Hacking Biometrics
Fooling A Fingerprint Scanner 1/3: Using grease stains on the
scanner
Last updated: 18th of March 2003.
The vulnerability was analyzed by: Antti Kaseva Antti
Stén
1. Threat and Vulnerability
Fingerprint recognition is based on the fact that every humanbeing has
a unique pattern of ridges and valleys on their fingertips. A scanner
makes copy of your fingerprint and compares its characteristics to the
ones stored beforehand. These characteristics are measured based on
special points (such as branches and loops) on a print. In figure 1.1 some
of these special points can be seen. The scanner uses these points as
coordinates to define other branches, loops, beginning of lines, number of
lines etc.
The scanner used in this hack stores these characteristic points of the
user's fingerprint on the smart card. The method the scanner uses to to
obtain those points is explained in section 3.
Fig1.1 - Some of the characteristics that are unique for
every fingerprint
The hack itself is to re-use grease stains on the fingerprint scanner
left by the previous user. Typically, a human finger contains so much
grease that it leaves a non-visible mark where it touches and thus usually
leaves a clear mark also on the scanner. This stain can be brought visible
in many ways and even a mere breathing can show the print very clearly.
The used fingerprint scanner is Precise Biometrics 100 SC, which uses a
capasitive measurement to detect finger and has a smart card reader/writer
to store fingerprint info. Though in this hack only biometric aspects are
to be defeated.
This combo of smartcard reader and fingerprint scanner can provide
access to Microsoft Windows NT, 2000 and XP operating systems if account
data is stored onto the smart card. This setting overrides Windows' own
logon screen and user logs into his account using a smart card and a
fingerprint scanner, no passwords are required. Typical hack cases occur
when the legitimate user forgets his card into the reader, somewhere near
it or the intruder steals the card from the user. Most threats in
corporations come from the inside and this attack is most presumably
performed by a fellow co-worker. Hacking thru this device usually gives
all the priviledges for the user to do whatever he wants, read and write
data, send mail etc.
For this hack no specific tools are needed.
Fig 1.1 - Precise Biometrics 100 SC Smart card reader and
fingerprint scanner
2. Preconditions for the attack
For using this kind of vulnerability one needs to have a clear grease
stain left on the surface of the scanner. This stain has to have most of
the important charasteristics of the fingerprint left on the pad so that
the scanner can reliably read the same line-ends and curves that it
detected on the previous user. Also for this specific scanner a smart card
is required (i.e. user forgot it to the scanner).
Requirements:
- Operating system: Microsoft Windows NT, 2000 or XP
- Fingerprint scanner: Precise Biometrics SC100
- Legitimate user's enrolled fingerprint with login information on the
smart card
- Applicable fingerprint stain on the scanner's pad left by the
previous user.
- Temperature between 0-50°C (Scanner operating temperature)
- For the gummy bear attack also a gummy bear or some other jelly
material (i.e flat gelatine square) is needed.
- Some privacy and a lot of perseverance
3. Analysis of the attack
For capasitive scanner the visibility of the fingerprint is not the
case but it helps the intruder to see whether there is a fingerprint stain
on the pad and how usable it is.
Fig3.1 - A fingerprint scanner showing the grease
stain
Method 1: Moist Breath The idea behind this scheme is to
breathe gently on the surface of the scanner and produce substance that
has enough capacitance to fool the scanner. As the small water particles
hit the pad the grease stain left on the surface does not hold them but
the moist gathers up in between the small stained fingerprint lines. This
could be enough so that the scanner can measure the capasitance and
faultily think that there is a finger.
How to hack it:
- Ensure smart card is inserted.
- Wait for login screen to prompt for finger.
- Gently breathe at about 5-10cm distance onto the surface of the pad.
- Try to control the amount of moist by breathing longer or shorter
periods. The device will inform you that your "Finger is too wet" if you
breath too much or too long.
