{"id":52271,"date":"2016-08-24T10:31:31","date_gmt":"2016-08-24T17:31:31","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=52271"},"modified":"2025-08-15T03:07:33","modified_gmt":"2025-08-15T10:07:33","slug":"virtual-reality-facebook-photo-hack","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/privacy-identity-protection\/virtual-reality-facebook-photo-hack\/","title":{"rendered":"How Virtual Reality and Facebook Photos Helped Researchers Hack Biometric Security"},"content":{"rendered":"

Years ago, holograms were considered science-fiction. Things have changed. Within recent memory, we\u2019ve gone from seeing well-loved, but deceased, cultural icons appearing onstage at music awards<\/a>, to CEOs attending big meetings in holographic form<\/a>. Obviously, our ability to project ourselves through virtual reality across the globe has evolved. But so are the security consequences of being able to do so.<\/p>\n

Those consequences were on display earlier this month at the Usenix security conference, a yearly security symposium aimed at highlighting cybersecurity issues in new technology. During this year\u2019s conference, researchers from the University of North Carolina demonstrated how life-like animations of faces<\/a> could be used to trick facial recognition.<\/p>\n

To achieve this, WIRED reports, the researchers used technology similar to virtual reality and a few borrowed photos from volunteers. (While volunteers willingly gave the researchers permission, the photos were acquired in a similar fashion to how cybercriminals would acquire them, according to WIRED.) This technique cracked several security systems tested.<\/p>\n

As far as new technology goes, this isn\u2019t unexpected. Fledgling technologies will almost always have vulnerabilities and pitfalls during their early days. As always, security researchers are best equipped to discover the security issues embedded in these technologies.<\/p>\n

In this particular case<\/a>, researchers used the virtually-stolen photos to create fake faces with readily available 3D rendering and animation software. They then blended the photos and animated the 3D images to trick facial recognition programs into thinking the fake images had both motion and depth (right down to blinking and smiling) \u2014 measurements these programs check for while scanning a face.<\/p>\n

It\u2019s a great reminder that it\u2019s trivial to steal high-quality photos of someone today. Even from multiple angles, which this theoretical attack requires. Crooks could simply browse your Facebook<\/a>, LinkedIn and other social media profiles. As simple as it is to carry out, this form of vulnerability is a bit tricky to defend against. After all, having an online presence is important for both social and career purposes, and even the most cautious posters can\u2019t always guarantee a nonexistent digital-footprint.<\/p>\n

Alarming? Sure. But few should worry: the attack is too complicated, and too time consuming, for most cybercriminals to bother with. A lot of preparation \u2014 and background knowledge \u2014\u00a0is needed to successfully replicate this theoretical attack. That fact significantly narrows the number of people who may be at risk. Additionally, these vulnerabilities have been flagged to cybersecurity firms \u2014 firms who want to see this technology succeed. Fixes to these issues will be on their way shortly.<\/p>\n

Given this research, we should take the opportunity to revisit two issues relevant in today\u2019s digital world. First, as discussed above, maintaining a level of privacy online is important not only as a matter of lifestyle, but also as a matter of security. Our photographs are now connected to our profiles and, by extension, our security. Second, technology isn\u2019t a one-and-done thing. New innovations in everyday devices, services, and security takes time to perfect. Biometric security and similar innovations are no different.<\/p>\n

Tips For Practicing Biometric Security<\/h2>\n

With that in mind, here are three tips for practicing biometric security:<\/p>\n