Injection attack

Feeding fake video straight into the app, bypassing the camera entirely.

Instead of holding a fake up to a real camera, the attacker uses software to send a prepared video or image directly into the verification flow, so the app never sees a real lens.

Insertion of synthetic or replayed biometric data into the capture pipeline via virtual camera, emulator, or API manipulation. The capture pipeline is the path an image takes from the camera to the verification system.

Attackers use several methods to inject data:

• Virtual cameras, which are software that pretends to be a camera and plays a chosen video.
• Emulators, which are simulated phones running on a computer.
• API manipulation, which tampers with the app's connection to the camera or the verification service.
• Rooted or jailbroken devices, whose relaxed security lets attackers alter what the app receives.

What gets injected is often a deepfake, a replayed recording, or a synthetic image.

A standard now exists for testing defenses. The European Committee for Standardization (CEN) published CEN/TS 18099, a technical specification on biometric data injection attack detection, which defines injection attacks, gives guidance on detecting them, and describes how to plan an evaluation. Presentation attacks remain covered by ISO/IEC 30107.

Injection attacks sit next to terms that are easy to mix up:

• Presentation attack shows a fake to a real camera, while an injection attack bypasses the camera.
• Deepfake is the synthetic media that attackers often inject.
• Emulator detection spots simulated devices, which is one way to catch injection.

For more, see How iPhone Jailbreaking Is Used to Commit Deepfake Fraud.