Older Andriod versions had more vulnerabilities

Is Samsung's Galaxy S5 'leaking' YOUR fingerprints? Flaw means hackers can intercept and steal biometric data (Daily Mail); Forbes piece, here.

The pair told Thomas Fox-Brewster from Forbes that the flaw lies in older versions of the Android operating system, up to and including Android 4.4.

Subsequently, anyone running Android 5.0 or above are not at risk and the security experts are advising people on older models to update as soon as possible.

The semi-technical press seizes upon biometrics as a proxy for personal data. This is old news, but here's a great example.

A close reading of the article reveals that earlier releases of Google's version of the Android mobile OS weren't as secure as they are now. This will come as news to few. The article points out that, "Once inside they can monitor all data sent to and from the phone, as well as data recorded by the handset's built-in sensors, including the fingerprint scanner."

Get it? Exploiting the security flaw means that the whole device is compromised: Email apps, microphone, location information, and possibly even the contents of phone calls themselves, but according to the author and editor(s), the news value is in the possibility of capturing a fingerprint image. Of course, it's their outfit; it's their call.

For readers here, instead of "OMG fingerprinst[!]," I'd emphasize that:

Not all mobile operating systems are created equal.
Different mobile applications offer a different mix of privacy costs and benefits.
Installing OS updates and patches is very important.
If the OS is compromised, the applications it runs are vulnerable.

Left out of the information readily available online about this hack is how the people at FireEye got their malware onto the hardware in the first place. Past "hacks" of biometric systems have been executed on a playing field that is far more favorable than the real world to the the hackers, where all the other layers of the security regime are stripped away from the one security link they want to test. Here's a particularly striking example. If FireEye rooted the phone, side-loaded their malware onto the device, and went from there, this isn't a hack in any real sense — it's a malware test.

That hypothetical scenario would mimic a real world example where a user lost their phone and bad guys got it, loaded software on it and then returned the mobile device to the user who continued as if nothing had happened. In the security world, if you lose control of the hardware, all bets are off for anything that isn't encrypted (with a strong key).

So, without more information, it's hard to say how big a deal this is, or in many (most?) cases, was. In the bigger picture, this is a Google Android OS story. The subtext is that users who care about mobile device security should be thoughtful about what device/OS/app combinations they adopt, keep their device's software up to date, and be careful about malware.

As automated and convenient security including biometrics becomes better and more common, the highway robbers of the 21st Century are increasingly forced to turn to social engineering techniques rather than frontal assaults on security technology.

See: The Con is Mightier than the Hack

Deep learning for better face-rec

Google: Our new system for recognizing faces is the best one ever (Fortune)

At first we’ll see systems like Google’s FaceNet and Facebook’s aforementioned system (dubbed “DeepFace”) make their way onto those company’s web platforms. They will make it easier, or more automatic, for users to tag photos and search for people, because the algorithms will know who’s in a picture even when they’re not labeled. These types of systems will also make it easier for web companies to analyze their users’ social networks and to assess global trends and celebrity popularity based on who’s appearing in pictures.

...yet (continued)

Google Glass Will Not Be Offering Facial Recognition (States Chronicle)

This is an appropriate time to repost what we had to say the last time Google felt compelled to disavow facial recognition technology in relation to Glass.

June 3, 2013

If it's a camera, it can be used for facial recognition

Google outlaws facial recognition apps on Glass for now (CSO)

Google announced late Friday that it will outlaw facial recognition and other biometric identification apps on Glass, its networked eyewear still in prototype phase that's expected to be commercially released later this year.

“As Google has said for several years, we won’t add facial recognition features to our products without having strong privacy protections in place,” Google’s Project Glass team said in on its Google Plus page.

Google may have publicly said this, however until now its developer policy did not explicitly rule out apps that can do facial recognition.

If it's a camera, it can be used for facial recognition. Facial recognition is really just a specific type of image analysis. It doesn't matter where the image comes from. It could be a 19th Century daguerreotype or a picture taken from space. The software doesn't care. Presumably running the open source Android operating system, as a head-mounted sensor array with a camera, there is little or nothing preventing application developers from passing images collected via the headset through facial recognition applications not developed by Google.

