Log inRegister

Fraud News

Endpoint Security

Aaron Lint of Arxan on How Application Telemetry Can Guide Security Strategies(APACinfosec) • March 18, 2019     Aaron Lint, chief scientist and vice president of research, Arxan

Getting a telemetry stream back from applications can help organizations to "adjust much more quickly to see how practical attacks are happening on the endpoint and then go to mitigate," says Aaron Lint of Arxan.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In a video interview with Information Security Media Group at RSA Conference 2019 in San Francisco, Lint discusses:

Application protection and shielding; Recommendations for improving application security; How application telemetry is changing the game.

Lint is chief scientist and vice president of research at Arxan.

3rd Party Risk Management , Cloud Security , Data Breach

Incident Highlights the Importance of Vendor Risk Management(HealthInfoSec) • March 18, 2019    Unsecure Fax Server Leaked Patient Data

A medical software vendor's unsecured fax server leaked patients' medical information, highlighting yet again the importance of vendor risk management.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Sacramento, Calif.-based Meditab Software Inc., which provides fax services and other services for healthcare providers, leaked the patient records through a fax server that was hosted by a subdomain of one of its affiliate companies, MedPharm Services, based in Puerto Rico, according to a March 17 report on news site TechCrunch.

Meditab's website says the privately held company provides software to over 2,200 clients from over 35 medical specialties.

TechCrunch reports that SpiderSilk, a Dubai-based cybersecurity firm, made the discovery that the exposed fax server was running a Elasticsearch database with over 6 million records since its creation in March 2018.

As of Monday, the incident did not appear on Department of Health and Human Service's HIPAA Breach Reporting Tool website that lists major health data breaches. It's not yet clear how many records were potentially exposed or for how long.

Because the server allegedly had no password, anyone could read the transmitted faxes in real time, SpiderSilk told TechCrunch. The faxes contained a variety of information, including names, addresses, medical information, prescription information and, in some cases, Social Security numbers and payment data, the news site reports. And apparently none of the data was encrypted, it states.

Meditab Response

Angel Marrero, general counsel at Meditab and MedPharm Services, confirms to Information Security Media Group that MedPharm hosted the unsecured fax server on its subdomain.

Marrero says the companies cannot yet disclose how long the fax server was left unsecured, the number of individuals who were affected or how the incident occurred because the incident is under review for the scope of the potential exposure. "I can confirm that the fax server was taken down immediately after we were notified," he says.

MedPharm Services and Meditab Software will comply with all required notification requirements under federal and state regulations, he adds.

"We are conducting a comprehensive security check of all our portals and services to make sure they are secured," Marrero says. "In addition, we will be implementing additional penetration testing as part of our development and testing methodology. Lastly, the management team has already conducted discussions to implement a bug bounty program so that security researchers can report any flaws they find directly and securely."

Marrerro adds: "We can assure all our customers and their patients that we will do everything in our power to make sure this never happens again."

Skipping the Basics

The apparent data exposure stemming from an unsecured fax server is troubling for a variety of reasons, says Rebecca Herold, president of Simbus, a privacy and cloud security services firm, and CEO of The Privacy Professor consultancy.

"I'm coming across increasingly more B2B online services organizations that are simply choosing not to implement basic information security controls on their servers," she says.

Often these vendors will skip implementing necessary controls "with the expressed opinion that they believe it is more important to 'be agile' than to perform long-time known and necessary due diligence data and systems security actions and implement the necessary protections," she says. "Too many are simply willing to gamble with their clients' data security that nothing will happen."

The security of fax servers, as well as fax machines, is often overlooked, she adds.

"I've had business owners, and many start-up managed services providers, tell me, 'No one uses faxes anymore. That is a waste of our time to put attention to fax security if they are not used.' They push forward with that flawed opinion, despite the advice of those of us who have actually been working, and continue to work with, a wide range of businesses of all sizes that regularly use fax transmissions as part of their business processing."

The alleged lack of a password to protect the fax server and alleged absence of encryption are particularly concerning, Herold says.

"The breached organizations in this case will likely never know how many others may have obtained all that sensitive patient data," she says. "The crooks using it for fraud and other crimes, and selling it to other criminals, are the only ones who will have any type of insights into the answer to that question."

