Hackers Got Past Windows Hello by Tricking a Webcam

Biometric authentication is a key piece of the tech industry’s plans to make the world passwordless. But a new method for duping Microsoft’s Windows Hello facial recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn’t.

Services like Apple’s FaceID have made facial recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it’s still not supported on Macs at all. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability.

That’s because you can’t trust any old webcam to offer robust protections for how it collects and transmits data. Windows Hello facial recognition only works with webcams that have an infrared sensor in addition to the regular RGB sensor. But the system, it turns out, doesn’t even look at RGB data. Which means that with one straight-on infrared image of a target’s face and one black frame, the researchers found that they could unlock the victim’s Windows Hello-protected device. 

By manipulating a USB webcam to deliver an attacker-chosen image, the researchers could trick Windows Hello into thinking the device owner’s face was present and unlocking.

“We tried to find the weakest point in the facial recognition and what would be the most interesting from the attacker’s perspective, the most approachable option,” says Omer Tsarfati, a researcher at the security firm CyberArk. “We created a full map of the Windows Hello facial recognition flow and saw that the most convenient for an attacker would be to pretend to be the camera, because the whole system is relying on this input.”

Microsoft calls the finding a “Windows Hello Security Feature Bypass Vulnerability” and released patches on Tuesday to address the issue. In addition, the company suggests that users enable “Windows Hello Enhanced Sign-in Security,” which uses Microsoft’s “Virtualization-based Security” to encrypt Windows Hello face data and process it in a protected area of memory where it can’t be tampered with. The company did not respond to a request for comment from WIRED about the CyberArk findings.

Tsarfati, who will present the findings next month at the Black Hat security conference in Las Vegas, says that the CyberArk team chose to look at Windows Hello’s facial recognition authentication in particular because there has already been a lot of research industry-wide into PIN cracking and fingerprint-sensor spoofing. He adds that the team was drawn by the sizable  Windows Hello user base. In May 2020 Microsoft said that the service had more than 150 million users. In December, the company added that 84.7 percent of Windows 10 users sign in with Windows Hello.

While it sounds simple—show the system two photos and you’re in—these Windows Hello bypasses wouldn’t be easy to carry out in practice. The hack requires that attackers have a good quality infrared image of the target’s face and physical access to their device. But the concept is significant as Microsoft continues to push Hello adoption with Windows 11. Hardware diversity among Windows devices and the sorry state of IoT security could combine to create other vulnerabilities in how Windows Hello accepts face data.

“A really motivated attacker could do those things,” says Tsarfati. “Microsoft was great to work with and produced mitigations, but the deeper problem itself about trust between the computer and the camera stays there.”