Google's announcement should be taken to mean that Google isn't going to integrate facial recognition into Google Glass. Facial recognition apps won't be on the Google Play store. And, at least for now, they won't be facilitating face rec. in other Google services such as YouTube, search, Gmail, and Google+. [end repost]

In a twitter exchange, John at M2SYS nails exactly why every Google Glass face rec denial sounds so silly: The device screams for facial recognition applications and everybody knows it.

Terrible with names? Suffer from prosopagnosia? Wonder where you've seen that person before? There's an app for that.

Read these two together...

Read this...

Emotient and iMotions partner for integrated facial expression recognition, bio sensor and eye-tracking solution (Biometric Update)

Emotient, which specializes in facial expression analysis, and iMotions, an eye-tracking and biometric software platform company, have announced that Procter and Gamble, The United States Air Force and Yale University are its first customers for a newly integrated platform that combines facial expressions recognition and analysis, eye-tracking, EEG and GSR technologies.

According to the companies, the new cobmbined solution is designed for usability research, market research, neurogaming as well as academic and scientific research.

Then this...

Google facial password patent aims to boost Android security (BBC)

Google has filed a patent suggesting users stick out their tongue or wrinkle their nose in place of a password.

It says requiring specific gestures could prevent the existing Face Unlock facility being fooled by photos.

...and then think about Google Glass (or something similar offered by another brand) and the things that become knowable as these technologies are combined and others are added. Iris and face for backward-facing and front-facing ID, knowing precisely what (or whom) someone is looking at when a certain change in neurological activity is noted. Or, precise targeting of weaponry controlled by the eye's movement along with detailed observations of the neurological states of combatants.

Right now, all of it seems like a long way off, and it is. Significant scientific, technological, and organizational barriers exist. The technology of measurement; the science of interpretation; the fact that a lot of small players own small pieces of the puzzle; integrating the pieces: each present significant challenges. But...

“Most people overestimate what they can do in one year and underestimate what they can do in ten years.”

― Bill Gates

Stay tuned. Ubiquitous multi-modal sensors and the real-time ability to interpret and act on the data they collect would have profound effects.

If it's a camera, it can be used for facial recognition

Google outlaws facial recognition apps on Glass for now (CSO)

Google announced late Friday that it will outlaw facial recognition and other biometric identification apps on Glass, its networked eyewear still in prototype phase that's expected to be commercially released later this year.

“As Google has said for several years, we won’t add facial recognition features to our products without having strong privacy protections in place,” Google’s Project Glass team said in on its Google Plus page.

Google may have publicly said this, however until now its developer policy did not explicitly rule out apps that can do facial recognition.

If it's a camera, it can be used for facial recognition. Facial recognition is really just a specific type of image analysis. It doesn't matter where the image comes from. It could be a 19th Century daguerreotype or a picture taken from space. The software doesn't care. Presumably running the open source Android operating system, as a head-mounted sensor array with a camera, there is little or nothing preventing application developers from passing images collected via the headset through facial recognition applications not developed by Google.

Google's announcement should be taken to mean that Google isn't going to integrate facial recognition into Google Glass. Facial recognition apps won't be on the Google Play store. And, at least for now, they won't be facilitating face rec. in other Google services such as YouTube, search, Gmail, and Google+.

The Hamdroid

...or maybe it's the Andster. At any rate, the Android Hamster or Hamster for Android is on it's way and whatever the marketers decide to go with, the combination of a reliable, affordable, off-the-shelf, USB fingerprint reader and reliable, affordable, off-the-shelf, tablet devices could be a real game changer.

Artwork not endorsed/approved by Google or SecuGen

Now, for around than $150 all in, tinkerers can purchase a staggering array of hardware and operate it on an open platform. I can't wait to see what people do with that power. Even before this, folks were applying biometrics to more things than any one person could possibly imagine.

The SecuGen Hamster sells for as low as $79.00.
Android tablets are available for as low as $70.00. I saw some sales circulars in the Sunday paper (Wal-Mart & Best Buy) advertising 7 in. tablets with front-facing cameras and Wi-Fi for $69.99.


Secugen releases fingerprint authentication SDK for Android (Biometric Update)

SecuGen has just announced the release of its FDx SDK Pro for Android.

According to the company, this new SDK will allow developers to add fingerprint authentication to their Android-based software on ARM tablets and smart phones using SecuGen’s Hamster IV and Hamster Plus fingerprint readers. This SDK also incorporates SecuGen’s MINEX tested, FIPS 201/PIV complicate template extraction and matching algorithms.

