Date: Mon, 20 May 2002 00:20:04 -0400 (EDT)
From: editor@telecom-digest.org
Subject: [telecom] TELECOM Digest V20 #255
To: ptownson@massis.lcs.mit.edu
Reply-To: telecom@telecom-digest.org

<snip>



TELECOM Digest     Mon, 20 May 2002 00:20:00 EDT    Volume 20 : Issue 256

Inside This Issue:                             Editor: Patrick A. Townson

    Fingerprint Readers Fooled with Gelatin Molds (Marcus Didius Falco)

<snip>

Date: Sun, 19 May 2002 15:37:39 -0400
From: Marcus Didius Falco <marcus_d_falco@yahoo.com>
Subject: Fingerprint Readers Fooled with Gelatin Molds of


If memory serves, the guy who did this experiment, Tsutomu Matsumoto,
is the fellow who caught Kevin Mitnick a couple of years
ago. Obviously, he's not a guy to mess with! :-)

* Original: FROM..... Dave Farber


  ------ Forwarded Message
  From: Chris Hoofnagle
  Date: Thu, 16 May 2002 08:30:49 -0400
  Subject: Fingerprint Readers Fooled with Gelatin Molds of *Latent* Prints

Dear Dave,

This is from Bruce Schneier's Crypto-Gram.
( http://www.counterpane.com/crypto-gram.html ) Thought it would be of
interest.

Regards,

Chris

http://www.counterpane.com/crypto-gram-0205.html#5

Fun with Fingerprint Readers

Tsutomu Matsumoto, a Japanese cryptographer, recently decided to look
at biometric fingerprint devices. These are security systems that
attempt to identify people based on their fingerprint. For years the
companies selling these devices have claimed that they are very
secure, and that it is almost impossible to fool them into accepting a
fake finger as genuine. Matsumoto, along with his students at the
Yokohama National University, showed that they can be reliably fooled
with a little ingenuity and $10 worth of household supplies.

Matsumoto uses gelatin, the stuff that Gummi Bears are made out
of. First he takes a live finger and makes a lastic mold. (He uses a
free-molding plastic used to make plastic molds, and is sold at hobby
shops.) Then he pours liquid gelatin into the mold and lets it
harden. (The gelatin comes in solid sheets, and is used to make
jellied meats, soups, and candies, and is sold in grocery stores.)
This gelatin fake finger fools fingerprint detectors about 80% of the
time.

His more interesting experiment involves latent fingerprints. He takes
a fingerprint left on a piece of glass, enhances it with a
cyanoacrylate adhesive, and then photographs it with a digital
camera. Using PhotoShop, he improves the contrast and prints the
fingerprint onto a transparency sheet. Then, he takes a
photo-sensitive printed-circuit board (PCB) and uses the fingerprint
transparency to etch the fingerprint into the copper, making it
three-dimensional. (You can find photo-sensitive PCBs, along with
instructions for use, in most electronics hobby shops.) Finally, he
makes a gelatin finger using the print on the PCB. This also fools
fingerprint detectors about 80% of the time.

Gummy fingers can even fool sensors being watched by guards. Simply
form the clear gelatin finger over your own. This lets you hide it as
you press your own finger onto the sensor. After it lets you in, eat
the evidence.

Matsumoto tried these attacks against eleven commercially available
fingerprint biometric systems, and was able to reliably fool all of
them.  The results are enough to scrap the systems completely, and to
send the various fingerprint biometric companies packing. Impressive
is an understatement.

There's both a specific and a general moral to take away from this
result.  Matsumoto is not a professional fake-finger scientist; he's a
mathematician. He didn't use expensive equipment or a specialized
laboratory. He used $10 of ingredients you could buy, and whipped up
his gummy fingers in the equivalent of a home kitchen. And he defeated
eleven different commercial fingerprint readers, with both optical and
capacitive sensors, and some with "live finger detection"
features. (Moistening the gummy finger helps defeat sensors that
measure moisture or electrical resistance; it takes some practice to
get it right.) If he could do this, then any semi-professional can
almost certainly do much much more.

More generally, be very careful before believing claims from security
companies. All the fingerprint companies have claimed for years that
this kind of thing is impossible. When they read Matsumoto's results,
they're going to claim that they don't really work, or that they don't
apply to them, or that they've fixed the problem. Think twice before
believing them.

Matsumoto's paper is not on the Web. You can get a copy by asking:
Tsutomu Matsumoto <tsutomu@mlab.jks.ynu.ac.jp>

Here's the reference:
T. Matsumoto, H. Matsumoto, K. Yamada, S. Hoshino, "Impact of Artificial
Gummy Fingers on Fingerprint Systems," Proceedings of SPIE Vol. #4677,
Optical Security and Counterfeit Deterrence Techniques IV, 2002.

Some slides from the presentation are here:
< http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf >

My previous essay on the uses and abuses of biometrics:
< http://www.counterpane.com/crypto-gram-9808.html#biometrics >

Biometrics at the shopping center: pay for your groceries with your
thumbprint.
< http://seattlepi.nwsource.com/local/68217_thumb27.shtml >


Chris Hoofnagle, Legislative Counsel    +1.202.483.1140 (tel)
Electronic Privacy Information Center   +1.202.483.1248 (fax)
1718 Connecticut Ave., NW Suite 200     hoofnagle <at> epic.org
Washington, DC 20009  USA
http://www.epic.org/                   http://www.privacy.org/

For archives see:
http://www.interesting-people.org/archives/interesting-people/

Direct replies are unlikely to be read.
To reply use the address below: falco_marcus_didius <at> yahoo.co.uk