The Glass Perimeter - Systematic Bypasses in Biometric Frameworks

The Glass Perimeter - Systematic Bypasses in Biometric Frameworks

Speakers: Javier Bernardo (Head of Hacking, Strike); Dan Borgogno (Security Researcher, Faraday)

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=1uCl7T8--i8

Overview

In "The Glass Perimeter - Systematic Bypasses in Biometric Frameworks," Javier Bernardo and Dan Borgogno present a compelling and deeply technical exploration into the vulnerabilities of client-side biometric authentication systems, particularly those used for Know Your Customer (KYC) processes. The talk addresses the critical and often overlooked risk of delegating fundamental security decisions to environments fully controllable by an attacker, such as a mobile device. This research, spearheaded by Strike and Faraday, demonstrates how widely adopted biometric frameworks can be systematically bypassed, exposing users and financial institutions to significant synthetic identity fraud.

The presentation highlights a crucial shift in the security landscape where identity has become the new perimeter. With the proliferation of digital services, biometric verification has moved from being a secondary authentication factor to, in many cases, the sole gatekeeper for sensitive accounts and data. Bernardo and Borgogno meticulously detail various attack vectors, ranging from sophisticated OSINT (Open Source Intelligence) and AI-driven synthetic identity generation to deep technical injections into the mobile operating system's camera pipeline. Their work underscores a fundamental architectural flaw in relying on client-side security for high-stakes identity verification, revealing how attackers can manipulate the perceived reality of a mobile application to gain unauthorized access.

The implications of this research are far-reaching, impacting financial institutions, e-commerce platforms, and any service relying on client-side biometrics for identity verification. The speakers not only expose the technical frailties but also shed light on the economic drivers behind such attacks, citing billions in annual losses due to synthetic identity fraud. By showcasing practical bypass techniques across multiple major biometric frameworks, they provide invaluable insights for both defenders and developers, urging a re-evaluation of current security paradigms and a stronger emphasis on server-side validation to fortify the "glass perimeter" of digital identity.

Background

▶ Watch: The critical flaw: relying on client-side security (2:00)

The increasing demand for biometric authentication in mobile applications, particularly for Know Your Customer (KYC) processes, stems from a rising tide of synthetic identity fraud. This insidious form of fraud involves creating entirely new identities using a combination of real and fabricated personal information, often culled from publicly available sources. The speakers cite staggering figures, estimating global losses from synthetic identity fraud to be around $20 billion annually. Furthermore, a significant 70% of financial institutions report the creation of "mule accounts" or fake accounts, directly impacting their bottom line.

The core problem, as identified by Bernardo and Borgogno, lies in the fundamental error of delegating critical security decisions, such as identity verification, to the client-side environment – specifically, a mobile device – which an attacker can completely compromise. When an attacker gains control over a mobile device, they can manipulate what the application "sees" or "hears," effectively undermining any client-side security measures. This oversight often stems from a misconception that mobile platforms are inherently secure or that client-side controls are sufficient for robust identity validation.

To demonstrate their attack methodology, the researchers developed a sophisticated OSINT pipeline for generating synthetic identities. This process begins with harvesting publicly available images and videos from social networks like LinkedIn, X (formerly Twitter), and Instagram. For lip-syncing and voice cloning, they utilize audio clips and videos from YouTube, WhatsApp messages, or any other source providing voice traces. Crucially, they emphasize the importance of narrative context in AI prompts, which adds significant detail and coherence to the generated synthetic identities. Their research indicates that with just 5 minutes of active OSINT, they can reconstruct a 3D biometric model accurate enough for 90% of active internet users, a truly alarming statistic.

The process of forging a synthetic identity involves several steps:

1. Public Photos: Starting with readily available images.
2. Face Models: Generating 3D face models from these photos.
3. Voice Files: Acquiring or cloning voice samples.
4. Lip-Syncing Engines: Utilizing advanced engines to synchronize generated videos with cloned audio, creating realistic speaking footage.
5. Liveness Video: The ultimate goal, a video simulating a real person performing liveness detection actions (e.g., moving closer/further, turning head, blinking).