Lingering Problems

Despite the move to electronic health records, as well as growing adoption of the Direct protocol for point-to-point encrypted healthcare messaging, many healthcare providers in the U.S., especially smaller entities, still rely on faxes for exchanging patient information and sending prescriptions to pharmacies.

The U.K. in January banned National Health System healthcare trusts from buying fax machines, and faxes will be phased out by March 31, 2020, in favor of more secure methods of communication, including secure email, according to a statement issues last December by Matt Hancock, the U.K's secretary of state for health and social care.

Privacy attorney David Holtzman of the security consultancy CynergisTek says the Meditab mishap is a prime example of the risks involving vendors.

"This incident has little to do with the prevalence in the use of fax machines in healthcare. The root cause of this event was that the cloud computing vendor did not secure their servers, resulting in exposing the data to the internet," he says. "This represents a fundamental failure to practice minimum information security practices. We have seen these incidents over and over again with cloud-based medical transcription vendors and healthcare billing services."

Other Vendor Mishaps

Many other vendors have also been implicated in security breaches involving misconfigured servers.

For instance, last November, the New Jersey state attorney general office signed a $200,000 settlement with Best Medical Transcription for a 2016 breach involving the misconfiguring a server that publicly exposed protected health information - including the names and medical diagnoses of more than 1,600 patients treated by Marlton, New Jersey-based Virtua Medical Group.

imageHealthcare practice Virtua Medical Group and its vendor Best Medical Transcription each signed settlements last year with New Jersey's attorney general for a breach involving an unsecured server.

The New Jersey attorney general's office last April also signed a nearly $418,000 settlement with Virtua Medical Group.

The cases against Best Medical Transcription and Virtua Medical Group alleged violations of HIPAA and the New Jersey Consumer Fraud Act.

Healthcare providers cannot rely on a cloud computing vendors' claims they are "HIPAA compliant," Holtzman says.

"It's crucial for healthcare organizations to have a vendor security management program in place to verify that business associates are continuously safeguarding the information security of PHI and PII," he says. "Don't place a high level of trust in a certification that is the result of a one-and-done cybersecurity assessment."

Good vendor management practices call for a covered entity to work with their contractors to employ a risk-based strategy to assess the potential for compromise of data, Holtzman stresses. "Organizations must aggressively pursue getting answers to questions about how their e-PHI will be safeguarded."

Cybercrime , Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime

Nation Flaunts Sanctions via Cybercrime Efforts• March 18, 2019    UN Report: N. Korea Targets Cryptocurrency Exchanges, Banks

North Korea's cybercrime capabilities have given the country the ability to flaunt international sanctions by allowing the regime to steal millions in currency not only from banks but also from cryptocurrency exchanges, according to a report from the United Nation's Security Council.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Between January 2017 and September 2018, the Democratic People's Republic of Korea carried out at least five successful attacks against cryptocurrency exchanges in Asia, resulting in the theft of $571 million in currency, the report concludes.

The UN report also notes North Korea's ability to attack banks across the world, including the Bangladesh Bank heist that targeted the bank's SWIFT system account at the Federal Reserve Bank in New York and then transferred about $81 million to accounts in the Philippines, where the money was then laundered.

Other international banks targeted by North Korean cyberattacks include the Banco de Chile and Cosmos Bank in India, according to the report, which the UN released March 14. Between 2015 and 2018, the country targeted banks in Europe, Asia, the United States and South America, resulting in the theft of over $1 billion, the report adds.

"Cyberattacks by the Democratic People's Republic of Korea to illegally force the transfer of funds have become an important tool in the evasion of sanctions and have grown in sophistication and scale since 2016," according to the UN report.

Evading Sanctions

The report, written by a panel of UN security experts, looks at how North Korea is evading international sanctions through a variety of means while keeping its nuclear and ballistic missile capabilities intact. One reason is that the country and its agents keep finding ways to fill the country's coffers through numerous illegal activities, including cyberattacks.

As the report states: "The panel notes a trend in the Democratic People's Republic of Korea's evasion of financial sanctions of using cyberattacks to illegally force the transfer of funds from financial institutions and cryptocurrency exchanges. According to a member state, 'cyberspace is used by the DPRK as an asymmetric means to carry out illicit and undercover operations in the field of cybercrime and sanctions evasion. These operations aim to acquire funds through a variety of measures in order to circumvent the sanctions.'"

