Biometrics.........the next BIG thing?

[Milton Kuo]

Re: Biometrics.........the next BIG thing?

All we need is ONE car producer to use it...........insurance company will reduce the costs because the car is MUCH harder to steal..........& Bingo.
Mike

While this seems very promising and appears to be well-suited for financial institutional use, I do not see it being practical for use in automobiles. For starters, I don't see how an automobile can get around the necessity of having a "back door" used by mechanics who service the car. A back door available to a mechanic will easily become a back door available to car thieves.

The other problem with biometric systems is that if you somehow change (fingerprints change if you play stringed instruments or if you get injured), the system no longer recognizes you. It's not clear to me how robust the NEC system is for dealing with a changing biometric profile and what kind of "back door" is going to be required to address a changed biometric profile.

On the Apple iPhone finger scanner, I've read that initial authentication to the phone (power-on) is through a password. Subsequent unlocks of the phone can be done through a biometric authentication. Everything I've read so far is that the password is the primary means of authentication and the finger scan is a convenience. If what I have read is true, it is because the biometric system is not foolproof enough (foolproof as in the hardware/software has no quirks and is robust enough to handle obtuse users) to be the primary or only means of authentication.

[shiny!]

Re: Biometrics.........the next BIG thing?

All we need is ONE car producer to use it...........insurance company will reduce the costs because the car is MUCH harder to steal..........& Bingo. Mike

It'll be interesting to see how people without fingerprints or fingers are accomodated if fingerprint scanner tech ever becomes widely adopted. Have to take off our shoes and press our big toe on the steering wheel in order to start the car?

[Mega]

Re: Biometrics.........the next BIG thing?

It looks under your skin:-

[c1ue]

Re: Biometrics.........the next BIG thing?

All we need is ONE car producer to use it...........insurance company will reduce the costs because the car is MUCH harder to steal..........& Bingo.

That all sounds good until you are unable to use your car because of some software bug, or someone hacks into it and circumvents the entire validation process.

[think365]

Re: Biometrics.........the next BIG thing?

That all sounds good until you are unable to use your car because of some software bug, or someone hacks into it and circumvents the entire validation process.

Good point. See selected extracts from Wired Magazine article, below (particularly the first paragraph):

If Apple’s iPhone Has Fingerprint Authentication, Can It Be Hacked?

By Bruce Schneier 09.09.13 6:25 AM
Bruce Schneier is a security technologist and author

There are two ways an authentication system can fail. It can mistakenly allow an unauthorized person access, or it can mistakenly deny access to an authorized person. In any consumer system, the second failure is far worse than the first. Yes, it can be problematic if an iPhone fingerprint system occasionally allows someone else access to your phone. But it’s much worse if you can’t reliably access your own phone — you’d junk the system after a week.

And fingerprint readers have a long history of vulnerabilities as well. Some are better than others. The simplest ones just check the ridges of a finger; some of those can be fooled with a good photocopy. Others check for pores as well. The better ones verify pulse, or finger temperature. Fooling them with rubber fingers is harder, but often possible. A Japanese researcher had good luck doing this over a decade ago with the gelatin mixture that’s used to make Gummi bears.

It’s fine if your fingers unlock your phone. It’s a different matter entirely if your fingerprint is used to authenticate your iCloud account. The centralized database required for that application would create an enormous security risk.

The final problem with biometric systems is the database. If the system is centralized, there will be a large database of biometric information that’s vulnerable to hacking.

Your fingerprint isn’t a secret; you leave it everywhere you touch

http://www.wired.com/opinion/2013/09...uthentication/

[Milton Kuo]

iPhone Finger Scanner Busted

Well, that didn't take long at all. The iPhone 5s finger scanner has been busted using an easily-made fake finger.

From "Chaos Computer Club Breaks Apple TouchID"

The biometrics hacking team of the Chaos Computer Club (CCC) has successfully bypassed the biometric security of Apple's TouchID using easy everyday means. A fingerprint of the phone user, photographed from a glass surface, was enough to create a fake finger that could unlock an iPhone 5s secured with TouchID. This demonstrates – again – that fingerprint biometrics is unsuitable as access control method and should be avoided.