The quality of these AI-generated artifacts is remarkably high. Bernardo showcased two synthetic images of his co-speaker, Dan, created from just two public photos, indistinguishable from real photos to the human eye. The detail, such as reflections in a glass or the position of a finger behind an object, highlights the sophistication. A 4K lip-sync video of Dan, generated from a low-quality LinkedIn avatar and a newspaper photo, was presented as capable of deceiving "even his own mother." The talk also featured a humorous example of a lip-synced video of Lionel Messi, demonstrating the ease of generating celebrity deepfakes using free online tools.

Beyond initial generation, attackers must fine-tune these synthetic videos to bypass modern liveness detection algorithms. This involves:

• Simulating Erratic Blinking: AI-generated blinks can be too regular; human blinking is errant.
• Adding Micro-Movements: Mimicking the subtle, involuntary movements of a person holding a phone.
• Reflecting Screen Light: Simulating the reflection of the phone screen in the pupils.
• Stripping Metadata: Removing digital artifacts generated by compression and video generation engines, which can be detected by algorithms.

Another technique discussed is FaceSwap, where an attacker records a video of themselves performing the required liveness actions and then overlays a deepfake face of the victim. This leverages the attacker's physical movements and environment, which are often more natural than a fully AI-generated video. The researchers also explored analog attacks in their "analog attack lab," which included using high-grade silicone fingers, masks (e.g., V for Vendetta, partial masks), and even Fresnel lenses to create a 3D illusion of depth from flat images. They demonstrated a surprisingly realistic fake Argentinian ID card, complete with official-looking holograms, generated from a simple AI prompt. These diverse approaches underscore the multi-faceted nature of attacks against biometric systems, combining advanced digital manipulation with traditional physical bypass techniques.

Key Findings

▶ Watch: Convincing deepfake liveness video from two public images (7:00)

The central finding of this research is the systematic bypassability of prevalent client-side biometric frameworks used for KYC and authentication. The speakers demonstrated that despite various protective measures, it is consistently possible to inject synthetic or manipulated video frames into mobile applications, deceiving both the application's client-side validation and, often, the server-side checks. This capability fundamentally undermines the security premise of using biometrics as a sole or primary authentication factor in a client-controlled environment.

The research identified and analyzed four major, unnamed biometric frameworks (dubbed Alpha, Beta, Gamma, and Delta) along with a generic "shield" protection mechanism. These frameworks were found to be in use across seven different real-world applications, including home banking apps, serving a large user base. Each framework presented unique challenges and required distinct bypass techniques, but ultimately, all were found to be vulnerable to some form of video injection.

Key contributions and discoveries include:

• Ubiquity of Vulnerabilities: The problem is not isolated to a single framework or application but is systemic across widely adopted solutions.
• Scalability of Attacks: The ability to generate convincing synthetic identities using minimal OSINT (5 minutes for 90% of users) makes these attacks scalable and highly efficient.
• Evolvability of Bypass Techniques: Attackers can adapt to detection mechanisms by fine-tuning synthetic media (e.g., adding erratic blinking, micro-movements) and by stripping metadata.
• Multi-Layered Injection Capabilities: The researchers successfully demonstrated injection at various levels of the mobile operating system, from the application layer down to the camera server, proving that even robust client-side protections can be circumvented by moving to lower, more privileged layers.
• Bypass of Anti-Tampering Measures: Sophisticated anti-Frida, anti-root, and memory poisoning protections were systematically bypassed, often through clever manipulation of existing QA functionalities or by exploiting the order of memory operations.
• High Success Rates: While not every deepfake video passed every framework immediately, the core capability of injecting frames was consistently proven, indicating that with sufficient iteration and investment, successful bypasses are highly probable. For example, a video stream injection achieved a 94% face match and a 0.96 liveness score from the backend, indicating high confidence in the injected stream.
• Architectural Flaw: The ultimate conclusion is that relying solely on client-side biometric validation introduces a critical single point of failure due to the inherent control an attacker can gain over the execution environment.

