Journalist Unlocks Four Android Smartphones with a Plaster Head
Forbes journalist Thomas Brewster successfully bypassed the facial recognition systems on several high-end Android smartphones using a 3D-printed model of his own head. Brewster set out to test the reliability of increasingly popular facial recognition systems and came to some interesting conclusions.
How the 3D Model Was Made
At Brewster’s request, the design studio Backface (Birmingham, UK) created a three-dimensional model of his head. First, Brewster was photographed with 50 cameras, and the resulting images were combined into a single 3D image. Using photo editing software, designers made the necessary adjustments and then prepared the file for printing.
A 3D printer then produced a plaster model of Brewster’s head. After some final tweaks and painting, the journalist received a realistic copy of his head just two days later, at a cost of only £300.
The Experiment: Testing Face Recognition
For the experiment, Brewster used an iPhone X and four Android devices: the LG G7 ThinQ, Samsung S9, Samsung Note 8, and OnePlus 6. He registered his real face with the biometric authentication systems on each device, then tested whether the plaster model could fool the phones.
Brewster managed to unlock all four Android smartphones (some more easily than others), but the iPhone X resisted the attempt.
Manufacturers’ Responses and Security Recommendations
According to LG representatives, the face scanner is intended only as a secondary unlocking method, to be used alongside a PIN code or fingerprint. The Samsung S9 also warns users that someone who looks similar to the owner could unlock the device, and recommends using a PIN, password, or pattern as the primary authentication method. During initial setup, however, the phone offers both iris and face authentication. While the plaster eye did not fool the device, Brewster was still able to pass face authentication with the plaster head, though not on the first try.
A Samsung spokesperson explained that the face unlock feature is designed solely for user convenience and is equivalent to unlocking the phone with a screen swipe. OnePlus representatives told Brewster the same thing, recommending fingerprint, PIN, or password for security.