Fingerprint scanners can be fooled

Biometrics are rapidly becoming a popular means for adding security factors to user authentication. However, many biometric scanning systems are not as foolproof and reliable as you might think. You've seen movies demonstrate numerous means by which fingerprint scanners can be bypassed, from latex gloves with fake imprints to fingerprint-projecting LCD panels -- not to mention using someone's chopped-off finger as a portable verification key. These fantastic measures are not far from reality. Japanese mathematician Tsutomu Matsumoto has demonstrated several methods for creating fake fingers that fool fingerprint scanners four out of five times.

The fake fingers are crafted from common kitchen supplies, primarily gelatin. The use of gelatin requires that a finger be pressed into the goo to create a mold. Another method lifts fingerprints from surfaces such as glass and countertops. Through an ingenious process, the print is enhanced with super-glue fumes and photographed with a digital camera. Hackers digitally increase the contrast, print it onto transparent sheets and etch the print onto copper using a photo-sensitive printed circuit board (an item found at most electronic supply and hobby shops). The copper-print is then used to create a gelatin fingertip.

A range of biometric fingerprint scanners from several companies were tested against these gelatin fingers; all consistently failed to reject the imposter finger.

The gelatin fingers were little more than thin sheaves slipped over the tip of the finger. Thus, the gelatin fingers even defeated devices that tested for human-normal capacitance, heat and pulse.

To read how to create your own fingerprint-scanner-breaking gummy bears, view the PDF presentation by Tsutomu Matsumoto at http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf.

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.

This was first published in June 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.