In essence, the research proves that the "glass perimeter" of client-side biometrics is inherently fragile. Attackers, with sufficient control over the device, can effectively "lie" to the biometric system, making it perceive a synthetic reality as genuine, thereby enabling unauthorized access and facilitating widespread fraud.

Technical Deep Dive

▶ Watch: Bypassing advanced anti-tampering with memory poisoning (24:00)

The technical core of the research revolves around instrumenting mobile applications at runtime to inject forged biometric data. The speakers categorized attack surfaces into different layers of the mobile operating system, each with varying levels of difficulty and visibility to the SDK:

1. Application Layer: The highest layer, where attackers alter memory processes within the app's context.
2. Camera API Layer: Manipulating communications between the app and the camera hardware through system APIs.
3. Hardware Abstraction Layer (HAL): Bypassing the SDK by operating at the layer responsible for abstracting hardware specifics.
4. Kernel Layer: Raw injection at the camera driver level.
5. Physical Sensor (CMOS): The lowest layer, requiring analog lab techniques.

The focus of their successful bypasses primarily resided in layers 1-4, with a particular emphasis on making injections "completely invisible to the SDK" at lower layers.

Framework Bypass Techniques

Before injecting frames, the researchers first had to bypass various anti-tampering and anti-debugging mechanisms implemented by the biometric frameworks:

• General Anti-Tampering (Root/Emulator Detection): Many applications immediately crash or refuse to proceed if they detect a rooted device or an emulator. The bypass involved using Frida, a dynamic instrumentation toolkit, to hook functions like isRoot or isEmulator and force them to return false in runtime. This is a common "free win" in Android CTFs.
• Framework Alpha (Embedded License Check): This framework used an embedded license check that interacted with a backend, exchanging cryptographic keys. If tampering was detected, the license check would fail. Through extensive reverse engineering of Smali code (Android's pseudo-compiled bytecode), the team initially assumed a valid license returned 1 but discovered it was 0. By hooking the specific function and forcing it to return the correct value (which was 0 for valid, despite initial assumptions), they bypassed the license validation.
• Framework Beta (Frida Detection with QA Bypass): This framework specifically detected Frida. However, it was shipped with Quality Assurance (QA) functionalities that allowed security checks to be disabled during testing. By finding functions like isHookDetectionDisable and setting them to true at runtime via Frida, the framework was tricked into believing it was in a QA environment, thus ignoring Frida detection.
• Shildex (Extensive Checks & Memory Poisoning): This was one of the most challenging frameworks, performing 11 constant checks for root, Magisk, Xposed, debugger enabled, and emulator presence. Bypassing these individual checks took 70 iterations. Shildex also implemented memory poisoning: it loaded a JNI (Java Native Interface) library early in the application's lifecycle, which "poisoned" specific memory regions. If Frida later injected and modified memory, the JNI library would detect this corruption and crash the application. The solution involved allowing the JNI library to load and poison memory, but then using Frida to empty out (implement a no-op) the specific JNI functions that performed the checks. This prevented the application from ever receiving a "memory corrupted" signal, allowing it to continue running. Further iterations were needed to selectively re-enable essential JNI calls required for the KYC process itself.
• Framework Delta (Unbypassable at App Layer): Delta was so deeply integrated and protected that any attempt to inject Frida at the application layer resulted in an immediate crash. This led the researchers to pursue a lower-level injection strategy.

Video Injection Pipeline

The general process for injecting video frames was consistent across techniques:

1. Generate Video: Using AI, deepfake, or pre-recorded attacker videos.
2. Strip Frames: Deconstruct the video into individual frames, ensuring they match specific formats, resolutions, and sizes.
3. Push to Device: Transfer these frames to a readable directory on the mobile device via ADB (Android Debug Bridge).
4. Load Frida: Inject Frida into the target application's process.
5. Load Frames into Memory: Frida reads the prepared frames into the application's memory.
6. Inject: On command, Frida intercepts the camera's output or the application's input, replacing it with the loaded frames. The application then "sees" the injected video instead of the live camera feed.

