Browse Definitions :
Definition

image replay attack

Contributor(s): Matthew Haughn

An image replay attack is the use of a picture to fool an authentication method.

Image replay attacks are most commonly used by an attacker trying to gain entry to a system protected by less-than-secure biometric authentication technology implementations. The method has been used successfully against low-end fingerscanners, iris scanners and facial recognition systems.

In the simplest cases, image replay attacks involve a printed image of the subject used for authentication. An attacker might, for example, present a picture of an authorized user to a facial recognition system. Extra measures can be implemented in facial recognition and iris scans to foil printed or static images, however; such measures include requiring the user to wink, blink or speak.

More sophisticated image replay attack methods may involve recorded video and audio playback to defeat these measures. Methods of defeating these attacks exist as well, however. Video and audio are typically out of sync to a detectable degree when played back from a file. Security algorithms have been created to detect the discrepancy and prevent these attacks.

Making biometric authentication methods secure from image replay attacks can't rely on the methods used to detect data replay attacks. (The opposite is also true.) When security is important, it is advisable for administrators to be aware of both attack methods and counter measures.

This was last updated in December 2014

Continue Reading About image replay attack

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Is this like a James Bond film where they take the eye of a fighter pilot and use it to gain access to a seemingly secure military base and then to the controls that launch bombs?

OK, just checking. How could any biometric system (sorry Apple) be so simple that it could be easily breached? That's why we have backup passwords for these systems when they don't work. I say make them precise and tough to crack.

While I don't want anyone taking my eyes out of my skull, I favor a solid line of defense. And how about enacting dual factor authentication with one arm of it being biometrics?

I shake my head.
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

SearchSecurity

  • cybersecurity

    Cybersecurity is the protection of internet-connected systems, including hardware, software and data, from cyberattacks.

  • asymmetric cryptography (public key cryptography)

    Asymmetric cryptography, also called public key cryptography, uses a pair of numerical keys that are mathematically related to ...

  • digital signature

    A digital signature is a mathematical technique used to validate the authenticity and integrity of a message, software or digital...

SearchHealthIT

SearchDisasterRecovery

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

SearchStorage

  • hard disk drive (HDD)

    A computer hard disk drive (HDD) is a non-volatile memory hardware device that controls the positioning, reading and writing of ...

  • byte

    In most computer systems, a byte is a unit of data that is eight binary digits long. Bytes are often used to represent a ...

  • network-attached storage (NAS)

    Network-attached storage (NAS) is dedicated file storage that enables multiple users and heterogeneous client devices to retrieve...

Close