Browse Definitions :
Definition

image replay attack

Contributor(s): Matthew Haughn

An image replay attack is the use of a picture to fool an authentication method.

Image replay attacks are most commonly used by an attacker trying to gain entry to a system protected by less-than-secure biometric authentication technology implementations. The method has been used successfully against low-end fingerscanners, iris scanners and facial recognition systems.

In the simplest cases, image replay attacks involve a printed image of the subject used for authentication. An attacker might, for example, present a picture of an authorized user to a facial recognition system. Extra measures can be implemented in facial recognition and iris scans to foil printed or static images, however; such measures include requiring the user to wink, blink or speak.

More sophisticated image replay attack methods may involve recorded video and audio playback to defeat these measures. Methods of defeating these attacks exist as well, however. Video and audio are typically out of sync to a detectable degree when played back from a file. Security algorithms have been created to detect the discrepancy and prevent these attacks.

Making biometric authentication methods secure from image replay attacks can't rely on the methods used to detect data replay attacks. (The opposite is also true.) When security is important, it is advisable for administrators to be aware of both attack methods and counter measures.

This was last updated in December 2014

Continue Reading About image replay attack

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Is this like a James Bond film where they take the eye of a fighter pilot and use it to gain access to a seemingly secure military base and then to the controls that launch bombs?

OK, just checking. How could any biometric system (sorry Apple) be so simple that it could be easily breached? That's why we have backup passwords for these systems when they don't work. I say make them precise and tough to crack.

While I don't want anyone taking my eyes out of my skull, I favor a solid line of defense. And how about enacting dual factor authentication with one arm of it being biometrics?

I shake my head.
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • compliance audit

    A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines.

  • regulatory compliance

    Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business...

  • Whistleblower Protection Act

    The Whistleblower Protection Act of 1989 is a law that protects federal government employees in the United States from ...

SearchSecurity

  • deprovisioning

    Deprovisioning is the process of removing access to a system from an end user who will no longer be utilizing that system.

  • payload (computing)

    In computing, a payload is the carrying capacity of a packet or other transmission data unit. The term has its roots in the ...

  • passphrase

    A passphrase is a string of characters longer than the usual password (which is typically from four to 16 characters long) that ...

SearchHealthIT

SearchDisasterRecovery

SearchStorage

  • computational storage

    Computational storage is defined as an architecture that couples compute with storage in order to reduce data movement. In doing ...

  • data deduplication

    Data deduplication -- often called intelligent compression or single-instance storage -- is a process that eliminates redundant ...

  • public cloud storage

    Public cloud storage, also called storage-as-a-service or online storage is a service model that provides data storage on a ...

Close