Specific Injection Techniques

The team developed six distinct injection techniques, progressively moving to lower layers for increased stealth:

1. Bitmap Swap (Application Layer): In applications that capture a single image for liveness validation and then compress it before uploading to the backend, the bitmapCompress function was hooked. Before the image was signed and uploaded, the attacker's image was replaced with the victim's image. The backend would then validate the (forged) image, believing the liveness check passed. This technique works if the backend doesn't perform deeper computable metrics beyond the raw image.
2. Web View Injection (JavaScript Layer): If KYC was rendered within a WebView (common for less frequently used features), the JavaScript context became an attack surface. The getUserMedia API call, which requests camera access, was hooked. Instead of providing the real camera object, an injected JavaScript object that simulated a camera and provided the forged frames was returned. The underlying SDK's Frida detection mechanisms were oblivious because the injection occurred in the JavaScript context.
3. Video Stream Injection (API Layer): For applications that streamed video continuously to the backend for liveness and face matching, the approach shifted from single image replacement to continuous frame injection. Frida was used to feed a stream of pre-loaded frames in the required format and resolution directly into the application's video buffer. This method successfully achieved a 94% face match and a 0.96 liveness score from the backend.
4. Raw Format Injection (OS API Layer - YUV NV21): Some applications bypassed standard API formats and read camera frames in a raw format like YUV NV21 for security or performance. The injection technique was adapted to supply frames in this specific raw format, moving the attack closer to the operating system's camera interface.
5. Memory Read-Only Bypass (NDK Layer): This advanced technique targeted applications that read images directly from specific memory addresses, often marked as read-only by Java/Kotlin within the application's context. The bypass involved writing to these memory sectors outside the Java context, at the NDK (Native Development Kit) layer. By ensuring the injected data had an identical format, resolution, and size, the application would pick up the forged image from memory without detecting tampering.
6. Camera Server Injection (OS Kernel Layer - Golden Sweet Spot): This was the ultimate technique, specifically developed to bypass the impenetrable Framework Delta. Since Delta could not be bypassed at the application layer, the researchers went lower, injecting directly into the camera server PID within the Android operating system. The application, communicating with the camera server via its standard API, would receive the injected frames without any awareness of tampering. This method represents the "golden sweet spot" for attackers because, at this level, the application has no mechanism to differentiate between a legitimate camera feed and injected frames, rendering client-side protections irrelevant.

These techniques collectively demonstrate a comprehensive ability to subvert biometric frameworks by exploiting vulnerabilities at various layers of the mobile software stack, highlighting the profound risks of client-side reliance for identity verification.

Demo / Proof of Concept

▶ Watch: First live demo: Bitmap swap injection bypasses liveness (34:00)

The presentation included several compelling video demonstrations, showcasing the practical application of their bypass techniques across different real-world scenarios. While the specific applications were blurred for anonymity, the core functionality and success of the injections were clearly visible.

1. Bitmap Swap Injection:

This demonstration featured three scenarios using the Bitmap Swap technique, where the bitmapCompress function was hooked to replace the attacker's image with the victim's:

• Accessing an Application: The presenter initiated a facial validation. With Frida running in the background, injecting frames, the application's camera feed (shown as a small window in the demo) reacted as if a face was present, even though the presenter was not in front of the phone. After the injection, the application successfully validated the face, granting access.
• Accessing an Account without Credentials: In a second scenario, the same technique was used to bypass facial validation, directly granting access to an account without requiring additional credentials or multi-factor authentication. This highlighted a significant vulnerability where biometric validation was the sole gatekeeper.
• Accessing Sensitive Data: A third instance showed how the bypass could grant access to sensitive information, such as card details, which also required facial validation. The process was identical, demonstrating the versatility of the injection across different application flows using the same underlying framework.

Crucially, the presenter emphasized the need to inject frames in the correct format, scale, and proportion for each specific layer and application, as incorrect parameters would lead to detection and failure.

