Tag Archives: iris

Another Type of Interception: the Iris Template Replay Attack

While much of the world continues to play football, American “football” wrapped up this month at the professional level with the “Commercials, Concerts, And a Sports Show”(tm).

During the game, New England Patriots quarterback Drake Maye threw two interceptions, or throws that were received by players on the opposing them (the Seattle Seahawks).

But what if Maye were throwing iris templates? And what if the defending Seahawks used the intercepted data in injection attacks?

Bet you didn’t think I was going there.

Iris template replay attacks

Facial data (from companies such as FaceTec and iProov) isn’t the only type of data that can be protected by injection attack detection. You can inject data from any type of biometric to bypass the capture device.

One type of injection attack is a template replay attack. It works something like this:

  • For this example assume that I am a legitimate subject and an authorized user, and the biometric workstation captures my iris. 
  • Rather than sending the entire iris image to the server, it converts the image into a template, or a much smaller mathematical representation.
  • The biometric workstation transmits this template to the server. BUT…
  • The evil fraudsters use some type of malware to intercept my iris template and save it for future mischief. Unfortunately, unlike a football interception seen by over 100 million people, no one realizes that this iris “interception” happened.
  • Later, when a fraudster wants to gain access to the biometric system, they perform an injection attack. Rather than capturing the fraudster’s iris at a workstation and sending that template to the server, the fraudster performs a “replay” and “injects” my intercepted iris template into the workflow.
  • The server receives my iris template, thinks I am accessing the system, and authorizes access.
  • The fraudster does bad things.

Iris template replay attack detection

How do you prevent an iris template replay attack?

First you have to detect it. Perhaps the system can detect that the template is not from a current iris capture, or that the template originated somewhere other than an iris workstation.

Once you detect it, you can reject it. Fraudster denied.

Of course this applies to any biometric template: fingerprint, face, whatever.

Injection attack detection, when implemented, is just another tool embedded in the biometric product.

Biometric product marketing expert. Look at his eyes.

The Orb At The Gap

I missed this January story. Apparently World installed an iris-reading Orb inside a San Francisco Gap store…for better visibility.

“At Gap, we believe in originality, authenticity — what makes us human,” the plaque reads. “That’s why we’re partnering with World, to bridge the gap between humans and technology.”

However, it seems to be a visibility stunt. Gap doesn’t care whether its clothing is purchased by humans, and it would be delighted to sell individuals multiple pairs of jeans, even if they had previously purchased a pair.

Who Can Write My Biometric Company’s Product Marketing Content?

Someone who is a biometric product marketing expert.

Someone who has three decades of expertise in biometrics.

I remember ANSI/NIST-CSL 1-1993.

Someone who has worked with fingerprints, faces, irises, voices, DNA, and other biometric modalities.

Some modalities. Butts and tongues not included.

Someone who understands the privacy landscape in Europe (GDPR), Illinois (BIPA), California, and elsewhere.

BIPA is a four-letter word.

Oh…and someone who can write.

A slight exaggeration.

So who can write this stuff?

I know someone. Bredemarket.

Stop losing prospects! Use Bredemarket content for tech marketers

Some great videos


Biometric product marketing expert.
Questions.
Services, process, and pricing.

Which Biometric Modalities Does NIST Investigate?

I’ve spent a lot of time in the Bredemarket blog looking at a variety of NIST studies of different biometric modalities.

But you can read up on them yourself.

NIST has investigated the following biometric modalities, using both definitions of the word biometrics:

But NIST has not spent taxpayer money researching other biometric modalities, such as tongue identification.

Biometric product marketing expert.

CIBS: Keeping Secrets From NGI

An interesting item popped up in SAM.gov. According to a Request for Information (RFI) due February 20, the FBI may have interest in a system for secret biometric searches.

“The FBI intends to identify available software solutions to store and search subjects at the classified level.  This solution is not intended to replace the Next Generation Identification System Functionality, which was developed and implemented in collaboration with the FBI’s federal, state, local, tribal, and territorial partners. The solution shall reside at the Secret and/or Top-Secret/SCI level with the ability to support data feeds from external systems.  The solution must allow the ability to enroll and search face, fingerprint, palmprint, iris, and latent fingerprints, and associated biographic information with a given set of biometrics.”

Now remember that the Next Generation Identification (NGI) system is protected from public access by requiring all users to adhere to the CJIS Security Requirements. But the CJIS Security Requirements aren’t Secret or Top Secret. These biometric searches, whatever they are, must REALLY be kept from prying eyes.

