The BBC published a story today explaining how one of its reporters fooled HSBC’s voice biometrics security system. The bank let the reporter’s non-identical twin access his telephone banking account when he mimicked his brother’s voice. His brother was then able to access his account details and make financial transactions. IT security experts from Aeriandi, Positive Technologies and Intercede commented below.
“Biometrics technology has been widely shown to significantly reduce fraud – but it’s not the whole solution. And as this experiment has illustrated no security technology is 100% fool-proof. Technology advances have shown that it is now possible to cheat voice recognition systems. Voice synthesiser technology is a great example. It makes it possible to take an audio recording and alter it to include words and phrases the original speaker never spoke. The good news is that there is a way to protect against phone fraud beyond biometrics – and that’s fraud detection technology. Fraud detection on voice looks at more than the voice print of the user; it considers a whole host of other parameters. For example, is the phone number being used legitimate? Increasing phone fraud attacks on UK banks come from overseas. Voice Fraud technology has been proven to protect against this as well as domestic threats.”
“Biometrics were introduced to try and overcome the issue of PINs or passwords that hackers were able to circumvent with alarming regularity. However, as the BBC report highlights, biometric authentication alone can also be fallible. As is always the case with security, a layered approach is best. Rather than relying on it as a sole authentication method, it should be used as an additional tool, in tandem with other security practices.”
“Of far greater trepidation is the need to protect biometric databases, which are increasingly considered a prime target for hackers. In 2015, fingerprints of about 6 million officers of US Office of Personnel Management were stolen. Large caches of personal information are always going to be a target for attackers and you cannot change your fingerprints after they are stolen!”
“Another day, another corporation revealed as having hackable security systems. HSBC’s roll out of voice recognition technology in lieu of usernames and passwords was a promising step in in the right direction. Yet today’s news serves to highlight that not all biometric authentication is strong or resistant to potential attack. There are two types of biometric identifiers – physiological (based on characteristics inherent to the individual, such as a fingerprint or retina scan) and behavioural (such as typing rhythm or voice). In the case of the latter, behavioural characteristics can change over time, be learned or be mimicked. Therefore, using these as a gateway to accessing customer accounts is risky.
“Most security breaches happen at the ‘front door’ – at the user authentication level. To avoid becoming the next victim of attack, businesses need to change their approach to cybersecurity beyond merely adding more or stronger locks on the door. After all, you could have the valid keys or codes to gain access, but still be the wrong person having acquired them through illegitimate or criminal means. Instead, the priority should be proving the identity of the individual before giving them keys. This means looking at measures that incorporate three distinct elements – possession (something you have, such as a smartphone), knowledge (something you know, such as a PIN) and inherence (something you are, such as an iris scan). This allows businesses to verify that the person accessing the service is who they say they are, in addition to limiting the amount of times an individual can attempt access if any of these elements are missing or incorrect.
“Businesses are quick to think that hacks ‘won’t happen to me’ but it’s dangerous to rely on issues surfacing to highlight and fix underlying problems. A more proactive and robust approach would ensure that management teams aren’t left with some serious explaining to do and compensation to pay out.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.