News for hackers. Stuff that matters.
Re:Chaos Computer Club breaks Apple TouchID by yellowbkpk on Sunday September 22, 2013 @02:37PM (#6427460)
Frontline had an excellent piece on the (lack of) reliability behind most of crime forensics. Fingerprints in particular are mentioned as being very unreliable and unscientific. The only scientifically rigorous piece of "CSI" is DNA matching.

http://www.pbs.org/wgbh/pages/frontline/real-csi/

Re:Chaos Computer Club breaks Apple TouchID by maroonblazer on Sunday September 22, 2013 @02:56PM (#6427533)
And now even DNA is being called into question.

http://mobile.nytimes.com/2013/09/17/science/dna-double-take...

Re:Chaos Computer Club breaks Apple TouchID by pasbesoin on Sunday September 22, 2013 @03:56PM (#6427761)
In addition to the chimeric qualities cited in the NYT article (I skimmed), IIRC some DNA sampling has in the past used and may still use a fairly limited profile of markers. The statistically likelihood of matches between distinct parties is in some cases well under the population of the world. Never read into it in detail, but I was left with the impression that "unique identifier" can be an over-statement/qualification also from this perspective.
Re:Chaos Computer Club breaks Apple TouchID by AnthonyMouse on Sunday September 22, 2013 @04:33PM (#6427905)
>The statistically likelihood of matches between distinct parties is in some cases well under the population of the world.

In addition to that, there are problems with bias and statistical independence. A given marker is unlikely to be present in exactly 50% of the population, and to the extent that it isn't it can reduce the probability by that amount that a test match is a true match. Meanwhile the suspect pool for a given crime is likely to encompass several (perhaps many) members of the same extended family, who for the obvious reason are significantly more likely than random members of the world population to have the tested markers match one another. Even within a city you will generally see concentrations of specific ethnicities who may have a higher statistical incidence of specific genetic markers than other populations, which can screw up the numbers by an amount that historically hasn't even knowable because we don't have good numbers on the statistical incidence of specific markers within geographical populations.

The place where this is most pernicious is when they get a sample from a crime scene and run it against some "DNA database" to find a hit. Then everybody is talking about the probability that X suspect would match the DNA at the crime scene rather than the probability that someone in the database would match even if the actual perpetrator wasn't in the database.

Re:Chaos Computer Club breaks Apple TouchID by coldtea on Sunday September 22, 2013 @04:55PM (#6427971)
>The place where this is most pernicious is when they get a sample from a crime scene and run it against some "DNA database" to find a hit. Then everybody is talking about the probability that X suspect would match the DNA at the crime scene rather than the probability that someone in the database would match even if the actual perpetrator wasn't in the database.

Or the probability that, match or not, the DNA from the crime scene belongs to the criminal.

And not, say, someone the victim came in contact with earlier, someone that happened to be in the crime scene before the crime took place, or even some third guy the actual criminal took a DNA from in order to frame him.

Re:Chaos Computer Club breaks Apple TouchID by brazzy on Sunday September 22, 2013 @04:56PM (#6427976)
> The statistically likelihood of matches between distinct parties is in some cases well under the population of the world.

I thought that was pretty much always the case. Which is why DNA evidence is never used alone - you don't take DNA traces found at a scene of crime, run it against a huge database, find a match, close the case and try and sentence the matching person.

Instead you either investigate whether that matching person had means and motive and no alibi, or (more often) you check the DNA only against people you already suspect for whatever reasons.

Both variants reduce the likelihood of false positives by quite a few orders of magnitude.

Re:Chaos Computer Club breaks Apple TouchID by tingletech on Sunday September 22, 2013 @06:58PM (#6428422)
I thought they used restriction digests with gel electrophoresis, I'm pretty sure full genomic sequencing would be too expensive.
Re:Chaos Computer Club breaks Apple TouchID by pasbesoin on Monday September 23, 2013 @01:15PM (#6432453)
I don't really know, but this does sound familiar and is part of what I was speaking to. What type and generation of technology was used? How much was the solicitor of the test willing to pay for it (influencing the choice made within the current range of available technologies/capabilities), as well as how many sequence/data points were targeted.

As one example, combine a fairly limited set of targets with gel chromatography, and varying quality/accuracy of analysis/analysts of same... And you have a lot less "uniqueness" than things like the common, public term "DNA fingerprint" imply.

Yes, it may be a useful tool in combination with proper understanding of its limitations. However, we have (in the U.S., for example) and adversarial judicial process and prosecutors have been shown to often not place such understanding even in context let alone as a primary concern. If the defence is lacking, including simply financially to engage its own "expert witnesses"... misbegotten interpretations can and do rule the day.

Re:Chaos Computer Club breaks Apple TouchID by auctiontheory on Sunday September 22, 2013 @02:58PM (#6427539)
Even DNA can provide false negatives in the case of human chimeras.
Re:Chaos Computer Club breaks Apple TouchID by Amadou on Sunday September 22, 2013 @03:09PM (#6427586)
Or just someone skilled enough to place fake dna in his body such that the person taking the sample is fooled into taking it from the fake dna.

Yes, this really happened - at least once that we know of: https://en.wikipedia.org/wiki/John_Schneeberger

Re:Chaos Computer Club breaks Apple TouchID by sillysaurus2 on Sunday September 22, 2013 @04:00PM (#6427773)
Wow!