“We are very excited to be able to offer Android compatibility for our fingerprint readers,” Dan Riley, VP of engineering at SecuGen said. “Our partners have been asking for this and our role, as always, is to provide them with the tools that they need. The FDx SDK Pro for Android is one of several exciting new products that we will be bringing to market in 2013.”

UPDATE: Minor edits, added links to hardware, and bumped.

It's all ID nowadays

If the one word for the 60's was plastics and in the 80's it was all ball bearings, the technology touchstone for the 2010's figures to be identity.



The “i” in the next iPhone will stand for “identity.” (Cult of Mac)

When people hear rumors and read about Apple’s patents for NFC, they think: “Oh, good, the iPhone will be a digital wallet.” When they hear rumors about fingerprint scanning and remember that Apple bought the leading maker of such scanners, they think: “Oh, good, the iPhone will be more secure.”

But nobody is thinking different about this combination. Everybody is thinking way too small. I believe Apple sees the NFC chip and fingerprint scanner as part of a Grand Strategy: To use the iPhone as the solution to the digital identity problem.

NFC plus biometric security plus bullet-proof encryption deployed at iPhone-scale adds up to the death of passwords, credit cards, security badges, identity theft and waiting in line.

Apple loves to solve huge, hitherto unsolved problems. And there is no problem bigger from a lost-opportunity perspective than digital identity.

The Boston Consulting Group estimates that the total value created through real digital identity is $1 trillion by 2020 in Europe alone.

Read the whole thing. Stripped of the Apple-worship, it's an astute post.

The link inside the quote above is in the original and the pdf it links to is highly worth a look, as well. From the executive summary...

Increasingly, we are living double lives. There is our physical, everyday existence – and there is our digital identity. Most of us are likely more familiar with that first life than with the second, but as the bits of data about us grow and combine in the digital world – data on who we are, our history, our interests – a surprisingly complete picture of us emerges. What might also be surprising for most consumers is just how accurate and traceable that picture is.
...
Views on digital identity tend to take one of two extremes: Let organisations do what they need to in order to realise the economic potential of “Big Data,“ or create powerful safeguards to keep private information private. But digital identity can‘t be cast in such black-and-white terms. While consumers voice concern about the use of their data, their behaviours – and their responses to a survey conducted specifically for this report – demonstrate that they are willing, even eager, to share information when they get an appropriate benefit in return. Indeed, as European Commissioner for Justice Viviane Reding remarked, “Personal data is in today‘s world the currency of the digital market. And like any currency it has to be stable and it has to be trustworthy.“ 1 This is a crucial point. Consumers will “spend“ their personal data when the deals – and the conditions – are right. The biggest challenge for all stakeholders is how to establish a trusted flow of this data.

A new type of ID is needed to bind our physical and online selves, payments and hardware. If the tech giants are going to finish off the post office and assume the role of credit card companies, they're going to have to solve the ID problem. If they solve the ID problem, there's really no telling how many other business models they can disrupt.

Can respect for privacy be a competitive differentiator?

Though biometrics get quite a lot of attention from people interested in privacy, the real action is in the internet browser and online services. Just remember — If you are not paying for it, you're not the customer; you're the product being sold*.

The Microsoft "Scroogled" ad campaign against Google is interesting because it indicates that the high-level marketing types at Microsoft believe the public is open to the message that some web services are taking too much information from users compared to the value the users receive in "free" services. Whether respect for privacy is a competitive differentiator among web services remains to be seen, but the fact that Microsoft has spent real time and money on the assumption that it is should not go unnoticed.

Google Privacy Chief Blasts Microsoft’s “Scroogled” Campaign at RSA Conference (CIO)

The bulk of the article linked above is devoted to privacy standards, privacy policy and corporate management. While that's not nearly as eye-catching as a slug fest between Information Age titans, it is a much more substantial issue and one worth of serious attention.

In search of a post-password world

Google wants to ditch the password - sounds lovely (Singularity Hub)

Memorizing numerous passwords is inconvenient. This is known. To counteract said inconvenience, many people use memorable (read: hackable) passwords on multiple sites. Which is a shame because security experts advise that, at a minimum, we use different, random, alpha-numeric strings for every website and switch them out every few months. Kind of the opposite of convenient. And even this method provides but a fig leaf of security.

