Slashdot Mirror
Hackers Make a Fake Hand to Beat Vein Authentication (vice.com)
Devices and security systems are increasingly using biometric authentication to let users in and keep hackers out, be that fingerprint sensors or perhaps the iPhone's FaceID. Another method is so-called 'vein authentication,' which, as the name implies, involves a computer scanning the shape, size, and position of a users' veins under the skin of their hand. But hackers have found a workaround for that, too.
From a report: On Thursday at the annual Chaos Communication Congress hacking conference in Leipzig, Germany, security researchers described how they created a fake hand out of wax to fool a vein sensor. "It makes you feel uneasy that the process is praised as a high-security system and then you modify a camera, take some cheap materials and hack it," Jan Krissler, who goes by the handle starbug, and who researched the vein authentication system along with Julian Albrecht, told Motherboard over email in German. Vein authentication works with systems that compare a user's placement of veins under their skin compared to a copy on record. According to a recent report from German news wire DPA, the BND, Germany's signals intelligence agency, uses vein authentication in its new headquarter building in Berlin.
One attraction of a vein based system over, say, a more traditional fingerprint system is that it may be typically harder for an attacker to learn how a user's veins are positioned under their skin, rather than lifting a fingerprint from a held object or high quality photograph, for example. But with that said, Krissler and Albrecht first took photos of their vein patterns. They used a converted SLR camera with the infrared filter removed; this allowed them to see the pattern of the veins under the skin.
One attraction of a vein based system over, say, a more traditional fingerprint system is that it may be typically harder for an attacker to learn how a user's veins are positioned under their skin, rather than lifting a fingerprint from a held object or high quality photograph, for example. But with that said, Krissler and Albrecht first took photos of their vein patterns. They used a converted SLR camera with the infrared filter removed; this allowed them to see the pattern of the veins under the skin.
it is usually not very hard to copy.
Which idiot decided to use an identification as an authorization. Someone deserves to be beaten to pulp for being so stupid. Identification is not authorization, especially when it cannot determine intent. More specifically whether the person being identified is actively seeking service pr is being presented under duress and external force
I'm sure at the time this seemed like something that would be damn near impossible to spoof, and I can see where the idea was so compelling that it made it all the way into implementation and deployment.
When deployed it was essentially un-spoofable because it was a new kind of "lock"; no one had made a "key" for it because this kind of lock never existed before.
But as soon as the lock (in the form of a vein scanner) appeared, the "getting defeated" part was sure to follow.
I think the surprising part was that it was defeated fairly quickly...I'm sure the people using this thing expected it to be the end-all-be-all of security for the next decade or so.
Just cruising through this digital world at 33 1/3 rpm...
Identification, Authentication, and Authorization are all VERY different things.
Identification = Information about who you are
Authentication = verifying that ID information being provided is correct through a predefined/established process
Authorization = gaining permissions or actual access AFTER authentication has checked out.
bio-metrics foolishly rolls all 3 of those things into ONE and that is just bad security practice and it's not going to likely change. The fact that this is still being pursued and developed in this way is tacit proof that real security is not desired or required. Security Theater once again... wins the day!
And when you're done logging in, you can use the fake hand to give yourself a stranger. What's not to love eh?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
The utter stupidity of the idiots who still think biometrics are a good idea in the face of all the evidence to the contrary simply doesn't count. Because tt was hackers, that hacked, with hacks! You really can't begin to defend against hackers, hacking, with hacks. Because they're hackers, and they do hacking, with hacks! Everyone knows this!
Well, at least msmash cherry-picks the "news" to look like that.
If I made a fake hand, I'd use it to beat something else.
Some eggs, for instance.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
The difference is that these wonderful biometrics allow you to enjoy ADA lawsuits from people whose hands were amputated, or never grew due to a birth defect. (For retinal scanners, likewise with people whose eyes have been poked out.)
This space intentionally left blank
This is not anything fantastic. It is no great feat to make a fake "hand" to fool a deep-vein-palm-scanner. It changes nothing.
Fingerprints- you leave them everywhere.
DNA- you leave it everywhere.
Face- you show it everywhere.
Iris- visible when look at any device.
Hand/finger shape- not live, visible in any photo.
The whole point of deep vein scan is that what is being scanned is never left anywhere (latent) and not casually visible or obtainable. The veins are beneath the skin in the palm, in an area rarely exposed "outward" and can be seen only in infrared at very close range. When you "enroll", you know you are doing so and typically have to be an active participant. Combined with a password, something you "know", not "are", it is perhaps the most secure in-use thing out there while also being the most private, and actually very cheap to implement, and still fast enough for real-time use (those last qualifications throwing out things like retina, which is typically expensive, complex, and slow).
Meanwhile, fingerprint and faceID systems continue to erode privacy and diminish actual security. DNA, when it eventually comes, well.... go watch the old film GATTACA.
And when you're done logging in, you can use the fake hand to give yourself a stranger. What's not to love eh?
It's a wax hand, not a whacks hand. Save your joke for when they start using this technique with video instead of still images, and it's necessary to make a silicone (or similar) hand so that it can be equipped with a pulse.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Biometrics is turning into the ligne Maginot of the IT world, a fixed defense that someone, somewhere will always find a way around.
in places that matter a human guard sits behind glass and knows all the staff allowed into an area.
Biometric authentication gets you part way in.
Domestic spying is now "Benign Information Gathering"
As usual for high tech, sex applications lead the way with fake body parts with accurate veining.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.