North Korea's APT Groups

At the heart of these schemes are a network of advanced persistent threat groups that work with or are directly sponsored by the North Korean regime and carry out various cyberattacks, according to the report. Some of these groups share ties, while others work independently, the report found.

For instance, the most well-known of these groups, Lazarus - which also goes by the name Hidden Cobra among other aliases - is mostly focused on disruptive campaigns, which include the well-known Sony Pictures hack of 2014 as well as the Wannacry ransomware attacks of 2017.

In September 2018, U.S. prosecutors charged Park Jin Hyok of North Korea with being part of Lazarus and alleged that he was one of the main architects of WannaCry and other attacks, including those against Sony and Bangladesh Bank. While North Korea and the U.S. do not have a formal extradition treaty, which means that it's unlikely that Hyok will ever face trial, the nearly 200-page indictment offers a window into how the APT group works, what tools its uses as part of attacks and some of the motivation behind these various schemes.

Other APT groups, such as APT 38 and Temp.Hermit, overlap, with each of these groups using some of the same toolsets as part of their various cyberattack campaigns.

APT 38 and Temp.Hermit are involved with various financial schemes, but Temp.Hermit also launches espionage campaigns, according to the UN report. APT 38, which security analysts began studying in late 2018, has been involved in several high-profile banking attacks targeting the SWIFT systems of banks in Africa and Asia, according to a recent analysis by FireEye.

Connecting the Dots

There appears to be a direct line between North Korea's attacks against banks and the country's new-found interest in attacking cryptocurrency, which helps to further hide its activities, says Mukul Kumar, the CISO and vice president of cyber practice at Cavirin, a Santa Clara, California-based security company.

"North Korea's attacks on cryptocurrency exchanges are a logical escalation from their earlier attacks on other financial institutions, since, as the report points out, the digital trail is more difficult to trace," Kumar tells Information Security Media Group. "What is important to note is that the U.S. is not just sitting back and hoping sanctions have an impact. Under the administration's new guidelines, the U.S. can take additional offensive actions to counter future attacks. I see this change in strategy as critical to ensuring our national cyber posture."

As part of the UN report released last week, the panel noted that it's recommending several guidelines to help stop North Korea avoid sanctions. To help stop cyberattacks, it recommends, among other steps:

U.N. member states need to be aware of North Korea's ability to use cyberattacks to circumvent sanctions by illegally generating revenue. Member states need to share information about North Korea's capabilities not only among themselves, but with banks and other financial institutions. The UN Security Council, when drafting financial sanctions measures, needs to take into account North Korea's ability to wage cyberattacks to circumvent sanctions.

A hacker who has previously put up for sale over 840 million user records in the past month, has returned with a fourth round of hacked data that he's selling on a dark web marketplace.

This time, the hacker has put up for sale the data of six companies, totaling 26.42 million user records, for which he's asking 1.2431 bitcoin ($4,940).

The hacker's name is Gnosticplayers, and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1, Round 2, and Round 3] on Dream Market, a dark web marketplace.

Today, the hacker published a new batch of files from six new companies, namely game dev platform GameSalad, Brazilian book store Estante Virtual, online task manager and scheduling apps Coubic and LifeBear, Indonesia e-commerce giant Bukalapak, and Indonesian student career site YouthManual.

Company
DB sizeBreach datePriceContent
GameSalad (game dev platform)
1.5 Mil
2019/02
฿0.0785
email, password (SHA1/SHA256), username, IP address
Estante Virtual (Brazilian book shop)
5.45 Mil
2019/02
฿0.2618
name, username, password (SHA1), address, email, phone number
Coubic (scheduling software)
1.5 Mil
2019/02
฿0.157
name, email, password (SHA256)
LifeBear (Japanese scheduling app)
3.86 Mil
2019/02
฿0.2618
email, password (MD5), username, event details, app settings
Bukalapak (Indonesian e-commerce site)
13 Mil
2017/07
฿0.34
username, name, email, password hash (SHA512+salt), shopping details, IP adress, other
YouthManual.com (Indonesian youth student and career site)
1.12 Mil
2019/02
฿0.144
name,email, password hash (SHA1+salt), hobbies, education, other
Gnosticplayers Round 4 Image: ZDNet

ZDNet has reached out to the allegedly hacked companies with emails earlier today. It is worth mentioning that many of the companies whose data Gnosticplayers has sold in the previous three rounds have already confirmed breaches.