Google isn't suggesting biometrics, at least not yet, but the article does cover biometrics as a possible solution.

EU Urges Google on Transparency

EU regulators say Google must revise its privacy policy (The Verge)

The EU is fine with Google's unified privacy policy acting as a "general guideline" about its operations, but it wants the search giant to return to its old system, which provided specific privacy notices for each Google product. It says these product-specific privacy policies must include "simple and clear explanations" on when, why, and how location, credit card, unique device identifiers (UDIDs), and telephony data is collected, along with information on how users can opt out. It asks that Google adds a specific clause for biometric data where necessary as there is currently no mention of facial recognition in its privacy policy.

Google, Apple, Mobile, Money (& Biometrics)

The article isn't even mostly about biometrics, but as we readily acknowledge here all the time, biometrics are only ever a means to an end. What the article does provide is a coherent view of where future profits will come from for Apple and Google well supported with charts, graphs and other visual aids, which I love.

The key biometrics bit is here but the rest is very interesting as well.

How Android gets Google to $2000 by 2020 (Marketwatch)

The most exciting thing I see on the horizon isn’t the ad sales that will almost certainly materialize, but the network effects of a billion Android users and the ways Google can leverage that scale. If one billion people are on the same mobile OS and you know where they are precisely and they have a biometric scanner on their phone, do you really need Mastercard and Visa to take their 3% to verify the funds and identity? That’s why Google is working on Google Wallet. If one billion people are constantly sharing their location by virtue of having their phone switched on, could you sell them stuff based on where they are? That’s why Google is working on Google Offers. And if one billion people care more about the device than the network and will pick the service based on who has the cool new Android phone, couldn’t you launch your own data service? That’s Google Fiber.

This also seems to be of a piece with growing recognition among financial types that biometrics are going to have a role in how authentication works and add significant value to the process.

French Consumers Prefer Fingerprints over Mobile Phones for Retail Payments

Survey Shows More Interest in Biometrics than Near Field Communication (NFCWorld.com)

69% of the 1,008 people surveyed by Ifop for Wincor-Nixdorf said they were either very or quite in favour of replacing PIN codes with fingerprint biometrics at the point-of-sale, and only 36% were either very or quite in favour of using an NFC phone to make a purchase. 39% were quite opposed to the idea and 25% were very opposed.

Support for NFC actually dropped from last year's survey.

What explains this?
Is it something to do with NFC tech specifically?
Do people trust their credit card company/bank more than they trust their mobile service provider/Google/Apple?
Is smartphone penetration in France so low as to limit interest in a NFC payment system?
Is it that if you lose your phone, you can't buy a new one because you don't have a phone and you'll starve because you can't use your phone to buy food (less likely, I'll admit)?

UPDATE:
Following Vulnerabilities, Google Disables Pre-Paid Card on Google Wallet App (GottaBeMobile.com)

After a series of two vulnerabilities were discovered that targeted Google Wallet, Google’s mobile and digital wallet app on the company’s Android smartphones, Google has now decided to disable the prepaid credit card feature on the app.
...
The app makes use of NFC, or near field communications, technology. Rather than swiping a plastic credit card through a magnetic reader, users can pay for physical goods at retail stores by waving their NFC-enabled smartphone next to an NFC reader. In this manner, Google anticipates that smartphones and wallets would converge and eventually credit cards would become obsolete as users would only need to carry their smartphones to make and initiate payment.

h/t @ksikeyboards
h/t @Ess_ID_Security

Biometrics in Their Proper Security Context

Here's a really good article that, on its surface, is about the facial recognition capabilities included in the Android 4.0 mobile operation system. It also communicates a couple of important security concepts: deterrence and layers.

Facial Recognition and The Club (IT Business Edge via @m2sys)

Deterrence:
I don't have to be faster than the bear, I just have to be faster than you.
OR
Don't be the lowest-hanging fruit.

In the bigger picture, it's useful to think of The Club. The device, which clamps onto opposite sides of an automobile's steering wheel to prevent its turning, isn’t enough to prevent a theft. It is enough, however, to require at least a moderate level of expertise (and, in this example, tools) to get it off. There simply are so many totally unprotected targets – cars in one case, mobile devices in the other – that it doesn’t take too much to make the thief move on to lower-hanging fruit. The Club and facial recognition are deterrents, not foolproof safeguards.

