Attackers Can Bypass Fingerprint Authentication With an 80 Percent Success Rate

[SaM]

An anonymous reader quotes a report from Ars Technica:

A study published on Wednesday by Cisco’s Talos security group makes clear that the alternative isn’t suitable for everyone – namely those who may be targeted by nation-sponsored hackers or other skilled, well-financed, and determined attack groups. The researchers spent about $2,000 over several months testing fingerprint authentication offered by Apple, Microsoft, Samsung, Huawei, and three lock makers. The result: on average, fake fingerprints were able to bypass sensors at least once roughly 80 percent of the time.

The percentages are based on 20 attempts for each device with the best fake fingerprint the researchers were able to create. While Apple Apple products limit users to five attempts before asking for the PIN or password, the researchers subjected the devices to 20 attempts (that is, multiple groups of from one or more attempts). Of the 20 attempts, 17 were successful. Other products tested permitted significantly more or even an unlimited number of unsuccessful tries. Tuesday’s report was quick to point out that the results required several months of painstaking work, with more than 50 fingerprint molds created before getting one to work. The study also noted that the demands of the attack – which involved obtaining a clean image of a target’s fingerprint and then getting physical access to the target’s device – meant that only the most determined and capable adversaries would succeed.

The most susceptible devices were the AICase padlock and Huawei’s Honor 7x and Samsung’s Note 9 Android phones, “all of which were bypassed 100 percent of the time,” the report says. “Fingerprint authentication in the iPhone 8, MacBook Pro 2018, and the Samsung S10 came next, where the success rate was more than 90 percent. Five laptop models running Windows 10 and two USB drives – the Verbatim Fingerprint Secure and the Lexar Jumpdrive F35 – performed the best, with researchers achieving a 0-percent success rate.”