Red Bleed: A Pragmatic Near-Infrared Presentation Attack on Facial Biometric Authentication Systems#

Bowen Hu, Kuo Wang, and Chip Hong Chang, Nanyang Technological University — Wildcard

• Why: A practical, sub-$400 hardware attack defeating a widely-deployed commercial biometric authentication system (Windows Hello, confirmed by Microsoft's own security response center) — a concrete demonstration that "commercial-off-the-shelf NIR biometric = secure" is no longer a safe assumption.
• What: Red Bleed, a presentation attack against near-infrared (NIR) facial biometric authentication (e.g., Windows Hello, Apple Face ID) using a custom-built consumer LCD display costing under $400, converting ordinary visible-light face images/video into convincing NIR spoofs. Confirmed against a commercial Windows Hello module with a CVE scheduled for disclosure. (from abstract only)
• How: A generative framework (VAE-based) converts RGB/visible-spectrum face images or video into the NIR domain, combined with face-swapping, so attackers can use easily-obtainable RGB material (social media photos, video calls) rather than needing rare NIR footage of the target. (from abstract only)
• Where applicable: NIR-based facial biometric authentication specifically (a widely deployed modality); a hardware/software technique that generalizes to any NIR liveness-detection system relying on the assumption that commodity displays can't emit convincing NIR.