Layers:
Just because my house has locks on the doors and windows, doesn't mean I'm in favor of dissolving the police department.

The danger is that the technology will be seen as all the device owner needs to do to be safe. That isn’t the case. Serdar Yegulalp at Byte has it about right in his view that biometrics is best seen as one tool in the security tool chest:

There's ways to fix the facial unlock function to make it more useful. Schneier mentions in his piece how fingerprint readers could be programmed to prevent cheating by detecting a pulse or a pore pattern. Facial unlock, likewise, could be reprogrammed to only work if the person winks or smiles - two things a photo definitely can't do.

There are those who object to biometric identity management measures on aesthetic grounds. That's fine. There's no accounting for taste. The argument that because biometric security applications are imperfect as stand-alone solutions they are useless is, however, without merit.

How Image Processing Will Change the World

Exploring the future of software that can "see" (The Economic TImes)

The linked article does an excellent job of outlining applications that flow from the increased ability of software to make sense of non-textual, optical/image-based inputs. Biometrics like facial recognition are just the beginning.

Rituparna Chatterjee, the article's author, places facial recognition in its proper context here:

While DNA and fingerprints remain the US Federal Bureau of Investigation's favoured means of identification, it's now also using facial recognition. "Image Processing is an important technology for investigation," says Bill Casey, program manager of the FBI's Biometric Center of Excellence.

"When hunting for a criminal, we look through our database of over nine million photos for possible investigative leads." Casey shares how his colleagues recently nabbed a double-homicide suspect by comparing his photo with the US Department of Motor Vehicles' local database of 30 million photos in the state of North Carolina.

She is also perceptive in her observations of how Google has been showing interest in image processing technology. It's an article well worth reading in its entirety.

See also:
Google debates face recognition technology
Biometrics, object recognition and search

Insight into Google's Ideas about Security

Googling from the inside out (Smart-Grid.TMCNet.com)

The article is about Google's Pryor, Oklahoma data center. A large section, however, is devoted to Google's and the center's approach to security.

The relevant paragraph is the longest one. It begins:

"We take security and privacy very seriously which is why our facilities are not something we have regular tours through," he said. "This is why we have the kind of fencing which you might see at a medium-security prison, because if that trust (in Google) goes away, it would be very difficult for us to get it back." "Besides the fencing and the gate, we have an extensive security system," Wooten said. "Of course, we have security cameras, highly controlled badge access in biometrics to the facility and specific parts of the facility which are more sensitive, iris scans, fingerprint scans, and even restricted access to other 'Googlers' -- only the people who are authorized to be in a certain location have access. Even people from other Google data centers, there are five in the U.S., don't have clearance to our center -- security is that tight."

Biometrics, object recognition and search

One of the limitations of the internet search we all know and love is that it is bound to text. If you have a picture of something, you can't find out what it is with a search engine. If you've recorded a bird's song, there's no way to get that into the search field to identify the species of bird that created it.

Google obviously recognizes this limitation of its technology and the obvious benefits of extending its capabilities.

Two main types of technology have been developed to help get real-world (non-text) inputs into a form that computers are good at using: Optical Character Recognition and Biometrics.

Optical Character Recognition (OCR) involves taking an image of text and converting it to textual data. Banks use OCR to scan the numbers at the bottom of checks, document scanners use it to make better use of scanned documents, and more recently, it has been used with vehicle license plates in law enforcement. OCR was the logical first step along the path of using pictures as computer inputs because text is fairly easy to break into its constituent parts (characters) and there simply aren't that many different characters to identify. So the tech is pretty easy and the ROI (Return on Investment) of using computers to transcribe text instead of humans is very straightforward.

Biometrics are the second generation of automatic object recognition. Biometrics are far more complicated than OCR but far less complicated than a theoretical no-holds-barred image search engine. With biometrics the tech is more difficult but the ROI of using computers to help manage identity can be very substantial indeed.