Coubic returned comment and said it was investigating the breach. So did LifeBear, which admitted that it was "most likely" that it servers got hacked, but the company is still investigating.

The difference between Round 4 and the previous three rounds is that five of the six databases Gnosticplayers put up for sale were acquired during hacks that have taken place last month, February 2019.

The hacker said that he put up the data for sale mainly because these companies had failed to protect passwords with strong encryption algorithms like bcrypt.

Most of the hashed passwords the hacker put up for sale today can cracked with various levels of difficulty --but they can be cracked.

"I got upset because I feel no one is learning," the hacker told ZDNet in an online chat earlier today. "I just felt upset at this particular moment, because seeing this lack of security in 2019 is making me angry."

In a conversation with ZDNet last month, the hacker told us he wanted to hack and put up for sale more than one billion records and then retire and disappear with the money.

But in a conversation today, the hacker says this is not his target anymore, as he learned that other hackers have already achieved the same goal before him.

Gnosticplayers also revealed that not all the data he obtained from hacked companies had been put up for sale. Some companies gave into extortion demands and paid fees so breaches would remain private.

"I came to an agreement with some companies, but the concerned startups won't see their data for sale," he said. " I did it that's why I can't publish the rest of my databases or even name them."

Article updated with Coubic and LifeBear responses.

More data breach coverage:

In January 2018 a group of hackers, now thought to be working for the North Korean state-sponsored group Lazarus, attempted to steal $110 million from the Mexican commercial bank Bancomext. That effort failed. But just a few months later, a smaller yet still elaborate series of attacks allowed hackers to siphon off 300 to 400 million pesos, or roughly $15 to $20 million from Mexican banks. Here's how they did it.

At the RSA security conference in San Francisco last Friday, penetration tester and security advisor Josu Loza, who was an incident responder in the wake of the April attacks, presented findings on how hackers executed the heists both digitally and on the ground around Mexico. The hackers' affiliation remains publicly unknown. Loza emphasizes that while the attacks likely required extensive expertise and planning over months, or even years, they were enabled by sloppy and insecure network architecture within the Mexican financial system, and security oversights in SPEI, Mexico's domestic money transfer platform run by central bank Banco de México, also known as Banxico.

Easy pickings

Thanks to security holes in the targeted bank systems, attackers could have accessed internal servers from the public Internet, or launched phishing attacks to compromise executives—or even regular employees—to gain a foothold. Many networks didn't have strong access controls, so hackers could get a lot of mileage out of compromised employee credentials. The networks also weren't well segmented, meaning intruders could use that initial access to penetrate deep into banks's connections to SPEI, and eventually SPEI's transaction servers, or even its underlying code base.

imageTo make matters worse, transaction data within internal bank networks wasn't always adequately protected, meaning attackers who had burrowed in could potentially track and manipulate data. And while communication channels between individual users and their banks were encrypted, Loza also suggests that the SPEI app itself had bugs and lacked adequate validation checks, making it possible to slip bogus transactions through. The app may have even been directly compromised in a supply chain attack, to facilitate successful malicious transactions as they moved through the system.

All of these vulnerabilities collectively made it possible for hackers to lay extensive groundwork, eventually establishing the infrastructure they needed to begin carrying out actual cash grabs. Once that was in place, the attacks moved quickly.

The hackers would exploit flaws in how SPEI validated sender accounts to initiate a money transfer from a nonexistant source like “Joe Smith, Account Number: 12345678.” They would then direct the phantom funds to a real, but pseudonymous account under their control and send a so-called cash mule to withdraw the money before the bank realized what had happened. Each malicious transaction was relatively small, in the range of tens or hundreds of thousands of pesos. "SPEI sends and receives millions and millions of pesos daily, this would have been a very little percentage of that operation," Loza says.

Attackers would have potentially needed to work with hundreds of mules to make all of those withdrawals possible over time. Loza says that recruiting and training that network could be resource-intensive, but that it wouldn't cost much to incentivize them. Perhaps 5,000 pesos per person—less than $260—would be enough.

