeat face recognition software using various techniques.
  • Insecure face recognition SDKs are commonly used in digital wallets, etc.
  • Attackers can capitalize on flaws in system design or implementation to create fake accounts.
  • Face recognition software relies on liveness detection, which can be bypassed using attacks.
  • SDKs may sacrifice more security due to poor design or implementation.
  • Face recognition SDKs can be compromised to create fake accounts for various purposes.
  • Some SDKs conduct environment checking but can still be bypassed using attacks.
  • Face recognition software can be compromised using various techniques, including presentation attacks.
  • Liveness detection can be bypassed using fake image or video.
  • Face recognition SDKs can be compromised to pass the passport check.
  • Hackers can create fake accounts using various techniques.
  • Face recognition software can be compromised using various attacks, including spoofing and liveness detection bypassing.
  • Fake image or video can be used to bypass face recognition software.
  • Face recognition SDKs can be compromised to create fake accounts for various purposes.