Windows Hello is one of the crown features of Surface devices which are based on Infra-red, unlike other techs which use a camera to recognize faces to unlock a Windows 10 Machine. It seems, that this security feature of Windows 10 has been defeated by using a printed picture.
However, here is the big catch. Windows 10 machines running older versions of Windows are prone to this bug, and it seems Microsoft has disabled the anti-spoofing feature. According to ZDNet, security researchers from German firm SYSS, where able to bypass Windows Hello by testing on computers running Windows 10 Anniversary Update.
According to SYSS, if one can disable the anti-spoofing feature in Creators, and Fall Creators Update, the technique it can bypass Windows Hello. It is also reported that those who set up the Windows Hello with anniversary update, need to re-setup the Windows Hello with a fresh configuration to fix this. Otherwise, even if you have upgraded to the latest update to Windows 10, it won’t work.
The company plans to reveal further variations of its attack in spring 2018.
“According to our test results, the newer Windows 10 branches 1703 and 1709 are not vulnerable to the described spoofing attack by using a paper printout if the “enhanced anti-spoofing” feature is used with respective compatible hardware,” SYSS wrote.
“Thus, concerning the use of Windows Hello face authentication, SYSS recommend updating the Windows 10 operating system to the latest revision of branch 1709, enabling the “enhanced anti-spoofing” feature, and reconfiguring Windows Hello face authentication afterwards.”