Wake-up call

SPEI itself and the infrastructure surrounding the app were apparently ripe for attack. Banxico, which could not be reached by WIRED for comment, said in a forensic analysis report released at the end of August that the attacks weren't a direct assault on Banxico's central systems, but were instead targeted at overlooked or weak interconnections in the larger Mexican financial system. The attackers' approach required "a deep knowledge of the technological infrastructure and the processes of the victim institutions as well as access to them," Banxico wrote. "The attack was not intended to render SPEI inoperable or penetrate the defenses of the Central Bank."

Similar fraud using the international money transfer system Swift have cropped up around the world, including notorious incidents in Ecuador, Bangladesh, and Chile. But SPEI is owned and operated by Banxico, and only used within Mexico. In the aftermath of the April attacks, the bank tightened its policies and controls around fund transfers, to establish minimum cybersecurity standards for Mexican banks that link their systems to SPEI.

"Mexican people need to start to work together. All the institutions need to cooperate more," Loza says. "The main problem on cybersecurity is that we don’t share knowledge and information or talk about attacks enough. People don't want to make details about incidents public."

Loza adds that while there is still always the threat of a new rash of attacks, Mexican banks have invested heavily over the last year in strengthening their defenses and improving network hygiene. "From last year to today the focus has been implementing controls. Control, control, control," he says. "And I think the attacks aren't happening today because of it. But the most important thing is the change of mind that makes business users want to pay for better security."

These types of heists have been so successful around the world, though, that they won't be easy to stop. And while they take effort for attackers to set up, they can still net tens of millions of dollars. And all without having to crack a safe.

This post originally appeared on wired.com.

Facial recognition is a blossoming field of technology that is at once exciting and problematic. If you've ever unlocked your iPhone ($1,000 at Amazon) by looking at it, or asked Facebook or Google to go through an unsorted album and show you pictures of your kids, you've seen facial recognition in action.

Whether you want it to or not, facial recognition (sometimes called simply "face recognition") is poised to play an ever-growing role in your life. Your face could be scanned at airports or concerts with or without your knowledge. You could be targeted by personalized ads thanks to cameras at shopping malls. Facial recognition has plenty of upside. The tech could help smart home gadgets get smarter, sending you notifications based on who it sees and offering more convenient access to friends and family. 

facial-recognition-promo

This is part of a CNET special report exploring the benefits and pitfalls of facial recognition.

James Martin/CNET

But at the very least, facial recognition raises questions of privacy. Experts have concerns ranging from the overreach of law enforcement, to systems with hidden racial biases, to hackers gaining access to your secure information.

Over the next few weeks, CNET will be diving into facial recognition with in-depth pieces on a wide variety of topics, including the science that allows it to work and the implications, both positive and negative, for many of its applications. To get you up to speed, here's a brief overview including what facial recognition is, how it works, where you'll find it in use today, as well as a few of the implications of this rapidly expanding corner of technology.

What is facial recognition?

Facial recognition is a form of biometric authentication, which uses body measurements to verify your identity. Facial recognition is a subset of biometrics that identifies people by measuring the unique shape and structure of their faces. Different systems use different techniques, but at its core, facial recognition uses the same principles as other biometric authentication techniques, such as fingerprint scanners and voice recognition.

How does facial recognition work?

Now playing: Watch this: Facial recognition: Get to know the tech that gets to...

5:11

All facial recognition systems capture either a two- or three-dimensional image of a subject's face, and then compare key information from that image to a database of known images. For law enforcement, that database could be collected from mugshots. For smart home cameras, the data likely comes from pictures of people you've identified as relatives or friends via the accompanying app. 

Woodrow "Woody" Bledsoe first developed facial recognition software at a firm called Panoramic Research back in the 1960s using two-dimensional images, with funding for the research coming from an unnamed intelligence agency.

Even now, most facial recognition systems rely on 2D images, either because the camera doesn't have the ability to capture depth information -- such as the length of your nose or the depth of your eye socket -- or because the reference database consists of 2D images such as mugshots or passport photos.

