Spoofing fingerprint scanners  - NEWBIE()

Spoofing fingerprint scanners - NEWBIE()

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Spoofing fingerprint scanners - NEWBIE() shamilton72 05-01-2006
Posted by Juergen Nieveler on May 1, 2006, 2:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
shamilton72@hotmail.co.uk wrote:

> I was wondering if it is possible to spoof a fingerprint scanner, I am
> particularly referring to the relatively cheap ones that you can get on
> a computer mouse.

Depends a lot on the exact model and type used. For example, the
optical ones (that mainly consist of a camera that takes a picture of
your finger) are easier to spoof than the capacitive ones where you put
your finger on a metal plate. In both cases, though, you could try
fooling the scanner by making it think there's something to scan but
really just detect the fingerprint of the last person who touched it.
IIRC one way to do that is to put a jellybaby on the sensor :-)

AFAIK the hardest ones to fool are the ones where you swipe your finger
across - the swiping eradicates the remains of your fingerprint on the
sensor.

Here's a good example on how to recreate fingerprints of others (only
in German, unfortunately, but the pictures should explain it pretty
well): http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml

Juergen Nieveler
--
When someone decides to require Ceridian then by definition the FAA will
disolve Oklahoma city.

Posted by none on May 1, 2006, 2:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
shamilton72@hotmail.co.uk wrote:
> Hi,
>
> I was wondering if it is possible to spoof a fingerprint scanner, I am
> particularly referring to the relatively cheap ones that you can get on
> a computer mouse.
>
> For a relatively cheap implementation of this system in order to log
> onto a PC using a normal login ID and your scanned print, is there a
> standard for how much data is required for each scanned print and in an
> organisation of say 5,000 would the search be virtually instenteanous?
>
> I would have thought fingerprint scanners built into computer mice
> would be susceptible to dust and scratches (I'm thinking of a place
> like a university where PC's have multiple users).
>
> Any advice would be greatly appreciated.
>
> Regards,
>
> Sarah Hamilton.
>
Trivial to do .. I seem to remember that it can be done using only stuff
you can buy at your local grocery store. Given that the fingerprint that
you want to spoof is likely to be on the reader from when the legitimate
user touched, this is no security at all.
With some cheap fingerprint readers, breathing lightly onto the reader,
to reactivate the latent print, is enough. Only slightly harder is the
manufacture of a gelatin reproduction ... do a google search for "gummy
finger".

Posted by Volker Birk on May 2, 2006, 3:31 am
If you were  Registered and logged in, you could reply and use other advanced thread options
shamilton72@hotmail.co.uk wrote:
> I was wondering if it is possible to spoof a fingerprint scanner, I am
> particularly referring to the relatively cheap ones that you can get on
> a computer mouse.

You can spoof most of the more expensive ones, too. Many of them
with a gummibear. A short introduction into a more professional method
you can find here:

http://www.ccc.de/biometrie/fingerabdruck_kopieren.xml?language=en

Yours,
VB.
--
At first there was the word. And the word was Content-type: text/plain

Similar ThreadsPosted
registry keys for virus scanners February 3, 2005, 2:59 pm
Using multiple virus scanners on the same system? November 22, 2008, 7:22 am
Biometric fingerprint door locks here September 25, 2006, 10:28 pm
fingerprint scan : roll to dab (flat) image May 27, 2007, 12:48 pm
Defending ARP Spoofing November 6, 2005, 9:10 pm
TCP Spoofing Details January 4, 2006, 12:19 pm
Tunneling newbie? February 21, 2005, 8:52 pm
Newbie... need basics August 10, 2006, 8:01 pm
NAT routers - is IP spoofing a risk? November 20, 2005, 9:38 am
ARP spoofing detection tool XArp 2 July 26, 2006, 2:37 pm

The site map in XML format XML site map

Contact Us | Privacy Policy