2. Web View Injection (JavaScript):

This demo illustrated a bypass for a KYC process rendered within a WebView, often used for less critical or one-time validations. The scenario involved changing a password, which required facial authentication. The presenter demonstrated injecting a 100% AI-generated video into the JavaScript context, simulating a camera feed. Despite an underlying SDK with Frida detection, the JavaScript-level injection bypassed these controls. The application validated the synthetic face, allowing the password change. This showcased how vulnerabilities can arise when different layers of an application (native vs. web) have varying security contexts.

3. Video Stream Injection:

This demonstration targeted an application that continuously streamed video to the backend for liveness and face matching. The presenter injected a stream of frames, and the application's backend returned a 94% face match and a 0.96 liveness score, indicating high confidence in the authenticity of the injected video. This proved that even with more sophisticated backend stream analysis, continuous video injection could be successful, allowing access to the application.

4. Raw Format Injection (NV21):

Another demo showed an application that read camera frames in a raw NV21 format. The injection technique was adapted to match this specific format, demonstrating the ability to move deeper into the operating system's camera interface. The process was visually similar to other application access demos, but the underlying technical challenge and solution were more complex, operating closer to the OS level.

5. Memory Read-Only Bypass (NDK Layer):

While no live demo was provided for this technique, the speakers explained its functionality. It involved writing to read-only memory sections from the NDK layer, bypassing Java's protections. This conceptual demonstration highlighted the ability to manipulate data at a lower, native level, even when the application attempts to protect its memory.

6. Camera Server Injection (OS Kernel Layer):

This was the most challenging and impactful demo, targeting the Framework Delta, which was unbypassable at the application layer. The presenter injected a video (in this case, his own pre-recorded face) directly into the camera server PID at the operating system level. The application, communicating with the camera server, received the injected frames as if they were coming from the real camera. The demo showed the application prompting the user to "move closer," and the presenter could pause, play, and reverse the injected video stream to meet these demands. Although the KYC process ultimately failed due to other validation factors beyond the scope of the demo, the successful injection itself was the critical proof of concept: the application did not detect the injection and processed the video as a legitimate camera feed. This validated the core thesis that by operating at the OS level, attackers can render client-side protections irrelevant.

Throughout the demos, the presenters emphasized that these bypasses were achieved with minimal to zero investment in terms of sophisticated hardware or commercial tools, primarily relying on open-source tools like Frida and readily available AI generation capabilities.

Defensive Implications

▶ Watch: Key takeaway: Don't blindly trust client-side biometrics (53:00)

The research by Bernardo and Borgogno unveils critical vulnerabilities in client-side biometric frameworks, presenting significant defensive implications for organizations, particularly financial institutions and any service relying on KYC or biometric authentication. The overarching message is clear: do not blindly trust client-side environments for critical security decisions.

