Police 3D-Printed A Murder Victim's Finger To Unlock His Phone (theverge.com)

An anonymous reader quotes a report from The Verge: Police in Michigan have a new tool for unlocking phones: 3D printing. According to a new report from Flash Forward creator Rose Eveleth, law enforcement officers approached professors at the University of Michigan earlier this year to reproduce a murder victim's fingerprint from a prerecorded scan. Once created, the 3D model would be used to create a false fingerprint, which could be used to unlock the phone. Because the investigation is ongoing, details are limited, and it's unclear whether the technique will be successful. Still, it's similar to techniques researchers have used in the past to re-create working fingerprint molds from scanned images, often in coordination with law enforcement. This may be the first confirmed case of police using the technique to unlock a phone in an active investigation. Apple has recently changed the way iOS manages fingerprint logins. You are now required to input an additional passcode if your phone hasn't been touched for eight hours and the passcode hasn't been entered in the past six days.

Comments

So...

[DougOtto]

The scientists are giving them the finger?

Re:So...

[Wycliffe]

It's a cool use of 3D Printing; but couldn't just putting the victim's finger on the phone work?

If you would have read the article, it states that the body was too decayed. Another possibly scenario would be where the body hasn't been found yet and they find the phone in the victim's apartment, along side the road, etc... There are plenty of situations where you might have a prerecorded fingerprint but not a body.

Oh, and call me cynical but my guess is that one of the reasons it's being tried in this case is to set a precedence in a "safe" case so they can later use it against living people with a search warrant.

So much for biometrics being more "Secure"

[PinkyGigglebrain]

How long till they use 3D printing or such to replicate someones face or retina scan?

One more reason for me to never use or trust bio-metric authentication.

And now I have something I can point to and say "See?" when someone tries to convince me how great Bio-metrics are.

Re:So much for biometrics being more "Secure"

[JustAnotherOldGuy]

The only biometric signature hardware that I've seen that I would consider seriously difficult to spoof would be the deep-vein reader:

http://www.fujitsu.com/us/solu...
http://www.m2sys.com/palm-vein...

They use "Palm Vein Authentication" and this seems like it would be really, really tough to trick. I think it would be very hard to recreate the sensor signature, probably harder than a retinal scan.

Re:So much for biometrics being more "Secure"

[Aighearach]

The good news is that this might mean it is better for the thieves to just scan your finger, instead of needing to cut it off. They'll get one that doesn't need refrigeration that way. Unfortunately, this can only be done with fancy custom academic prototype 3d printing, not off-the-shelf models, so for now the answer for thieves of biometric-protected items is still to cut the finger off and apply an electric current.

My solution is simpler: I don't put anything on a mobile device that needs strong protection. Just because it is possible to bank from a phone app doesn't automatically mean there is a great use case for it. Internet banking from a physically secure desktop computer seems like a much better setup to me. But I've had that since the 90s.

If I really, really wanted to check my balance from my phone, I could actually just call the 800-number and have a computer read it to me. And it is much safer, because I can't do transactions that way; only check the balance.

Here's the interesting part...

[Frosty Piss]

Here's the interesting part...

A 3D printed finger alone often canâ(TM)t unlock a phone these days. Most fingerprint readers used on phones are capacitive, which means they rely on the closing of tiny electrical circuits to work. The ridges of your fingers cause some of these circuits to come in contact with each other, generating an image of the fingerprint. Skin is conductive enough to close these circuits, but the normal 3D printing plastic isnâ(TM)t, so Arora coated the 3D printed fingers in a thin layer of metallic particles so that the fingerprint scanner can read them.

Way to shoot yourself in the foot, LEOs

[Anonymous Coward]

This is a logical enough move, though I'm pretty sure you can do it without an actual 3d printer. We already know that fingerprints can be duplicated with very little effort indeed. But the problem for our esteemed LEO bunch here is that LEOs are now admitting this reality. And that brings up important sticky sticking points.

For, if they start to routinely duplicate fingerprints, what value do fingerprints found on the scene retain?

Also, now it turns out they're sitting on gigantic databases of other people's access keys, in the form of earlier taken fingerprints. You can trust them with that, can't you? They're totally trustable, right?

Re:Way to shoot yourself in the foot, LEOs

[Aighearach]

Also, now it turns out they're sitting on gigantic databases of other people's access keys, in the form of earlier taken fingerprints. You can trust them with that, can't you? They're totally trustable, right?

That's the real kicker. They don't even need a new scan. Even if you're not paranoid about the police directly, the identity thieves have already proven that they have an easy time planting people on the inside of government agencies that have access to identity data, like the DMV. And the amount of drugs that are smuggled into prisons shows that criminal elements have fully penetrated the prison guards. So there is already black market access to this information. You can't just avoid new scans to avoid it.

It isn't viable to protect the secrecy of your fingerprints, so it isn't viable as an authentication mechanism. The main thing you can do to protect yourself is not to rely on authentication mechanisms; don't think that putting your fingerprint into your phone lock screen means that it is safe to store secrets (like banking access) on a phone. Don't think that having a fingerprint scanner on a door means that nefarious persons can't enter through that door. Don't think that a fingerprint scanner on a car ignition will keep thieves from driving away in it. Etc.

So even without the conductive layer . . .

[mmell]

the police can put my fingerprint anywhere they want? Conceivably to be "found" later on and used as evidence against me?

Prosecutor: "Can you explain how your fingerprints came to be on the murder weapon?"

Defendant: "I don't know. I never touched it. Never seen it before. Maybe the police put it there? Since we know they can, experience has shown that they will."

Technically legal

[WillAffleckUW]

Live people have far more privacy protections than dead people do.

usual police incompetence

[ooloorie]

You don't need to 3D print a finger to fabricate a fingerprint, a simple laser printer is enough:

http://www.instructables.com/i...

Original gummy fingerprint tests beat most scanner

[Antique Geekmeister]

The original presentation on beating fingerprint sensors with ordinary laser printer printed copies of fingerprinters, laid on gelatin, published in 2002, is available at:

              http://web.mit.edu/6.857/OldSt...

It's quite a good presentation, and was verified by MythBusters in 2011.

              https://www.youtube.com/watch?...

Mythbusters even demonstrated that simply printing a fingerprint on paper, and _licking the paper_, created a fake fingerprint good enough to defeat most sensors. There's little reason to think that the commercial fingerprint sensors have gotten any better, though I'd welcome a modern retest with modern cell phone and computer keyboard based sensors.

Basically, the "fuzziness" of fingerprint sensors which allows to identify real fingers with real sensors is enough "fuziiness" to allow them to be beaten with even casually made fake fingerprints. I've seen no good evidence that the necessarysensor and computational "fuzziness" has ever been worked around with even the most expensive modern sensors: I'd welcome any evidence with honestly done tests showing otherwise.