Injection attack
A technique that bypasses the camera outright by injecting a fabricated stream into the verification system.
ISO/IEC 30107-3 tests presentation attack detection: a photo, a mask or a screen held up to the lens. An injection attack skips that scene entirely. It bypasses the capture layer and feeds the verification system a synthetic video stream directly, most often through a virtual camera, an emulator or a tampered app. Liveness checks that assume the image comes off a physical sensor stop working, and presentation-attack detection alone no longer holds up in remote identity proofing; CEN published a dedicated technical specification in 2024, CEN/TS 18099. The answer combines injection-specific detection based on device and channel integrity, binding between the live face and the ID document, and adaptive verification that tightens on device or session anomalies. Not to be confused with SQL injection or prompt injection, which go after code or a model.
Injection attacks bypass the camera layer, so a synthetic face reaches the system without ever passing in front of a lens.
Injection attack, digital injection attack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.