It's such an obvious solution that I really thought that WAS the case until just now. Why in the world would you tackle this problem any other way?
Then again, Apple’s marketing for the iPhone 5s made many claims of “subdermal fields”, “RF micro fields produced by the human body”, and how, as a result, it couldn’t be faked.
Except it could. Fairly easily. And without any remote pretense around the ‘emulate a live finger’. Just the fingerprint.
Much as I like Apple, these are pretty bold-faced deceptions.
Except, you know, they never actually said that.
The hack is to override the camera to ignore that signal. It is a rather unique idea and probably not something anyone even considered at Apple.
-- A LED shall light up when the camera is activated.
But what they should have implemented is:
-- It shall not be possible to activate the camera without the LED being lit, taking malicious third-party software into account.
The first requirement is obviously, and demonstrably, implemented by every camera (ignoring hardware defects regarding the LED). The second is, as proven by the paper, not fulfilled by any.
{EDIT: added the malicious part to the 2nd requirement}
-- There shall be a way for the user to physically obstruct the camera lens.
Apple used to have this in their standalone camera back in the day.
OS X allows non-privileged users to do that for some reason though...