Problem solve Get help with specific problems with your technologies, process and projects.

Fingerprint scanners can be fooled

We've seen them fooled in movies, but you'd be surprised at how easy it really is.

Biometrics are rapidly becoming a popular means for adding security factors to user authentication. However, many biometric scanning systems are not as foolproof and reliable as you might think. You've seen movies demonstrate numerous means by which fingerprint scanners can be bypassed, from latex gloves with fake imprints to fingerprint-projecting LCD panels -- not to mention using someone's chopped-off finger as a portable verification key. These fantastic measures are not far from reality. Japanese mathematician Tsutomu Matsumoto has demonstrated several methods for creating fake fingers that fool fingerprint scanners four out of five times.

The fake fingers are crafted from common kitchen supplies, primarily gelatin. The use of gelatin requires that a finger be pressed into the goo to create a mold. Another method lifts fingerprints from surfaces such as glass and countertops. Through an ingenious process, the print is enhanced with super-glue fumes and photographed with a digital camera. Hackers digitally increase the contrast, print it onto transparent sheets and etch the print onto copper using a photo-sensitive printed circuit board (an item found at most electronic supply and hobby shops). The copper-print is then used to create a gelatin fingertip.

A range of biometric fingerprint scanners from several companies were tested against these gelatin fingers; all consistently failed to reject the imposter finger.

The gelatin fingers were little more than thin sheaves slipped over the tip of the finger. Thus, the gelatin fingers even defeated devices that tested for human-normal capacitance, heat and pulse.

To read how to create your own fingerprint-scanner-breaking gummy bears, view the PDF presentation by Tsutomu Matsumoto at

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.

This was last published in June 2002

Dig Deeper on Network intrusion detection and prevention and malware removal

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.