Apple had released the new iPhone with a fingerprint sensor that was supposedly much more secure than previous fingerprint technology. A lot of bogus speculation about the marvels of the new technology and how hard to defeat it supposedly is had dominated the international technology press for days.

"In reality, Apple's sensor has just a higher resolution compared to the sensors so far. So we only needed to ramp up the resolution of our fake", said the hacker with the nickname Starbug, who performed the critical experiments that led to the successful circumvention of the fingerprint locking. "As we have said now for more than years, fingerprints should not be used to secure anything. You leave them everywhere, and it is far too easy to make fake fingers out of lifted prints." [1]

The iPhone TouchID defeat has been documented in a short video.

The method follows the steps outlined in this how-to with materials that can be found in almost every household: First, the fingerprint of the enroled user is photographed with 2400 dpi resolution. The resulting image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting. Finally, pink latex milk or white woodglue is smeared into the pattern created by the toner onto the transparent sheet. After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone. This process has been used with minor refinements and variations against the vast majority of fingerprint sensors on the market.

"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token", said Frank Rieger, spokesperson of the CCC. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access." Fingerprint biometrics in passports has been introduced in many countries despite the fact that by this global roll-out no security gain can be shown.
iPhone users should avoid protecting sensitive data with their precious biometric fingerprint not only because it can be easily faked, as demonstrated by the CCC team. Also, you can easily be forced to unlock your phone against your will when being arrested. Forcing you to give up your (hopefully long) passcode is much harder under most jurisdictions than just casually swiping your phone over your handcuffed hands.

Many thanks go to the Heise Security team which provided the iPhone 5s for the hack quickly. More details on the hack will be reported there.

[FrankL]

Re: iPhone Finger Scanner Busted

I'd love to know where the biometric information of the fingerprints is stored.

- Strictly local on the device, inaccessible for Apple or third-parties?
- In the cloud with locally cached copies?
- something else?

[think365]

Re: iPhone Finger Scanner Busted

Well, that didn't take long at all. The iPhone 5s finger scanner has been busted using an easily-made fake finger.

From "Chaos Computer Club Breaks Apple TouchID"

Fake finger/fingerprint access doesn't bode well for the biometric security system on the TruTouch alcohol sensor device either. This becomes particularly problematic if a TruTouch (medical) device database gets hacked/spoofed for two critical reasons: 1. Liability to TruTouch (and its customers) if counterfeit fingerprints used in the device allow an inebriated employee/intruder into a restricted, high risk area resulting in a serious or fatal accident; and 2. Hacked fingerprint database in a medical setting (hospital emergency room, etc) would result in severe fines for HIPPA violations (and possible product recall) as well as civil claims and class action lawsuits for invasion of privacy. There are also identity theft issues that will further complicate things if innocent persons are wrongfully accused and terminated because their prints got hacked.

[Milton Kuo]

Re: iPhone Finger Scanner Busted

Fake finger/fingerprint access doesn't bode well for the biometric security system on the TruTouch alcohol sensor device either. This becomes particularly problematic if a TruTouch (medical) device database gets hacked/spoofed for two critical reasons: 1. Liability to TruTouch (and its customers) if counterfeit fingerprints used in the device allow an inebriated employee/intruder into a restricted, high risk area resulting in a serious or fatal accident; and 2. Hacked fingerprint database in a medical setting (hospital emergency room, etc) would result in severe fines for HIPPA violations (and possible product recall) as well as civil claims and class action lawsuits for invasion of privacy. There are also identity theft issues that will further complicate things if innocent persons are wrongfully accused and terminated because their prints got hacked.

That is one of the questions I intend to ask Dr. Gill: the issue of liability if the TruTouch device gets FDA approval and is sold as a medical device.

In the discussions during the initial B-1 round, Dr. Gill did say that the biometric matching of the TruTouch system is not as uniquely identifying as other biometric systems. If I remember correctly, for purposes of employee populations, the TruTouch biometric technology is adequate for uniquely identifying a user. I suspect that the TruTouch biometric will be used as a supplemental ID to something like a corporate badge using Mifare or maybe smart card technology.

