Researchers have learned how to create fake fingerprints that can fool many devices - though it’s a lot of effort.

[DronVR]

Researchers have learned how to create fake fingerprints that can trick many devices.

Fingerprint Authorization - Theory
First, let's talk about how fingerprint scanners work. The basic idea is simple: when you put your finger on the scanner to unlock a smartphone, laptop or smart lock, the sensor in one way or another gets an image of your papillary pattern. There are several types of scanners, and each of them recognizes a fingerprint in its own way. Researchers at Cisco Talos have focused on the three most popular types:

• Capacitive Scanners - the most common type. A capacitive scanner receives an image with a small electric charge. To do this, miniature capacitors are built into it - devices that can accumulate electricity. When the finger touches the scanner, it discharges these capacitors. In those places where the finger comes close to the sensor (crests of the print) - more, and where there is a gap between the skin and the sensor (hollows of the print) - less. The scanner measures this difference and determines the print pattern from it.
• Optical scanners actually take a fingerprint. The device shines on the finger through a prism, the light is reflected differently from ridges and depressions, and the sensor reads it and receives the desired picture.
• Ultrasound scanners instead of light, an ultrasound signal is sent and an echo is recorded, which also forms differently from ridges and depressions. Such a scanner does not have to be in contact with a finger, so it can be hidden under the screen of a smartphone. In addition, he “hears” not only that part of the finger that is adjacent to the surface, but also the edges of the pad remote from the sensor, so that the picture comes out voluminous. This helps to identify fraud using flat copies of the print.

Having received your fingerprint, the scanner - or the operating system - compares it with the one stored in the device’s memory. Moreover, all existing methods for reading fingerprints may give some error, so that when comparing a certain percentage of mismatches is allowed - for each device its own.

If this percentage is high, it is more likely to fake a print. If the settings are more strict and the percentage of permissible error is low, it will be more difficult to trick the scanner, but the gadget will recognize the real owner through time.

How researchers prints faked
One way or another, in order to make a copy of the fingerprint, you must first get the fingerprint itself. Researchers have found three ways to do this.

How to steal a fingerprint, the first way: remove the mold for casting
You can take a fingerprint of the victim while the person is unconscious or, say, thoroughly drunk. For this, any soft but hardening material is suitable - for example, polymer clay.

As a result, in the hands of the attacker immediately appears a mold for casting a fake print. The obvious difficulty is that you need to find the victim in the “right” state or to introduce him into this state.

How to steal a fingerprint, the second way: get a picture from the scanner
You can also one way or another get a fingerprint taken with a scanner. This method in itself is technically more complicated. However, not all companies working with biometric data store them reliably. Therefore, it is possible that a thief will find scanned fingerprints on the web or buy on the dark on the cheap.

After that, you need to turn a flat picture into a three-dimensional model and print it on a 3D printer - and there are some nuances here. Firstly, in the program in which the researchers prepared the drawing for printing, it was not possible to set the size of the model. Secondly, the photopolymer used in the budget 3D printer had to be warmed up after printing, and the dimensions of the sample changed.

Thirdly, according to research experience, the actual print from this polymer is too hard for at least one scanner to recognize it as a real finger. Therefore, the researchers, as a result, did not print the cast itself, but the form in which false prints were then manually cast from more elastic material.

How to steal a fingerprint, the third way: take a photo of the print on the glass
Another obvious option is to photograph the print on a glass surface. That's exactly what crackers did in the history of the iPhone 5S - in this form, the fingerprint is the easiest to get. After this, the picture will have to be processed in order to achieve the desired level of clarity, and then, as in the previous case, everything rests in 3D printing.

According to the researchers, the experiments with the 3D printer turned out to be very long and dreary: it was necessary to calibrate the printer, gropingly find the appropriate form size, and printing one model (which they had to make 50 in total) with the necessary settings took an hour. That is, quickly faking a fake fingerprint to unlock a stolen smartphone in this way will not work. And the method with the imprint of a sleeping victim is also not super-fast.

In addition, the form for the ebb of prints is still half the battle. You need to make the fake yourself. Here the choice of material turned out to be the most non-trivial, because it was planned to test the fake on three types of sensors with a different approach to reading prints. For example, it doesn’t matter to ultrasonic and optical sensors whether a finger is conducting current or not;

However, in the end, just this part of the process turned out to be accessible to anyone: the best fabric glue came up best for making fake prints.

What devices were able to crack
The fakes obtained by the three methods described above, the researchers tried on a set of mobile phones, tablets and laptops from different manufacturers, as well as a smart lock and two protected USB drives - Verbatim Fingerprint Secure and Lexar Jumpdrive Fingerprint F35.

The result turned out to be rather sad: the bulk of gadgets could be deceived in 80–90% of cases, and in some places success was completely 100%. 3D printer-based casts were slightly less effective, but in most cases, they were a little bit .

However, there were exceptions. So, the researchers were not able to crack the Samsung A70 smartphone at all. On the other hand, this is just the gadget that recognizes the real fingerprints of its rightful owner very reluctantly.

Also, all devices with Windows 10 turned out to be impenetrable, regardless of the manufacturer. Researchers attribute this surprising unanimity to the fact that the operating system itself is engaged in comparing fingerprints with a sample, so little depends on a particular device manufacturer.

Finally, protected flash drives have shown themselves to be truly protected, although our colleagues warn that, with a different level of training, they are also likely to be hacked.

Among other findings, it was noted that it was easiest to trick ... ultrasonic fingerprint scanners. Despite their ability to perceive a three-dimensional image, they willingly recognized the fake imprint as genuine, graciously pressed to the sensor with a real finger, including a glove.

Fingerprint protection - for ordinary users
According to the researchers, the security of fingerprint authorization leaves much to be desired, and to some extent, the situation has even worsened compared to previous years.

Nevertheless, making a fake is a rather expensive procedure, at least in terms of time. So, the simple user has nothing to fear: street thieves on his knee will not make a fake print.

Another thing is if you may be interested in well-funded criminal groups or intelligence agencies. In this case it is best to protect devices with a good old password: it’s more difficult to crack it if you know how to cook it, and you can always change it if there is a fear that it fell into the wrong hands.

 

[Николай Николаевич]

Researchers have learned how to create fake fingerprints that can trick many devices.

Where is the world heading ???

 

[Марат (МОД)]

In general, hacking a phone using this “feature” is not only long, but also rather labor-consuming - first you need to get the victim’s phone for a long time or, in general, just get it. And special services use other less labor-intensive methods, and the “ordinary” hack can be turned much easier. Subjective opinion - the development of this direction is not predicted

 

[Частный детектив. Армения. Ереван.]

In general, hacking a phone using this “feature” is not only long, but also rather labor-consuming - first you need to get the victim’s phone for a long time or, in general, just get it. And special services use other less labor-intensive methods, and the “ordinary” hack can be turned much easier. Subjective opinion - the development of this direction is not predicted

But over time, technology will probably advance and it will not be so expensive.
What do you think Marat?

 

[Марат (МОД)]

But over time, technology will probably advance and it will not be so expensive.
What do you think Marat?

Certainly, but with the development of these technologies, let’s say the user’s definition by face) then by voice) and in any case, the most difficult task is to get the victim’s phone, so accessing it remotely is much faster - well, say through Phishing)