System Attacks & Fake Fingers

Insights into "fake fingers" / 'hacked' Fingerprint Systems

Some press and media reports claim that fingerprint sensors have been "hacked." Normally these articles refers to the issue of "fake fingers."

Types of Fake Fingerprints
Fake fingers may be made in 2 or 3 dimensions.

A 2D fake is simply a printout or copy of a fingerprint on paper.  Such fakes are easy to create and may be used to fool many optical principle sensors. A 2D fake can not be used to fool a capacitive or active thermal (NEXT) fingerprint sensor. 

A 3D fake is an object created with a mold typically from gelatin, silicone or rubber. Quality 3D fakes will fool all mass market fingerprint sensors (including NEXT principle and capacitive principle sensors). 

Given the right skills and equipment, producing a good 3D fake can be produced relatively easily. This requires the active collaboration of an individual pressing his/her finger into a mold to be used to produce the fake finger.

This is, however, far trickier without consent of the rightful enrollee. The criminal would have to find and lift the right fingerprint fraction (the one chosen by the user during enrollment) off a drinking glass (or similar), develop and digitize this and then create a mold to place the fake material and produce a good enough silicone finger.

Of course, all of this have to happen before the user detects the loss of the device. This process is definitely more difficult than spying out a PIN number or a password.

The above comments are not meant to downplay the seriousness of fake fingerprints but to emphasize that absolute security is never possible. Every systems integrator needs to take appropriate measures for each application. 

NEXT partners with leading universities and scientific institutes. Together we are researching hardware and software methods for detecting latent prints and fake fingers. To date there is no solution that reliably detects every kind of fake. If there is, NEXT will do everything reasonable to make it available to its valued clients.