The Glass Perimeter - Systematic Bypasses in Biometric Frameworks

The talk examines the liveness checks that banks and fintech apps use during facial identity verification. The presenters tested seven top-tier apps built on four KYC SDKs over about six months, and report that every app but one could be bypassed. They argue that a few public photos are enough to build a convincing synthetic identity video cheaply, and they describe physical spoofing with masks, printed faces and other props, which worked only some of the time.

The core of the talk walks through injection points from the application layer down to the Android camera server. Before any injection, the team had to defeat root, emulator and debugger checks, sometimes by flipping return values or by exploiting debug-only flags left in release builds. Frame injection then fed recorded or deepfake frames at whichever layer the app trusted. The lowest layer, the camera server, was invisible to the app itself and fed frames to every application on the phone, and it was the only route that worked against the one hardened app that resisted the earlier techniques.

The takeaway for practitioners is that client-side liveness and anti-tampering checks should not be the sole gate for identity decisions. The speakers recommend moving verification logic to the server side and note the dilemma CISOs face when tuning thresholds, since loosening them enables fraud and tightening them locks out legitimate users.