March 6, 2016 -
Michigan State (MSU) researchers, Anil Jain and Kai Cao, have discovered an inexpensive and quick method to unlock a mobile phone protected by fingerprint biometrics using an off-the-shelf printer and special photo paper.
The process can be done in under 15 minutes and uses a normal Brother brand inkjet printer and conductive silver ink and a type of photo paper which are both available from a Japanese manufacturer called AgIC.
The researchers detailed the process in a technical report and explain how this method can generate fake fingerprints more rapidly than previous methods using latex or wood glue.
“Hackers can easily generate a large number of spoofs using fingerprint reconstruction or synthesis techniques, which is easier than 2.5D fingerprint spoofs,” the report stated.
The MSU researchers tested the Samsung Galaxy S6, Huawei Honor 7, iPhone 5s, and Meizu MX4 Pro smartphones and successfully unlocked the Samsung and Huawei devices. In an interview with Quartz, Cao said that the spoof worked on the iPhone during an earlier attempt, but it didn’t work when he tried to replicate the result for the technical report.
The MSU researchers released a video of the fingerprint spoof:
The process starts with a scanned photo of the target user’s fingerprint. The image is then mirrored and printed on paper similar to photo stock using a conductive ink that contains silver. The ink and paper costs about $350.
In the Quartz report, researcher Cao commented; “We want to emphasize the urgent need for anti-spoofing technology because more phones are using fingerprint sensors.”
According to research firm Acuity Market Intelligence, more than 200 smartphones incorporating biometrics, including fingerprints, been introduced since Q1 2013 under 70 brand names.