Injection Attack

An injection attack works by replacing what the camera sees with content the attacker controls. A remote identity check expects a live image from the camera of a phone or a computer. The attacker inserts something else between the lens and the server that judges the image. The system then analyses a picture that was never in front of a camera.

There are several points of entry. Virtual camera software presents a video file to the operating system as if it were a webcam. An emulator imitates a phone on a computer, where the camera is whatever the attacker supplies. A modified app or a tampered phone can swap the feed inside the device. The attacker can also leave the device out altogether, sending prepared images straight to the provider's interface in the form the genuine app would use.

The injected content may be a stolen photo of a passport, a recording of the victim or a generated face. Once the set-up works, it can be repeated from one computer with a new identity each time.

A presentation attack happens in front of the camera. An injection attack happens behind it. In a presentation attack, a photo, a screen or a mask is held up to a genuine lens. The camera records a physical object, with the flaws a physical copy has: glare, flatness, visible edges. Liveness detection is built to notice those flaws.

In an injection attack the image arrives as clean digital data. A liveness check that studies only the picture may pass it. The two attacks therefore need different defences. One examines the scene. The other examines the route the image took.

Deepfakes are used in injection attacks because they give the attacker a face that moves on demand. A deepfake is an image, a video or a voice that machine learning has created or altered so that it appears to show a real person. Two kinds matter for identity checks. A face swap places the victim's face on the attacker's head in a video. A fully generated face shows a person who does not exist, to go with a forged document.

A stolen photo cannot blink. A recording cannot follow an instruction it did not expect. A face swap that runs in real time can do both, because the attacker performs the movement while the software redraws the face. Played on a screen in front of a camera, a deepfake still has to survive glare from the screen. Injected, it reaches the system at full quality.

An injection attack is detected by checking the route the image took as well as the picture itself. A method that resists injection combines several controls.

The first group of controls concerns the device. The app checks that it runs on a genuine phone, not an emulator. It checks that the operating system has not been tampered with, that the app is unmodified, that the image comes from the physical camera. A dedicated mobile app can make these checks more reliably than a web page, since a browser sees little of the hardware beneath it.

The second group ties the capture to the session. The server sends something unpredictable, such as a sequence of screen colours or an instruction, then looks for its trace in the video. A file prepared in advance will not contain it. A third group examines the content for the traces that generated video leaves. A fourth adds evidence that does not depend on the camera at all, such as reading the chip in a passport.

EU law does not name injection attacks. It sets the result a method must achieve. Under Article 24(1a)(c) of the eIDAS Regulation, a qualified trust service provider that relies on its own identification method, such as a document check with a face capture, must ensure the identification of the person with a high level of confidence, which a conformity assessment body must confirm. Article 22(6) of the Anti-Money Laundering Regulation, which applies from 10 July 2027, names the means of verifying a customer's identity without mentioning the risk. Both sets of rules are set out under remote identity verification.

A method that accepts injected video cannot give a high level of confidence. Standards bodies, among them the European Committee for Standardization (CEN), have taken up the testing of injection attack detection.

A firm that builds its own check from uploaded photos carries the injection risk itself.