2D facial recognition primarily uses landmarks such as the nose, mouth and eyes to identify a face, gauging both the width and shape of the features, and the distance between the various features of the face. Those measurements are converted to a numerical code by facial recognition software, which is used to find matches. This code is called a faceprint.

This geometric system can struggle with different angles and lighting. A straight-on shot of a face will show a different distance from nose to eyes, for instance, than a shot of a face turned to the side. The problem can be somewhat mitigated by mapping the 2D image onto a 3D model and undoing the rotation.

Apple uses a 3D facial recognition system called Face ID. It's good, but not perfect. 

Morgan Little/CNET

Adding a third dimension

3D facial recognition software isn't as easily fooled by angles and light and doesn't rely on average head size to guess at a faceprint. With cameras that sense depth, the faceprint can include the contours and curve of the face as well as depth of the eyes and distances from points like the tip of your nose.

Most cameras gauge this depth by projecting invisible spectrums of light onto a face and using sensors to capture the distance of various points of this light from the camera itself. Even though these 3D sensors can capture much more detail than a 2D version, the basis of the technology remains the same -- turning the various shapes, distances and depths of a face into a numerical code and matching that code to a database.

If that database consists of 2D images, software needs to convert the 3D faceprint back to a 2D faceprint to get a match.

Apple's Face ID uses 30,000 infrared dots that map the contours of your face. The iPhone then remembers the relative location of those dots the next time you try to unlock your phone.

Even these more advanced systems can be defeated by something as simple as different facial expressions, wearing glasses or scarves that obscure parts of your face. Apple's Face ID can struggle to match your tired, squinting, just-woke-up face to your made-up, caffeinated, ready-for-the-day face.

Now playing: Watch this: The Property Brothers can trick Face ID

2:34

Reading your pores

A more recent development, called skin texture analysis, could help future applications overcome all of these challenges. Developed by Identix, a tech company focused on developing secure means of identification, skin texture analysis differentiates itself by functioning at a much smaller scale. Instead of measuring the distance between your nose and your eyes, it measures the distance between your pores. It then converts those numbers into a mathematical code. This code is called a skinprint.

This method could theoretically be so precise that it can tell the difference between twins. Currently, Identix is working to integrate into facial recognition systems alongside a more normal 3D face map. The company claims the tech increases accuracy by 25 percent.

face-id-recognition-6face-id-recognition-6

Your face can be turned into a code. 

James Martin/CNET

Where is facial recognition being used?

While Bledsoe laid the groundwork for the tech, modern facial recognition began in earnest in the 1980s and '90s thanks to mathematicians at MIT. Since then, facial recognition has been integrated into all manner of commercial and institutional applications with varying degrees of success.

The Chinese government uses facial recognition for large-scale surveillance in public CCTV cameras, both to catch criminals and monitor the behavior of all individuals with the intent of turning the data into a score. Seemingly harmless offenses like buying too many video games or jaywalking can lower your score. China uses that score for a sort of "social credit" system that determines whether the individual should be allowed to get a loan, buy a house or even much simpler things like board a plane or access the internet.

The London Metropolitan Police also use it as a tool when narrowing their search for criminals, though their system supposedly isn't very accurate -- with incorrect matches reported in a whopping 98 percent of cases. In the US, police departments in Oregon and Florida are teaming up with Amazon to install facial recognition into government-owned cameras.

Facial recognition is undergoing trials at airports to help move people through security more quickly. The Secret Service is testing facial recognition systems around the White House. Taylor Swift even used it to help identify stalkers at one of her concerts. Facial recognition famously led to the arrest of the Capital Gazette shooter in 2018 by matching a picture of the suspect to an image repository of mugshots and pictures from driver's licenses. The upcoming 2020 Olympics in Tokyo will be the first to use facial recognition to help improve security.

Facial recognition could have large implications for retail outlets and marketers as well, beyond simply watching for thieves. At CES 2019, consumer goods giant Procter & Gamble showed a concept store where cameras could recognize your face and make personalized shopping recommendations.

Now playing: Watch this: Nest Hello video doorbell: Smarter than your average...

