Security risk fingerprint and iris scanners

Dominik Bärlocher

27.1.2017

Fingerprint scanners are the quickest way to unlock your phone, but they are certainly not the most secure. Iris scanners carry even more of a security risk. Here, we give you the low-down on the role your finger plays in security, Switzerland’s take on the legal side of things and why the peace sign can jeopardise your security.

These days, fingerprint technology is the established way to unlock smartphones. Devices without such a scanner seem old-fashioned or technologically inferior. But experts in the field of information security are horrified when they think about the advances in biometric data as an authentication factor. The term ‘biometric data as an authentication factor’ is pretty useless anyway, as no one understands it. This is what it really means:

• Biometric data: any part of your body that can somehow deliver unique data. We’re talking fingerprints, iris, brain waves, dental images , DNA, your voice, etc.
• Authentication factor: something that you use to access a protected area or service. This could be a key, PIN, badge, password, etc.

In this article, I’ll be talking about biometric data from fingerprints and occasionally from the iris. The reason I’m mentioning both is that all arguments for and against fingerprints can, with a bit of thought, apply to the iris as well.

The great uncertainty surrounding fingerprints

On TV and in films it’s easy to fake a fingerprint. You just need a bit of powder and sticky tape. Sometimes even wax and face powder will do the job. But surely it’s not as straightforward as that in real life, is it?

That’s right, because you definitely need a bit of time and a DIY store (or just trusted Galaxus). Hacker Jan Kirssler, alias Starbug from Chaos Computer Club, is the expert when it comes to faking fingerprints. In one particular video he demonstrates how he leverages an iPhone’s biometric sensor with the simplest means.

Fingerprint technology allows anyone to access those naked selfies on your iPhone. Is that something you want? “Definitely not!” my colleague exclaimed. There you go. Threat analysis. “Well, I wouldn’t be too bothered about photos of me in my underwear being published. Because they were already staged and everything. But the photos I took to help me with my diet… that would be embarrassing,” she added.

The good news is that my colleague’s ‘in the buff’ problem can be easily solved.

Now that we know it’s possible to falsify a fingerprint with wood glue and we’ve thought about where and how it can be accessed and by whom, we’re ready for the next step.

You only have a limited number of fingers

A password is a dynamic object. That means that you can change it as often as you need to. It doesn’t matter if you have 123456, yA3XKdpa or CorrectBatteryStapleHorse as a password. What is important is that you can change it as often as you want. You can change your password strategy or even the length, numbers and punctuation marks. It only takes a few seconds.

It’s not the same story when it comes to your fingerprints. You only get 10 fingerprints, which have to last you a lifetime. Bear in mind that they don’t normally change. Now imagine your fingerprint were stolen – you would always have a security issue. Should the attacker go to the effort of stealing all your fingerprints then this authentication method is over for you.

If you still want to use a touch sensor, you’re asking for esoteric solutions. You have 10 toes you could still scan, and you have two eyes for the iris scanner. On a less serious note, men have another option. Ladies, I’m afraid this one isn’t open to you.

What started as a joke lead to research and Reddit User tested various different body parts.

It gets worse – a hacker doesn’t even need your phone any more

In the video above, attackers need to have your smartphone. Whether they steal it or briefly borrow it is of no relevance, as demonstrated by hacker Starbug’s new attack. He can capture fingerprint data from a decent, high-definition photograph and then recreate it using the technology shown above.

However, the focus of the Japan Times wasn’t on photographs that can be used to extract fingerprints. Instead, this was the key takeaway from their article:

But NII says it has developed a transparent film containing titanium oxide that can be attached to fingers to hide their prints, the reports said.

The risk of being photographed by HD cameras and having fingerprints stolen seems to be so great that Japan is now researching and discovering countermeasures.

What the law in Switzerland has to say about it

As far as security goes, you can be forced to unlock your smartphone using fingerprint technology, but you don’t have to divulge a password. Just saying ;).

• Passwords, PINs and samples are knowledge and therefore protected by the Fifth Amendment in the US.
• Fingerprints are evidence like DNA or a physical key, which citizens can be compelled to hand over.

Bluefisch200 concluded that the same applies in Switzerland.

“That is not the case“, says Martin Steiger, a lawyer at a law office in Zurich, who specialises in digital cases. He found the precedent in the US fascinating but explained that it did not directly apply to Swiss law. This means that the US precedent can’t automatically be used in similar cases in Switzerland.

You may find this interesting:

Dominik Bärlocher

Senior Editor

dominik.baerlocher@digitecgalaxus.ch

Journalist. Author. Hacker. A storyteller searching for boundaries, secrets and taboos – putting the world to paper. Not because I can but because I can’t not.

---

Background information

Interesting facts about products, behind-the-scenes looks at manufacturers and deep-dives on interesting people.

Show all