Slashdot Mirror
Samsung's Galaxy S10 Fingerprint Sensor Fooled By 3D Printer (theverge.com)
A Samsung Galaxy S10 user has managed to fool the in-display fingerprint reader on his smartphone using a 3D print of his fingerprint. The Verge reports: In a post on Imgur, user darkshark outlined his project: he took a picture of his fingerprint on a wineglass, processed it in Photoshop, and made a model using 3ds Max that allowed him to extrude the lines in the picture into a 3D version. After a 13-minute print (and three attempts with some tweaks), he was able to print out a version of his fingerprint that fooled the phone's sensor.
The Galaxy S10's fingerprint sensor doesn't rely on a capacitive fingerprint scanner that's been used in other versions of the phone, using instead an ultrasonic sensor that's apparently more difficult to spoof. darkshark points out that it didn't take much to spoof his own fingerprint. A concern, he notes, is that payment and banking apps are increasingly using the authentication from a fingerprint sensor to unlock, and all he needed to get into his phone was a photograph, some software, and access to a 3D printer. "I can do this entire process in less than 3 minutes and remotely start the 3d print so that it's done by the time I get to it," he writes.
The Galaxy S10's fingerprint sensor doesn't rely on a capacitive fingerprint scanner that's been used in other versions of the phone, using instead an ultrasonic sensor that's apparently more difficult to spoof. darkshark points out that it didn't take much to spoof his own fingerprint. A concern, he notes, is that payment and banking apps are increasingly using the authentication from a fingerprint sensor to unlock, and all he needed to get into his phone was a photograph, some software, and access to a 3D printer. "I can do this entire process in less than 3 minutes and remotely start the 3d print so that it's done by the time I get to it," he writes.
this guy unlocked an S10 with the video of himself on another phone
https://www.youtube.com/watch?...
Politics is Treachery, Religion is Brainwashing
instantly opens up access to 2FA, and draining all your savings and retirement accounts while you are worried about your lost phone
Any key and lock can be broken. All any lock does is keep most of the people out most of the time. It's a first level of security that is perfectly adequate for most people. It's not like my Samsung contains nuclear launch codes. In fact, it contains nothing at all very useful, even to me. I'm not too concerned that someone with a 3D printer will take the trouble to find my fingerprint (1 in 10 chance there, buddy) and do the necessary transformations to be able to unlock my phone for no good reason. That's a whole lot of work for nothing gained.
How about a moderation of -1 pedantic.
He fooled a fingerprint reader using... an exact reproduction of his fingerprint. On the fourth try.
That seems incredibly unsurprising.
When I'm someday a reclusive billionaire, someone will do this by extracting my fingerprints from doorknobs with tape. It's just a matter of time and lottery tickets.
Gently reply
So, since it doesn't care if the finger is live or dead unlike the newer fingerprint readers, wouldn't it be quicker & easier to just cut off the owner's finger like we used to?
Too bad it wasn't using biometrics like old so-called "fingerprint" scanners do. They say "fingerprint" but what they really meant was "biometrics" including electrical measurements, not the actual, physical fingerprint.
Using the measurements, like oxygen saturation (which the phones have been doing for over a decade) in addition to the fingerprint were the right idea then.
Kriston
Not exact, only plastic ridges made from a wine glass fingerprint. The point being that the previous generation of readers rejected this attack, and you'd have to fake finger capacitance too. So this is a step backwards.
Do you think a security system should get *BETTER* with new generations or *WORSE* with new generations?
The surprise here is that its worse.
Buy a Galaxy S10, pay 5 times the price and it worse worse than a Galaxy A30 with the capacitive fingerprint reader simply to move the fingerprint reader from the back to under the front. SURPRISE!
When I'm someday a reclusive billionaire, someone will do this by extracting my fingerprints from doorknobs with tape
Or they will find a way to steal fingerprint info from a database. With more applications using fingerprints, it is unavoidable that your fingerprint info will be stored in multiple locations, and it is a single breach away from ending up in the wild. For eternity.
Once someone has a 3D model of your finger, I wouldn't count on oxygen saturation or impedance to save your ass. I'm sure that clever hackers can figure out a way to fool those too.
...if you hack the login autentication method, the device self-destroys.
They're the ones who manufactured and sold this broken piece of tech. But of course American tech media is reluctant to mention that.
Fuck all you media fucks!
The headline should be. Fingerprint scanner unlocked with replica of users finger.
This is not even news worthy. It is click bait sensationalism at it's finest.
Shut the fuck up.
You can fool any phone's fingerprint sensor with a simple rip of a fingerprint. So what would be so special about this one?
This isn't anything special, except the media needing some nice story which seems sensational, even though it isn't.
So nothing to see we already didn't know.. And I'm pretty sure it didn't take him 3 minutes to do it.