2:39

Bringing facial recognition home

Aside from large-scale installations, facial recognition has several uses in consumer products. Beyond iPhones, some phones with Google's Android operating system like the Google Pixel 2 and the Samsung Galaxy S9 are capable of facial recognition, but the technology on Android isn't yet secure enough to verify mobile payments. The next version of Android is expected to get a more secure facial recognition system closer to Apple's Face ID, although Samsung did not incorporate any facial recognition into its newest phone, the Galaxy S10 ($1,000 at Amazon), as many industry watchers had expected.

Facebook has used facial recognition for years to suggest tags for pictures. Other photo applications, such as Google Photos, are getting better at doing the same.

In the smart home, after starting as a niche feature in connected cams such as the Netatmo Welcome, facial recognition is now built into several popular models, including the Nest Hello video doorbell. We saw a bunch of new gadgets with the tech on display at CES 2019.

Connected cams compare faces with others they've seen before so you can customize notifications based on who the camera sees. All the models we've tested take a while to learn faces, as they need to be able to recognize the members of your household at various angles and in various outfits. Once the cameras learn, you can use facial recognition to make your connected security system that much smarter by making your notifications more relevant to what you actually want to know.

Beyond the security uses in the home, even robots like Lovot and Sony's Aibo robot dog can recognize faces. Aibo and others learn faces not to track who comes and goes, but to adapt to the specific preferences of different people over time.

Now playing: Watch this: My week living with Aibo, Sony’s robot dog

6:55

What are the implications?

Unlike other forms of biometric authentication, cameras can gather information about your face with or without your knowledge or consent. If you're a privacy-minded person, you could potentially be exposing your data when in a public place without knowing it. 

Because the technology is so new, there aren't any laws in the US limiting what companies can do with images of your face after they capture it. A bipartisan bill was recently introduced in the Senate to rectify the lack of regulation. 

The American Civil Liberties Union delivered a petition to Amazon last year asking it to stop giving its facial recognition technology to law enforcement agencies and the government, calling the prospect "a user manual for authoritarian surveillance."

According to a report by Buzzfeed, the US Customs and Border Protection agency plans to implement facial recognition to verify the identity of passengers on international flights in airports across the country. The Electronic Privacy Information Center shared documents with Buzzfeed that suggested the UCB skipped over gathering public feedback before starting to implement these systems, and that they have a questionable accuracy rate and little established privacy regulations as far as what the airlines can do with this facial data after they collect it.

NBC News reported that the databases of pictures used to improve facial recognition often comes from social media sites without the consent of the subject or photographer. Companies like IBM have the stated goal of using these images to try and improve the accuracy of facial recognition, particularly among people of color. Theoretically, by ingesting the data from a large catalog of faces, the system can fine tune its algorithms to account for a larger variety of facial structures.

The Electronic Frontier Foundation notes that current facial recognition systems tend to produce a disproportionately high number of false positives when identifying minorities. NBC's story also details how it can be tedious to impossible for private citizens to opt out of using their pictures in these databases.

ring-video-doorbell-two-1ring-video-doorbell-two-1

The Ring Doorbell would have watched for suspicious individuals. 

Chris Monroe/CNET

Facebook faces a class action lawsuit over its own facial recognition technology, called DeepFace, which identified people in photos without their consent. Smart home company Ring, an Amazon subsidiary, also came under fire last year for filing patents based on facial technology that could have violated civil rights.

Ring's video doorbells would have monitored neighborhoods for known sex offenders and those on "most wanted" lists and could then have automatically notified law enforcement. The idea was criticized as likely to target those unfairly deemed a threat and potentially even political activists.

The science behind facial recognition is certainly exciting, and the tech could lead to a safer and more personal smart home, but facial recognition could easily result in a loss of privacy, unjust profiling and violations of personal rights. While the impact of facial recognition is still being determined and debated, it's important to recognize that facial recognition is no longer some distant concept reserved for science fiction. For better or worse, facial recognition is here now and spreading quickly. 

Check back throughout the month as CNET dives deeper into the implications of this developing technology.

Published March 18 at 5:00 a.m. PT
Update, 3:00 p.m. PT.

Share your voice

  1. Beto O'Rourke's Secret Membership In The cDc
  2. Beto O'Rourke Has Serious Hacker Credentials
  3. You're Now In A Timeline In Which A US Presidential Hopeful Was In A Legendary Hacker Group
  4. WordPress Releases 14 Fixes In Latest Security Updates

Page 263 of 354