Spoofing fingerprint scanners  - NEWBIE()

Spoofing fingerprint scanners - NEWBIE()

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Spoofing fingerprint scanners - NEWBIE() shamilton72 05-01-2006
Posted by on May 1, 2006, 1:57 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

I was wondering if it is possible to spoof a fingerprint scanner, I am
particularly referring to the relatively cheap ones that you can get on
a computer mouse.

For a relatively cheap implementation of this system in order to log
onto a PC using a normal login ID and your scanned print, is there a
standard for how much data is required for each scanned print and in an
organisation of say 5,000 would the search be virtually instenteanous?

I would have thought fingerprint scanners built into computer mice
would be susceptible to dust and scratches (I'm thinking of a place
like a university where PC's have multiple users).

Any advice would be greatly appreciated.

Regards,

Sarah Hamilton.


Posted by Sebastian Gottschalk on May 1, 2006, 2:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
shamilton72@hotmail.co.uk wrote:

> I was wondering if it is possible to spoof a fingerprint scanner, I am
> particularly referring to the relatively cheap ones that you can get on
> a computer mouse.
>
> For a relatively cheap implementation of this system in order to log
> onto a PC using a normal login ID and your scanned print, is there a
> standard for how much data is required for each scanned print and in an
> organisation of say 5,000 would the search be virtually instenteanous?

A simple fingerprint extracted from a coffee cup is sufficient. For
cheap systems no don't even need to take care for wetness and aliveness
checks.

> I would have thought fingerprint scanners built into computer mice
> would be susceptible to dust and scratches (I'm thinking of a place
> like a university where PC's have multiple users).

You just need about 10 curve data samples to get pretty unique fingerprints.

> Any advice would be greatly appreciated.

You're leaving your fingerprint on about a thousand objects per day.
Very bad idea to use it as authentication.

Posted by Todd H. on May 1, 2006, 2:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> You're leaving your fingerprint on about a thousand objects per day.
> Very bad idea to use it as authentication.

As sole authentication, I agree.

As one factor of two factor authentication, it sure beats a poke in
the eye.

Swipe style scanners are marginally more secure than simple imagers
where you leave a nice handy latent fingerprint on em. These are
included in certain IBM/Lenovo thinkpads.


--
Todd H.
http://www.toddh.net/

Posted by Sebastian Gottschalk on May 1, 2006, 2:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Todd H. wrote:
>
>> You're leaving your fingerprint on about a thousand objects per day.
>> Very bad idea to use it as authentication.
>
> As sole authentication, I agree.
>
> As one factor of two factor authentication, it sure beats a poke in
> the eye.

Not actually. It's neither a reliable or efficient improvement over one
factor authentication and clearly doesn't reach two factor ~. Especially
due to error rates.

But "eye" is a good keyword. Iris scanning actually fulfills the
"something you are" factor mantra.

Posted by Juergen Nieveler on May 1, 2006, 2:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> But "eye" is a good keyword. Iris scanning actually fulfills the
> "something you are" factor mantra.

...but at least some implementations are easily fooled by a colour
printout of an iris :-)

Juergen Nieveler
--
When someone decides to require Ceridian then by definition the FAA will
disolve Oklahoma city.

Similar ThreadsPosted
registry keys for virus scanners February 3, 2005, 2:59 pm
Using multiple virus scanners on the same system? November 22, 2008, 7:22 am
Biometric fingerprint door locks here September 25, 2006, 10:28 pm
fingerprint scan : roll to dab (flat) image May 27, 2007, 12:48 pm
Defending ARP Spoofing November 6, 2005, 9:10 pm
TCP Spoofing Details January 4, 2006, 12:19 pm
Tunneling newbie? February 21, 2005, 8:52 pm
Newbie... need basics August 10, 2006, 8:01 pm
NAT routers - is IP spoofing a risk? November 20, 2005, 9:38 am
ARP spoofing detection tool XArp 2 July 26, 2006, 2:37 pm

The site map in XML format XML site map

Contact Us | Privacy Policy