Slashdot Mirror
Fingerprint-Protected Phones Vulnerable To Inkjet Attack (softpedia.com)
An anonymous reader writes: Two researchers have come up with a new method of hacking smartphones that use fingerprint biometrics to protect and lock the user's data. Their method only needs a regular inkjet printer, three AgIC silver conductive ink cartridges, a normal black ink cartridge, and special AgIC paper. The entire attack takes no more than 15 minutes. Current tests only included a Samsung Galaxy S6 and a Huawei Hornor 7. The researchers said that while the Samsung was easy to crack, the Huawei phone needed more tries.
We keep seeing this over and over again with bio-metric "security". Bio-metrics are not passwords, and should never have been considered as passwords. Bio-metrics are USER ID's, nothing more. They only identify individual users, they do not authenticate them.
Clearly their tests didn't work against the industry standard-bearer for biometric login, or their title would be different. So has anyone done work on this since the CCC show an expensive, detailed attack?
Make sure everyone's vote counts: Verified Voting
That it's that long and complicated. Honestly, for once, I expected it to be something pathetic and overly simple, like what they do on TV.
Either way, I do not look forward to people taking a finger or an eyeball when they mug you from now on...
And? Mother's maiden name falls under one of those categories too, but that doesn't mean either is a good authentication factor.
As TFA says, the Iphone sensor was already hacked by the CCC. I don't see why the new simpler method shouldn't also work on Iphones.
Or they could be a fan boy like the parent post and not try lol
Why do atheists have funerals?
Why do worshippers of atheism get dressed up in suits, dress up the CORPSE ITSELF in a suit, hold moments of silence/reflection, all in a formal ceremony for what the atheist religion dictates is nothing more than decomposing matter? Theists' belief of man's transcendent worth answers why they do.
What is the atheists' answer?
The "incredible" iPhone was already hacked by the CCC just a few hours it was released.... so puff goes the theory of iPhone's invincibility
Go away!
Both the iPhone 5c and iPhone 6: https://www.youtube.com/watch?...
Here's another video showing how easy the iPhone can be unlocked by a spoof: https://www.youtube.com/watch?...
So, why bother with this inkjet setup? it seems complicated compared to just using glue or what appears to be tape.
Please learn how to read.
I'm too sleepy to find ouzzzzzzzzzz
And then they died.
Finally!
Like having to watch dementia take a loved one, that Mythbusters show was for many years now.
The German CCC (Chaos Computer Club) did this already 2004 and went on to "publish" the finger print[sorry, in German only] of the then German minister of the interior tele-photoed of a glas used during a press conference.
So what is new now? Using a 3D printer instead of a laser printer?
I'll use my genital warts pattern for authentication from now on.
To the original posters comments, the iPhone 5S was compromised using an entirely different technique. This fact is mentioned in TFA. The question was whether the iPhone's sensor was susceptible to this new attack. That question was not answered in TFA and Apple haters took it as reason to attack rather than think about formulating an actual, rational, answer to the question posed.
"And? Mother's maiden name falls under one of those categories too, but that doesn't mean either is a good authentication factor."
Not everybody has one of those. I'm from Luxembourg and we have the french system.
"Since the 1789 Revolution, the law stipulates that "no one may use another name than that given on his birth certificate"
Finally, ther is something inkjet printers are useful for!
How many of those fingerprints wind up in a government data base.
"If any question why we died, Tell them because our fathers lied."
Wrong, repeat wrong again. Fanboys should ask, if the sensor is different. Did Apple change to a different type, of fingerprint sensor? Different algorithms for the device? Or just left it alone?
The next release (of the phone) will fix this.
Today's consumer biometrics really are a lot like PIN numbers or physical keys made of brass. If a particular scanner has a one-in-million chance of a false match, that means that hundreds of people in the US will have the same type of fingerprint, within the ability of the system to classify them. That is, one scan of my finger is unlikely to "match" a scan of YOUR finger, but it's very likely to match the scan of SOMEONE'S finger. Much like some people will use the same PIN number on their debit card, but it's unlikely that you specifically use the same PIN that I use.
They therefore do NOT identify one user out of millions. Physical keys, like you use on your front door, are similar- the #1 manufacturer, Kwikset, only makes about 20,000 different keys. A locksmith can pick a lock in seconds or minutes. Yet that's good enough for the vast majority of security needs.
Like PIN numbers, current consumer biometrics are good in either of two roles:
Weak authentication, like a signature or PIN, or physical key). For most things in my life, I'm not worried about the NSA. A four-digit number, Kwikset key, or cheap fingerprint scanner is sufficient to secure my kid's locker at school, or keep the kid out of the chemicals cabinet in the garage. It's fine for securing my fireworks box because someone could just BUY $500 worth of fireworks. My security just needs to encourage people to buy their own rather than taking mine.
Multi-factor authentication. If you have my key fob in your pocket, AND pass fingerprint authentication, you can take my car. You can spend money from my bank account of you know my (strong) password AND pass fingerprint auth AND don't trigger the bank's fraud detection algorithms.
Fingerprint scanners have long been proven vulnerable to the most elementary of attacks. There is a stack of references to gelatin based fingerprint replication, including http://www.theregister.co.uk/2... And MythBusters did a very useful comparison of the most robust and expensive fingerprint scanners at https://www.youtube.com/watch?... .
so those phones the FBI has could be opened this easily?
Two New York State police from Troop C (Binghamton) were convicted and jailed for spoofing fingerprints (and possibly other physical evidence) about 20-30 years ago. IIRC, they used scotch tape to lift the print of the innocent person they wanted to frame and then deposited the print on the piece of evidence connected to the crime.
So, even w/o using computers, fingerprints can be faked. Physical evidence is not as solid as prosecutors claim, but we already knew that from several other convictions for faking evidence. However NYS troopers are, as a group, ethical.
But, fingerprint readers do look cool.
For? Or are you in violation of the law Mr. " nospam007"?
...in an inkjet instead of a laser printer.
Presumably, as it is not stated in the paper as an issue per se, this method should get around safeguards intended to prevent using printouts - by requiring the fingerprint to be conductive to electricity.
Which would probably work with a wet printout as well.
Mit der Dummheit kämpfen Götter selbst vergebens
Those would be valid follow up questions. It has nothing to do with fanboy-ism. The first question is still germane as it answers whether there is a fundamental difference in the sensors. The new technique is faster to perform than the one used to compromise the iPhone's sensor.