During his 1999 trial, Schneeberger revealed the method he used to foil the DNA tests. He implanted a 15 cm Penrose drain filled with another man's blood and anticoagulants in his arm. During tests, he tricked the laboratory technician into taking the blood sample from the place the tube was planted.

Re:Chaos Computer Club breaks Apple TouchID by coldtea on Sunday September 22, 2013 @04:50PM (#6427956)
Or someone just being careful with his DNA at the crime he commits, that then places someone else's DNA that he wants to frame?
Re:Chaos Computer Club breaks Apple TouchID by pavel_lishin on Sunday September 22, 2013 @05:17PM (#6428059)
That would work in the sort of Hollywood movie where the government has everyone's DNA on file.

Then again, I guess we've seen that you literally cannot be too paranoid.

Re:Chaos Computer Club breaks Apple TouchID by coldtea on Sunday September 22, 2013 @06:28PM (#6428335)
>That would work in the sort of Hollywood movie where the government has everyone's DNA on file.

You don't have to have "everyone's DNA on file". It's actually pretty trivial even for your neighbor or whoever to get your DNA.

As for the police falsifying evidence, there's a wikipedia-long history of cases, in Europe, Latin America, Asia, etc. Especially in politically charged times, like the sixties and seventies. Heck, something like half of Italy's government in the 70's have been proved in later Italian courts to be involved in such things.

Re:Chaos Computer Club breaks Apple TouchID by pavel_lishin on Sunday September 22, 2013 @10:43PM (#6428944)
> You don't have to have "everyone's DNA on file". It's actually pretty trivial even for your neighbor or whoever to get your DNA.

Sorry, I wasn't clear. I can dump a gallon of your blood and semen onto a dead guy in an alley, but how would the government trace that blood and semen back to you?

Re:Chaos Computer Club breaks Apple TouchID by CaveTech on Sunday September 22, 2013 @11:18PM (#6429025)
They don't have to necessarily trace it back to me, as long as they can't trace it back to you.
Re:Chaos Computer Club breaks Apple TouchID by coldtea on Monday September 23, 2013 @10:55AM (#6431360)
A, sure.

Well, as the culprit, you can always arrange some things or leave other stuff that also points to me.

Also, your main benefit is that the police will more easily believe that it wasn't you (since your DNA won't match).

Re:Chaos Computer Club breaks Apple TouchID by clarky07 on Sunday September 22, 2013 @05:44PM (#6428156)
How in the world did he get off with only 4 years in prison after "repeatedly" raping multiple people?
Re:Chaos Computer Club breaks Apple TouchID by frakkingcylons on Sunday September 22, 2013 @03:40PM (#6427697)
In Schneeberger's case, it seems that he was simply infusing a part of his body with another man's blood and then making sure that the lab tech drawing the blood sample drew it from the same place. Once they tested his hair and saliva, they had a positive match.
Re:Chaos Computer Club breaks Apple TouchID by moocowduckquack on Sunday September 22, 2013 @03:10PM (#6427591)
The case of Lydia Fairchild is particularly harrowing, she nearly lost her own kids because most of her DNA didn't match. http://en.wikipedia.org/wiki/Lydia_Fairchild
Re:Chaos Computer Club breaks Apple TouchID by jonknee on Sunday September 22, 2013 @05:07PM (#6428022)
Chimeras are also apparently way more prevalent than we had previously realized.

http://www.nytimes.com/2013/09/17/science/dna-double-take.ht...

> But scientists are finding that it’s quite common for an individual to have multiple genomes. Some people, for example, have groups of cells with mutations that are not found in the rest of the body. Some have genomes that came from other people.

> Women can also gain genomes from their children. After a baby is born, it may leave some fetal cells behind in its mother’s body, where they can travel to different organs and be absorbed into those tissues. “It’s pretty likely that any woman who has been pregnant is a chimera,” Dr. Randolph said

Re:Chaos Computer Club breaks Apple TouchID by chimeracoder on Sunday September 22, 2013 @03:14PM (#6427610)
Or even mosaic individuals (which is slightly different): http://en.wikipedia.org/wiki/Mosaicism
Re:Chaos Computer Club breaks Apple TouchID by panzi on Sunday September 22, 2013 @04:12PM (#6427829)
And false positives in case of stem cell transplantation (a treatment of leukemia). There was a case where they got a false positive because of that. They discovered that it was a false positive because the alleged culprit had an alibi: He was in prison.
Re:Chaos Computer Club breaks Apple TouchID by Tichy on Sunday September 22, 2013 @04:17PM (#6427853)
Isn't it rather easy to obtain somebody's DNA, and also clone it? Seems even easier than obtaining somebody's fingerprints.
Re:Chaos Computer Club breaks Apple TouchID by andygates on Tuesday September 24, 2013 @04:29AM (#6436688)
It's easy to obtain. You'd need lab gear to make more - the gear is pretty common in wet labs: a PCR machine, desk centrifuge and suitable supplies.

It's much less common than a consumer-grade scanner and some wood glue.

Re:Chaos Computer Club breaks Apple TouchID by ptrinh on Sunday September 22, 2013 @04:14PM (#6427840)
Maybe we should lick the iPhone to provide accurate DNA biometric lol
Re:Chaos Computer Club breaks Apple TouchID by phogster on Sunday September 22, 2013 @04:22PM (#6427870)
Don't give them any ideas!
Re:Chaos Computer Club breaks Apple TouchID by nodata on Monday September 23, 2013 @06:52AM (#6429986)
Except laboratory error reduces the claimed reliability of DNA massively (to one in a few thousand levels, iirc - not one in a million).