The RFI itself is 8 pages long, and is mysteriously numbered as RFI 01302025. I would have expected an RFI number 01152026. I believe this was an editing error, since FBI RFI 01302025 was issued in 2025 for a completely different purpose.

Whatever the real number is, the RFI is labeled “Classified Identity-Based Biometric System.” No acronym was specified, so I’m self-acronyming it as CIBS. Perhaps the system has a real acronym…but it’s secret.

If your company can support such a system from a business, technical, and security perspective, the due date is February 20 and questions are due by February 2. See SAM.gov for details.

Les yeux sans visage

(Part of the biometric product marketing expert series)

Continuing in my series of looks at biometric accuracy in an alternative universe.

If you need to market a biometric product that handles challenging conditions, book a free meeting with me at https://bredemarket.com/mark/

Oh Yeah, That Biometric Stuff

Bredemarket works with a number of technologies, but it’s no secret that my primary focus is biometrics. After all, I call myself the “biometric product marketing expert,” having worked with friction ridge (fingerprint, palm print), face, iris, voice, and rapid DNA.

The biometric product marketing expert in the desert.

If I can help your biometric firm with your content, proposal, or analysis needs, schedule a free meeting with me to discuss how I can help.

How Do You Make Cash Payments to the CORRECT People?

In the United States, we forget that much of the world does NOT fill out W-9 forms.

Take the apparel industry in Jordan.

“In Jordan, the apparel sector relies heavily on a large migrant workforce, many of whom lack access to bank accounts and remain unbanked. Wage payments have traditionally been cash-based…”

To facilitate cash payments to unbanked apparel workers in Jordan, IrisGuard stepped in with its EyePay product.

“Cairo Amman Bank (CAB) Jordan…has launched a national-scale biometric cash salary payment network for unbanked workers. 

“With just a simple iris scan, employees can securely access their wages instantly, without the need for a bank account, PIN, or physical ID.”

I don’t think this is tied to an iris-based time and attendance system, but that is the obvious next step.

A More Positive Update on the Apple Vision Pro

Earlier this year, I quoted sources that claimed that Apple “may have ceased production of its first-generation Vision Pro headset.”

But as is often true in the tech world, there is now a SECOND generation of the Vision Pro headset, featuring more power (via the M5 chip that Apple is introducing everywhere) and more comfort (via the new “Dual Knit Band”).

Source: Apple.

“M5 provides an even faster, smoother, and more responsive experience for Apple Vision Pro users, while introducing new opportunities for developers to create more advanced spatial and immersive experiences. Built using third-generation 3-nanometer technology, M5 on Vision Pro features an advanced 10-core CPU that delivers higher multithreaded performance, resulting in faster experiences throughout the system, including faster load times for apps and widgets and more responsive web browsing.”

Source: Apple.

“The Dual Knit Band delivers an even more comfortable fit for users. It features upper and lower straps that are 3D-knitted as a single piece to create a unique dual-rib structure that provides cushioning, breathability, and stretch. The lower strap features flexible fabric ribs embedded with tungsten inserts that provide a counterweight for additional comfort, balance, and stability. And the intuitive dual-function Fit Dial allows users to make fine-tuned adjustments to achieve their ideal fit. The new Dual Knit Band comes in small, medium, and large sizes; is available to purchase separately; and is compatible with the previous-generation Apple Vision Pro.”

For all the details of the new Apple Vision Pro, read the press release.

But it’s still pretty pricey, more niche than revolutionary event.

Oh, and “one more thing”…

I had to read the fine print in the press release, and this is what it says about Apple.

“Apple revolutionized personal technology with the introduction of the Macintosh in 1984. Today, Apple leads the world in innovation with iPhone, iPad, Mac, AirPods, Apple Watch, and Apple Vision Pro. Apple’s six software platforms — iOS, iPadOS, macOS, watchOS, visionOS, and tvOS — provide seamless experiences across all Apple devices and empower people with breakthrough services including the App Store, Apple Music, Apple Pay, iCloud, and Apple TV. Apple’s more than 150,000 employees are dedicated to making the best products on earth and to leaving the world better than we found it.”

All right and fine, but Apple (then Apple Computer) existed before 1984. And while the Macintosh changed everything, including the non-Apple computer that I’m typing on today, there never would have been a Macintosh if it hadn’t been for the Apple II. Remember the Apple II, Tim? Woz does.

And another thing

Reminder to marketing leaders: if you need Bredemarket’s content-proposal-analysis help, book a meeting at https://bredemarket.com/mark/