1. Shift from Client-Side Trust to Server-Side Validation: The most crucial takeaway is the need to move away from relying solely on client-side biometric validation. While client-side checks can offer a first line of defense and user convenience, the ultimate verdict on identity authenticity must reside on the server-side. This requires robust server-side analysis of biometric evidence, extending beyond simple image or video reception to include deeper anomaly detection, metadata analysis, and behavioral analytics.
2. Architectural Fragility of Biometrics as a Single Factor: The presentation highlights an architectural fragility where biometrics, once a secondary authentication factor, have become the sole means of authentication in many applications. This creates a single point of failure. If the biometric input can be spoofed, the entire security perimeter collapses. Defenders must re-evaluate architectures that use biometrics as the only factor for high-value transactions or account access.
3. The CISO's Dilemma: Chief Information Security Officers (CISOs) face a difficult trade-off. Setting detection thresholds too high (e.g., rejecting blurred videos, requiring perfect lighting) can lead to false negatives, locking out legitimate users and creating a poor user experience. Conversely, lowering detection thresholds to improve usability creates a fraud gap, making it easier for synthetic identities and injected videos to pass. This dilemma underscores the need for multi-faceted security approaches that don't rely on a single, imperfect detection mechanism.
4. Awareness of Exploit Pack Market: The speakers revealed that exploit packs for synthetic identity fraud are actively traded in gray and black markets, offering a "ridiculous ROI" for attackers. These packs can generate $200,000 to $800,000 in end-days and $50,000 to $200,000 per day in revenue from mule accounts and synthetic identity fraud. This economic incentive drives sophisticated attacks, meaning defenders are up against well-funded and motivated adversaries.
5. Multi-Factor Authentication (MFA) is Paramount: Even with advanced biometric systems, MFA remains a critical defense. Combining biometrics with other factors, such as possession-based (e.g., hardware tokens, secure push notifications) or knowledge-based (e.g., strong passwords, security questions), significantly increases the difficulty for attackers. The demos showed cases where accounts were accessible with only facial validation, underscoring the danger of single-factor biometric reliance.
6. Robust Anti-Tampering is Necessary but Insufficient: While anti-Frida, anti-root, and memory poisoning protections are valuable, the research proves they are not insurmountable. Attackers will find ways to bypass client-side controls by exploiting QA features, reverse engineering, or moving to lower layers of the operating system. Therefore, relying solely on client-side obfuscation or integrity checks provides a false sense of security.
7. Regular Security Assessments and Threat Modeling: Organizations should conduct frequent, thorough security assessments and threat modeling specifically focused on their biometric authentication flows. This includes considering an attacker with full control over the client device and exploring injection vectors at various OS layers.
8. Proactive Monitoring for Synthetic Identity Indicators: Beyond real-time authentication, organizations should implement systems for proactive monitoring for indicators of synthetic identity fraud, such as unusual account creation patterns, rapid changes in account behavior, or discrepancies in linked data.

In summary, the "Glass Perimeter" talk serves as a stark warning: the perceived security of client-side biometrics is often an illusion when faced with a compromised device. Defenders must adopt a holistic, layered security strategy that leverages server-side intelligence, robust MFA, and a deep understanding of evolving attack techniques to truly secure digital identities.

Key Takeaways

• Client-side biometric frameworks are systematically bypassable: Attackers can inject synthetic or manipulated video frames into mobile applications, deceiving client-side and often server-side validation.
• Sophisticated synthetic identity generation is accessible and cheap: With minimal OSINT (5 minutes for 90% of internet users) and free AI tools, highly realistic deepfakes and liveness videos can be created.
• Attackers can achieve deep levels of injection into mobile OS camera pipelines: Techniques range from application-layer hooks to direct injection into the camera server at the operating system level, rendering client-side protections ineffective.
• Anti-tampering and anti-Frida mechanisms, though varied, are generally bypassable: With enough effort, techniques like exploiting QA features, reverse engineering, and memory manipulation can circumvent these defenses.
• Relying solely on client-side biometric verification for critical access is a major security risk: Biometrics, when used as a single point of failure, create significant vulnerabilities for synthetic identity fraud and unauthorized access.
• Server-side validation and robust multi-factor authentication are essential: To fortify the "glass perimeter," organizations must implement comprehensive server-side analysis of biometric evidence and integrate additional authentication factors.

About the Speaker(s)

Javier Bernardo is the Head of Hacking at Strike. In his role, he observed a high demand for penetration tests and security assessments on biometric solutions, which prompted the extensive research presented in this talk. He led the conceptualization of the research, focusing on the broader implications of synthetic identity fraud, the OSINT pipeline for identity generation, and the analog attack vectors. Bernardo's insights into the "CISO's dilemma" and the economic drivers of fraud underscore the strategic importance of this work.

Dan Borgogno is a Security Researcher at Faraday. Dan played a pivotal role in the technical execution of the research, particularly in the mobile device injection techniques. He delved into the intricacies of bypassing anti-tampering mechanisms across various biometric frameworks (Alpha, Beta, Gamma, Delta) and developing the six distinct video injection methodologies, from Bitmap Swaps to raw camera server injections. His expertise in dynamic instrumentation with Frida and deep understanding of Android's internal workings were crucial to demonstrating the systematic bypasses at different layers of the operating system.