Slashdot Mirror
Fake Fingerprints Can Imitate Real Ones In Biometric Systems, Research Shows (theguardian.com)
schwit1 shares a report: Researchers have used a neural network to generate artificial fingerprints that work as a "master key" for biometric identification systems and prove fake fingerprints can be created. According to a paper [PDF] presented at a security conference in Los Angeles, the artificially generated fingerprints, dubbed "DeepMasterPrints" by the researchers from New York University, were able to imitate more than one in five fingerprints in a biometric system that should only have an error rate of one in a thousand.
The researchers, led by NYU's Philip Bontrager, say that "the underlying method is likely to have broad applications in fingerprint security as well as fingerprint synthesis." As with much security research, demonstrating flaws in existing authentication systems is considered to be an important part of developing more secure replacements in the future. In order to work, the DeepMasterPrints take advantage of two properties of fingerprint-based authentication systems. The first is that, for ergonomic reasons, most fingerprint readers do not read the entire finger at once, instead imaging whichever part of the finger touches the scanner.
The researchers, led by NYU's Philip Bontrager, say that "the underlying method is likely to have broad applications in fingerprint security as well as fingerprint synthesis." As with much security research, demonstrating flaws in existing authentication systems is considered to be an important part of developing more secure replacements in the future. In order to work, the DeepMasterPrints take advantage of two properties of fingerprint-based authentication systems. The first is that, for ergonomic reasons, most fingerprint readers do not read the entire finger at once, instead imaging whichever part of the finger touches the scanner.
Can't change them. Can't revoke them. You leave a copy of them around on everything you touch. Why do people still use these for identification?
James Bond
Myth Busters...
It's been done. Finger print scanners are NOT secure.
Having said that, I too have developed a "don't give a fuck attitude" towards the insecurity. It's just too convenient to touch my PC or phone and have it unlock.
I use it. I know it's wrong, but...
I'm sure some governments have known this for awhile. I wonder how many people have been framed? And how would you ever prove your innocence?
I have similar worries in regard to the proliferation of 'deep fakes' and other methods of realistic video editing that is indistinguishable from original recordings.
I imagine we will deal with these issues to the best of our ability as time goes on, but "Damn future, you scary!"
They did demonstrate that it isn't particularly hard to fool simple fingerprint scanners. I mean, they used a simple photocopy of a fingerprint. Granted, those were fairly simple scanners, but it isn't too hard to imagine similar techniques working with more advanced scanners. I've also seen some presentations by physical penetration testers that were able to lift fingerprints and fool fingerprint locks, though they often simply bypassed the reader altogether.
If it works in theory, try something else in practice.
It may also be worth noting that today's cameras have enough resolution to reveal your fingerprints when you flash a peace sign in a photo, for example.
A silicone molding works on TouchID and I assume other capacitive scanners. It might also be possible to lift a print off a shiny surface with a bit more luck/skill/equipment too: https://youtu.be/2u4ZLGsw1zo?t...
Maybe the Orange Dude is right: everything is becoming fake, rigged, and/or bugged.
He's not paranoid, he's a profi...prophet.
Table-ized A.I.
What the hell was wrong with "common sense shows"? It's a hell of a lot cheaper.
Also interesting, the most expensive one tested was the easiest to fool.
Why did this need to be researched? We've known about this as long as we've had the technology.
This signature has Super Cow Powers
The mythbusters demonstrated copying a fingerprint known to be accepted by the scanner. This is a skeleton key created fingerprint that has about a 20% chance of working even if you don't have a fingerprint to copy.
Oh, wait, it already is.
Look, the main problem is one of tuning. Fingerprints are just 3D printed objects, and many scanners aren't that bright. In the old days we could just do a ridge pattern on plastic to throw them, now we have to emulate the ridges for the fancier detection devices. Still takes us less than 60 seconds, of course.
-- Tigger warning: This post may contain tiggers! --
>"Fake Fingerprints Can Imitate Real Ones In Biometric Systems, Research Shows"
Which is one of MANY reasons why fingerprints should not be used for "real" security- it isn't really secure.
Further, using fingerprints (or worse, DNA) and allowing a third-party to have access to that data is unacceptable. Not only because the government and big business should have no need to indiscriminately track what people are doing all the time but because they should not have fingerprint registration data (which will be horribly abused) .
Stand up for your rights (and the rights of your children and future generations). Once you give this data to the government or big business, it will NEVER be erased or restricted, regardless of claims, policies, or laws- it will go into huge databases and shared between agencies and used however they want for as long as they want. Even worse, with every crime investigation, you will be searched without probable cause. It is a genie that can't be put back into the bottle.
Fingerprints are something you leave all over the place all the time. They are easy to lift, copy, and forge. Easy to fake, easy to use to frame people. Time after time they have been shown to be poor for security and yet very effective at tracking people.
DNA is even worse. Like fingerprints, you leave it all over the place all the time. Samples can be lifted and planted and analyzed. DNA is more than a means to ID, it contains very sensitive information about you.
Iris scan is better than DNS or fingerprints- there is no leaving your iris image all over, and it doesn't say that much about you. But your eyes (iris, not retinal) could be scanned without your permission by any high resolution camera pointed at your face, even your own phone.
There is only one safer and practical biometric I know of right now- that is deep vein palm scan. That registration data cannot be readily abused. It can't be latently collected like DNA, fingerprints, and face recognition can. You have
to know you are registering/enrolling when it happens. You don't leave evidence of it all over the place. When you go to use it, you know you are using it every time. And on top of all that, it is accurate, fast, reliable, unchanging, live-sensing, and cheap. If you must participate in a biometric, this is the one you should insist on using.
Example/info: http://www.m2sys.com/palm-vein... https://www.imprivata.com/why-...
Now, it might not be suitable for phones, but for anything else that requires real security (and privacy as a major bonus), I think deep vein palm scan is a great idea.
The fundamental issue with biometrics is that people tend to think they represent a kind of security token (an idea actually pushed by greedy companies whose only goal is to sell you more of their useless stuff under the umbrella of "innovation").
It is clearly not ! This is simply an easier/convenient way to identify yourself, the equivalent of your good old login name. Full stop. any attempt to use biometrics beyond this point is just utterly stupid.