Biometrics are rapidly becoming a popular means for adding security factors to user authentication. However, many biometric scanning systems are not as foolproof and reliable as you might think. You've seen movies demonstrate numerous means by which fingerprint scanners can be bypassed, from latex gloves with fake imprints to fingerprint-projecting LCD panels -- not to mention using someone's chopped-off finger as a portable verification key. These fantastic measures are not far from reality. Japanese mathematician Tsutomu Matsumoto has demonstrated several methods for creating fake fingers that fool fingerprint scanners four out of five times.
The fake fingers are crafted from common kitchen supplies, primarily gelatin. The use of gelatin requires that a finger be pressed into the goo to create a mold. Another method lifts fingerprints from surfaces such as glass and countertops. Through an ingenious process, the print is enhanced with super-glue fumes and photographed with a digital camera. Hackers digitally increase the contrast, print it onto transparent sheets and etch the print onto copper using a photo-sensitive printed circuit board (an item found at most electronic supply and hobby shops). The copper-print is then used to create a gelatin fingertip.
A range of biometric fingerprint scanners from several companies were tested against these gelatin fingers; all consistently failed to reject the imposter finger.
The gelatin fingers were little more than thin sheaves slipped over the tip of the finger. Thus, the gelatin fingers even defeated devices that tested for human-normal capacitance, heat and pulse.
To read how to create your own fingerprint-scanner-breaking gummy bears, view the PDF presentation by Tsutomu Matsumoto at http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf.
About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.