It's not clear to me how easy it is to fake out a TruTouch system with a fake finger. You would have to create something that approximates human tissue with a chemical make-up comparable to a specific person. This does not sound like something that can be made easily or inexpensively.

[c1ue]

Re: iPhone Finger Scanner Busted

I'd love to know where the biometric information of the fingerprints is stored.

- Strictly local on the device, inaccessible for Apple or third-parties?
- In the cloud with locally cached copies?
- something else?

It is almost certainly local, but equally will likely get synced onto your PC by iTunes - and from there can be accessible by anyone with internet access and access to iTunes (i.e. Apple and the NSA).

I'd also note that it is extremely unlikely that the data in question is anything but a mathematical model - it is this stage where the operating system level hacks would target.

[think365]

Re: iPhone Finger Scanner Busted

It is almost certainly local, but equally will likely get synced onto your PC by iTunes - and from there can be accessible by anyone with internet access and access to iTunes (i.e. Apple and the NSA).

I'd also note that it is extremely unlikely that the data in question is anything but a mathematical model - it is this stage where the operating system level hacks would target.

Interesting. How might they do that? Just speculating, but would it mean that instead of storing an actual image of the fingerprint, a computer would capture certain unique/easily identifiable data points from the print (such as the distance from point A to point B on the image and/ or the number of circular segments within a defined area, etc) and then assign a unique/random number or code to that particular pattern via some kind of algorithm? So once you hacked the random number or code, you would no longer need the actual fingerprint to gain access to secure areas.

[Milton Kuo]

Re: iPhone Finger Scanner Busted

Interesting. How might they do that? Just speculating, but would it mean that instead of storing an actual image of the fingerprint, a computer would capture certain unique/easily identifiable data points from the print (such as the distance from point A to point B on the image and/ or the number of circular segments within a defined area, etc) and then assign a unique/random number or code to that particular pattern via some kind of algorithm? So once you hacked the random number or code, you would no longer need the actual fingerprint to gain access to secure areas.

That is correct. A typical fingerprint biometric authentication system captures certain points on a fingerprint and stores them in a secured area. The points are represented through some mathematic function. [Splines? I don't know exactly what functions are used.] The systems I've messed with did not store full scans of fingerprints.

However, knowing the data points is not sufficient to break the system. You still need to present a fingerprint to the system. The system then captures the fingerprint, selects points from the fingerprint, and attempts to match them against the stored data. What you're talking about suggests having access to the authentication computer itself, not just the reading device. For all intents and purposes, it's Game Over if a hacker gets access to the software that runs on a system.

[c1ue]

Re: iPhone Finger Scanner Busted

Interesting. How might they do that? Just speculating, but would it mean that instead of storing an actual image of the fingerprint, a computer would capture certain unique/easily identifiable data points from the print (such as the distance from point A to point B on the image and/ or the number of circular segments within a defined area, etc) and then assign a unique/random number or code to that particular pattern via some kind of algorithm? So once you hacked the random number or code, you would no longer need the actual fingerprint to gain access to secure areas.

I don't know the specifics, but I do know that fingerprinting consists of a small number of specific attributes like whorls, etc in a specific pattern for specific fingers.

This type of 2 dimensional data is very easily represented by any number of simplistic algorithms.

Thus to add to your comments: the output of said algorithm is not unique in the sense that every input yields a unique output. Any given input that is identical to another input would yield an identical output, much like a Fourier transform.

The ways that this process can be attacked are many-fold - just a few I can think of offhand:

1) Record the correct input by intercepting the output of the fingerprint scan and replay it internally whenever a 'check' occurs
2) Bypass the comparator function such that the output is always 'match'
3) Feed the 'match' file directly into the comparator (not the same as 1)

I'm sure there are many more possibilities.

For all intents and purposes, it's Game Over if a hacker gets access to the software that runs on a system.

Indeed. Note the additional attack points a fingerprint system presents to a hacker: while you can theoretically monitor the output of any authentication I/O, a unique authentication I/O narrows down the inputs and 'match' files that are in operation. Keyboard input is used so ubiquitously that finding the relevant data in that gigantic stream is much more difficult. To a lesser extent, the same applies to 'swipe' type authentication, for example.

The conversion of base data to model output requires CPU and mathematical processing - this also can be attacked.