Techniques developed for biometric identity management are also being applied to recognition tasks that do not deal with human identity management. Leafsnap is an app that uses visual recognition software to help identify tree species from photographs of their leaves. StripeSpotter is a free open-source system with an algorithm that can identify animals in the wild and build biometric databases using photos of the different animals. Here, the tech developed for high ROI applications is being applied to new, though lower value challenges.

Which brings us to Google's acquisition of PittPatt, a Pittsburgh pattern recognition company.

Google Buys PittPatt Facial Recognition Tech (PCMag.com)

In late March, Google denied plans for a dedicated facial-recognition app, although the company has said it could do so as far back as the launch of Google Goggles, which used object recognition to identify real-world objects.

With this acquisition, I suspect Google doesn't so much have facial recognition for identity search as they have object recognition in mind. First, Google has been wary of face recognition in public search. Whether this is due to the technical challenges of an unbound face rec application or a respect for the privacy of their users, I'll leave it to the reader to judge. It is also a much different challenge to return the result "This is a human face" than it is to say "This is a human face and that face belongs to Guy Herbert." In most object search the first type of result will be the most desirable anyway. If you submit a photo of an insect to a search, you aren't asking about the insect's individual identity, you probably just want to know what type of insect it is.

I'll bet Google's more interested in the object recognition capabilities of PittPatt than they are in facial recognition.

It's not the tech; It's the people. Google edition

Google has apparently discovered a morally repellent use of technology. Good for them. This says more about Google than biometrics.

Google Was for Facial Recognition Before Schmidt Was Against It (Yahoo)
Google warns against facial recognition database (The Telegraph)
Google's Eric Schmidt: Ex-CEO's Most Memorable Quotes (PCWorld)

Some may note the irony that this blog is brought to you via Google's Blogger service.

Google offers a lot of good products. You tend to pay in information about yourself. Often the bargain is acceptable. Sometimes, as with their more controversial pursuits, the relationship isn't consensual.

That's why the individuals working at Google are so important. Google's tech isn't the problem; (sometimes) their use of it is.

Review the quotes in the last article linked above.

It's not the tech; it's the people.


UPDATE:
Biometrics firm OmniPerception responds to this issue with
Opinion: Facial recognition technology satisfies privacy concerns raised by Google (OmniPerception.com)

Stewart Hefferman the CEO of OmniPerception said that history has many examples where technologies have had the potential to be misused, frequently through a lack of understanding, until it has been properly legislated or a strong framework of standards has been implemented.

Google Face-Rec

Google making app that would identify people's faces (CNN)

Google plans to introduce a mobile application that would allow users to snap pictures of people's faces in order to access their personal information, a director for the project said this week.

The article goes on to say that there is no timeline for release, but Google's interest in the subject should be obvious.

Face recognition, like other biometric applications, is really just a very specific type of computerized object recognition. For now, Google's can only apply its algorithm to text-based queries. I'm sure Google is aware that it would be very useful if they could make sense of image, audio or other types of files as search terms. Face recognition is a logical starting point.

Google debates face recognition technology

FT.com

Mr Schmidt said: “Facial recognition is a good example . . . anything we did in that area would be highly, highly planned, discussed and reviewed. When you go through these things, you review your management procedures.”

Apart from Google's history with privacy issues, they do face a dilemma, as the article points out. There is no reason to limit search terms to text only. Some innovator will bring search into the visual arena and enable a picture to be used as the search term. Without new regulation, that means that at some indeterminate point in the future* someone could take a picture of a face with a cell phone and find out a lot about that person.

These tools are coming. They will bring huge productivity gains. They will be abused.

Those concerned about the effects of technologies like Google Goggles upon their family's privacy would be well advised to think about what information about them exists online and what they do now to manage who has access to it. Most of us have near-total control over what personal information ends up on the internet. If the only thing keeping online information about you "private" is the lack of better search engines, then it might be a good idea to reevaluate how much personal information you post/allow to be posted online.

It is possible, even likely, that the internet will become both more private and less private. More private as Google increasingly respects the interests of content owners (FT again). Less private as better search brings more of the internet to users attention.



*The technical challenges of using a picture of a person's face as the only search term for a search of the internet for facts about that person are extremely daunting. If you take a picture of an apple, presumably the search would return lots of pictures and information relating to apples. If you take a picture of a person, presumably the search would return lots of pictures and information relating to people. Converting an object recognition search that has yet to be deployed into an facial recognition search is a long way off.