You can now unlock fingerprint protected phones with a printer

Summary

This blog post, "You can now unlock fingerprint protected phones with a printer", is a blueAPACHE article from 2016 covering security. Two researchers at Michigan State University have come up with a new method of hacking devices that use fingerprint biometrics to protect and lock the user’s data. Kai Cao and Anil K. Jain from the Department of Computer Science and Engineering have proven you can spoof fingerprints using a regular inkjet printer, three AgIC silver conductive ink cartridges, a normal black ink cartridge, and AgIC paper. It is written for readers evaluating emPOWER Core Network & DC Interconnect, emPOWER Security. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

Two researchers at Michigan State University have come up with a new method of hacking devices that use fingerprint biometrics to protect and lock the user’s data. Kai Cao and Anil K. Jain from the Department of Computer Science and Engineering have proven you can spoof fingerprints using a regular inkjet printer, three AgIC silver conductive ink cartridges, a normal black ink cartridge, and AgIC paper. The equipment required costs less than $500 – making it very accessible. Coupled with how easy it is to do, fingerprint hacking is now a dangerous reality. You can obtain a fingerprint – even from the stolen phone itself – scan it at 300 dpi and then print it on AgIC paper. Simply placing the printed fingerprint over the phone’s scanning sensor unlocks the phone and grants full access to the device and data. This process has been successfully tested on Samsung Galaxy S6 and a Huawei Honor 7. The Samsung was easy to crack, the Huawei phone needed more tries. The video below highlights how simple it is. The time required? Less than 15 minutes – about the same as it takes to head around the corner and grab a coffee, or the time it takes to realise you left your phone at the coffee shop. Fingerprints and biometrics are growing in popularity for everything from phones to home security. The research highlights how unsafe this authentication method is, and why organisations need to be investing in other control methods. If a device is misplaced or stolen (or does not have privileges correctly rescinded upon separation), the data and network access from the device pose a serious risk when fingerprint spoofing is so simple. But not all is gloom and doom – Mobile Device Management (MDM) software is readily available and easily deployed. MDM solutions like Citrix XenMobile and VMware AirWatch allow organisations to silo and encrypt content on devices, and remotely nuke the content should the device fall into the wrong hands or be misplaced. There are also file sharing and distribution tools like Citrix ShareFile that extends on traditional sharing by adding encryption and file expiration – enabling confidential or high value documents to be distributed securely. ShareFile (and all files) can also be remotely deleted should the need arise. If you’re not using MDM to remotely control and protect devices, new fingerprint spoofing methods like this should be concerning. All it takes is a single employee to be targeted, fifteen minutes and less than $500 of equipment. For more information on the new spoofing technique, you can directly access the research paper (PDF document) here. For information on better securing devices through Citrix XenMobile, VMware AirWatch and Citrix ShareFile, contact the blueAPACHE account team.

Related

• emPOWER Core Network & DC Interconnect
• emPOWER Connectivity (pillar hub)
• emPOWER Security
• emPOWER Security (pillar hub)

Frequently asked questions

Who conducted the fingerprint-spoofing research the article describes, and where?

The article names Kai Cao and Anil K. Jain from the Department of Computer Science and Engineering at Michigan State University as the researchers who developed the spoofing method. Their work demonstrated a new way of defeating fingerprint biometrics used to protect and lock a device's data.

What specific materials does the article say were used to spoof a fingerprint?

The article says the method used a regular inkjet printer, three AgIC silver conductive ink cartridges, a normal black ink cartridge, and AgIC paper. It describes obtaining a fingerprint, scanning it at 300 dpi, and printing it on the AgIC paper before placing it over the phone's sensor.

Which two phone models does the article say the spoofing method was tested on, and with what result?

The article says the method was successfully tested on a Samsung Galaxy S6 and a Huawei Honor 7. It notes the Samsung was easy to crack, while the Huawei phone needed more tries.

How much time and money does the article say the spoofing attack requires?

The article states the equipment costs less than $500 and the whole process takes less than 15 minutes. It compares this time to the length of a coffee run, to emphasise how quickly the attack can be carried out.

What mobile device management products does the article name as a defence, and what do they do?

The article names Citrix XenMobile and VMware AirWatch as MDM solutions that let organisations silo and encrypt content on devices, and remotely wipe that content if a device is misplaced or falls into the wrong hands. It presents MDM as the practical countermeasure to fingerprint spoofing risk.

What does the article say Citrix ShareFile adds to traditional file sharing?

The article says Citrix ShareFile extends traditional sharing by adding encryption and file expiration, enabling confidential or high-value documents to be distributed securely. It adds that ShareFile content, like other files, can also be remotely deleted if required.

What does the article say increases the risk if a device is lost or stolen?

The article says the risk is heightened if a device is misplaced or stolen, or if its access privileges were not correctly rescinded upon an employee's separation from the organisation. It argues this is what makes fingerprint spoofing dangerous rather than merely theoretical.

Where does the article say a reader can access the original research paper?

The article links directly to the research paper as a PDF hosted on the Michigan State University Department of Computer Science and Engineering's own site. It presents this as the primary source for readers who want the full technical detail behind the spoofing method.

Source

• origin post (2016)

Knowledge Base