Skip to content
AI

Why can synthetic video injected below the camera driver pass your liveness check cleanly?

85

Oportunidade

Liveness detection runs at the application layer, above the OS driver. A camera injection attack intercepts the video stream below that layer, feeding the detector a synthetic face generated in real time that behaves exactly like a genuine camera signal because from the detector's perspective it is one. Group-IB documented 8,065 such attempts against a single financial institution between January and August 2025, and injection attacks on iOS devices surged 1,151% in the second half of 2025 alone. An RSA Conference analysis published in 2026 concluded that ISO 30107-3 PAD certification does not cover virtual-camera and API-level injection, leaving it entirely outside the scope of the only certification most vendors pursue. There is no consumer-level standard for hardware-attested camera feeds, and the entire KYC pipeline assumes the signal entering liveness detection originates from a phy

Por que importa

Every biometric onboarding flow is only as strong as its weakest pipeline layer, and right now that layer is the unattested camera bus.

Como avalio a oportunidade

A Pontuação de Oportunidade é minha própria leitura, não uma medição: o quanto dói, com que frequência aparece e o quanto pouco existe para resolvê-lo hoje. Quanto maior, mais vale a pena construir, na minha opinião.

Gravidade9/10

O quanto de dor causa quando aparece.

Frequência7/10

Com que frequência as pessoas realmente se deparam com isso.

Lacuna8/10

O quanto pouco de boas ferramentas existe para isso hoje.

Mais problemas que merecem ser resolvidos