Fingerprint scanners can be fooled

We've seen them fooled in movies, but you'd be surprised at how easy it really is.

Biometrics are rapidly becoming a popular means for adding security factors to user authentication. However, many

biometric scanning systems are not as foolproof and reliable as you might think. You've seen movies demonstrate numerous means by which fingerprint scanners can be bypassed, from latex gloves with fake imprints to fingerprint-projecting LCD panels -- not to mention using someone's chopped-off finger as a portable verification key. These fantastic measures are not far from reality. Japanese mathematician Tsutomu Matsumoto has demonstrated several methods for creating fake fingers that fool fingerprint scanners four out of five times.

The fake fingers are crafted from common kitchen supplies, primarily gelatin. The use of gelatin requires that a finger be pressed into the goo to create a mold. Another method lifts fingerprints from surfaces such as glass and countertops. Through an ingenious process, the print is enhanced with super-glue fumes and photographed with a digital camera. Hackers digitally increase the contrast, print it onto transparent sheets and etch the print onto copper using a photo-sensitive printed circuit board (an item found at most electronic supply and hobby shops). The copper-print is then used to create a gelatin fingertip.

A range of biometric fingerprint scanners from several companies were tested against these gelatin fingers; all consistently failed to reject the imposter finger.

The gelatin fingers were little more than thin sheaves slipped over the tip of the finger. Thus, the gelatin fingers even defeated devices that tested for human-normal capacitance, heat and pulse.

To read how to create your own fingerprint-scanner-breaking gummy bears, view the PDF presentation by Tsutomu Matsumoto at http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf.


About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.


This was first published in June 2002

Dig deeper on Network intrusion detection and prevention and malware removal

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchVirtualDesktop

SearchWindowsServer

SearchExchange

Close