- If you continually get "Finger detection failed!" then it is adviced
to stop trying after about 5-10 tryouts (exact amount is not known) or
you will get the smart card locked and thus increase the risk of getting
caught. Try again after the legitimate user has succesfully logged one
time. This will reset the fault counter.
Method2 : Gummy bear If the breathing does not work a gummy
bear is to be used to represent a finger. This jello candy has nearly the
same capacitance as a finger's skin (~ 20 Mohm/cm) and can be soft enough
to be placed evenly on the pad and still retain the stain in form. This
can also help if the device constantly informs that "Finger is too wet" as
it contains much less water than moist breath.
How to hack it:
- Ensure smart card is inserted.
- Wait for login screen to prompt for finger.
- Gently press the gummibear against the pad. Be careful not to ruin
the stain.
- Try to control the pressure and keep gummibear evenly flat against
the pad.
- If you press too hard you will get "Finger is too wet" error. Too
light and the "finger" wont be detected.
- If you continually get "Finger detection failed!" then it is adviced
to stop trying after about 5-10 tryouts (exact amount is not known) or
you will get the smart card locked and thus increase the risk of getting
caught. Try again after the legitimate user has succesfully logged on
one time. This will reset the fault counter.
Both of these techniques are quite hard to land into a successful hack.
They require very much of skill and training, which makes them obsolete
for a casual hacker. However, if you have access to your own scanner, you
might be able to train yourself into a successful gummy bear
hacker in a matter of just a few years ;)
The scanner used (100 SC) uses a capacitance measurement method. The
pad consists of small measurement units or condensators making up a matrix
at 500dpi. Each unit can measure the capacitance at that point. If
capacitance is high, then at that point there is a ridge, if small, there
is a valley of the fingerprint. There is a certain kind of circuit in the
scanner of which voltage output depends on the capacitance on the scanner
surface. Therefore the voltage in the ridge area is different from that in
the valley area. This way the scanner can obtain an image of the
fingerprint and use a heuristic to solve the characteristics of the
finger.
Detection and tracing
This hack is very difficult to detect. If the intruder does not get
caught redhanded, the only way to detect this kind of attack is to notice
the damage afterwards. The intruder could lurk around the subject with a
bag of gummy bears or rehearse breathing. Tracing is very difficult. If
there was a log-file on the users' log-ins, you might find some
information about the break-in (e.g. the time). Surveillance cameras might
catch the data burglar on tape or some person could just as well see the
man in action. But there are no any "real" ways to track the intruder
down, because the break-in is done on the subject's own computer. The
things used in the break can be disposed easily (thrown in garbage, melted
or even eaten), so even if the burglar is caught there might be no
evidence left.
Protection against the Attack
The best way to protect against this attack is to wipe the scanner
after use. To be overcautious against this attack one needs to keep the
card apart from the scanner when not used. This way the data burglar has
to obtain the smart card and the user must leave a stain on the scanner.
Another way to make things difficult is to use several fingers in the
authentication. This way it is impossible to use one stain on the scanner
to pass two different fingerprint checks.
Modifications to equipment that might help:
- Live finger detection (pulse, sugar level etc.)
- Small flap or cover over the pad that closes and clears the surface
automatically after detection. Or at least scrambles it a bit.
Test results
The test was unsuccessful (security was not compromised)
Despite the furious attempts and hours of work, all that was achieved
was hands full of nothing. The used scanner obviously has a heuristic for
detecting this scheme as it constantly gave "Finger is too wet" error. The
gummy bear technique gave a bit better results as there were also a few
"Finger detection failed" errors. This means that the device was able to
read the "finger" but it was not detected as the original finger
corresponding to the data stored on the smart card.
Overall the test failed as no break-in was achieved and security was
not compromised at any situation. However, the authors still believe, that
with a good stain and a proper material found to resemble the finger, the
gummy bear method might work in trained hands.
Back to index |