RE: Hacking USB Thumbdrives, Thumprint authentication

[markus-1977@gmx.net]

Hey,

> I've been working with fingerprint authentication devices for over 9 years
now. The basis for the research quoted on cracking these
> devices is weak. Is it possible to devise a way to fool fingerprint
readers?... given enough time, gummy bears and glue? It may be
> possible but having tested the devices over a number of years I can say
that it is very difficult. By the time a person was able to do
> lithography and form a "gummy finger" of some type their password could
have been stolen hundreds of times over by a hardware
> key-logger or socially engineered.

There are a few things that are very disturbing about Biometrics (even with
a better reader), though:

a) biometrics are no secrets (I leave my fingerprint everywhere); retinas
are readable from some distance... where do you get a new thumb-print, when it
gets compromised? Yes, for good security it should be "know" and "have", but
look at what's going on in practice: They want to introduce fingerprints in
passports - why not have a pin as well?

b) security depends a lot on the reader, i.e. the "life-detection". Just
what will happen when all the countries agree on having fingerprints in the
passports. Will the readers in some third-world countries be as secure as in the
US/EU? What will happen when somebody can fake my entry into some country? Or
assume it will be used for payment or something like that... Will all the
readers be secure enough to detect gummy fingers? A pin-pad on the other hand
is relatively simple...

c) Biometrics is always "fuzzy comparison". If I have a pin, it's either
correct or not. If the PIN/password is difficult enough, I can encrypt stuff
with it. If only a hash is stored, then the device will not "know" the correct
password to decrypt my secrets but can verify that the user knows it.
Biometrics on the other hand always compares to a reference stored somewhere. The
reference is in the clear, because (to the best of my knowledge) there is no
hash-function out there that will hash your fuzzy fingerprint to a constant
value is it accepts and to something random if it rejects. That means that data
on the Thumbdrives is most likely not "encrypted" with your fingerprint. Most
likely it will make some comparison and then allow or deny access. There is
some work in progress to extract keys from fingerprints, though. However,
it'll take some time until we will find this in products...

Markus

--
The early bird gets the worm. If you want
something else for breakfast, get up later.

GMX ProMail (250 MB Mailbox, 50 FreeSMS, Virenschutz, 2,99 EUR/Monat...)
jetzt 3 Monate GRATIS + 3x DER SPIEGEL +++ http://www.gmx.net/derspiegel +++

[Navaneetharangan]

Dear Markus,
I totally agree with you that a biometric system can be compromised, but
then most of the security systems can be compromised. It is only the
effort required and complexity involved that sets any system apart. In
this angle, having worked with biometric devices and having developed
applications using fingerprint readers before, I feel that the modern
day biometric readers are a far improved lot and are really very
effective for logical and physical access control systems.
1) Many of the fingerprint authentication systems do encrypt the
fingerprint data before storing it in the database or as a digest file.
Ofcourse this is not a one way hash, but mostly a symmetric encryption
that happens.
2) With the arrival of optic based fingerprint scanners, the probability
of getting authenticated on latent fingerprints (or by using a lifted
fingerprint) is very minimal.
3) And you can use all the ten fingers of yours for authentication; it
need not always be your thumbprint alone.

The only disadvantage in this area, as rightly brought out by you, is
1) There is no standard amongst hardware manufacturers. Therefore there
is no compatibility between different hardwares. The BioAPI which is a
consortium for Biometric Development is doing a great job in laying the
rules of the game. However we need to still go a lot further before
biometrics can get a deFacto standard in the security industry.

Having said all that, I still agree that it is always better to go for
dual factor authentication ( 'Are' + 'Know' or 'Have').

Regards
C.Navaneetharangan CISA

-----Original Message-----
From: markus-1977@gmx.net [mailto:markus-1977@gmx.net]
Sent: Thursday, February 05, 2004 12:08 AM
To: David.Cross@ngc.com; bugtraq@securityfocus.com
Subject: RE: Hacking USB Thumbdrives, Thumprint authentication

Hey,

> I've been working with fingerprint authentication devices for over 9
years
now. The basis for the research quoted on cracking these
> devices is weak. Is it possible to devise a way to fool fingerprint
readers?... given enough time, gummy bears and glue? It may be
> possible but having tested the devices over a number of years I can
say
that it is very difficult. By the time a person was able to do
> lithography and form a "gummy finger" of some type their password
could
have been stolen hundreds of times over by a hardware
> key-logger or socially engineered.

There are a few things that are very disturbing about Biometrics (even
with
a better reader), though:

a) biometrics are no secrets (I leave my fingerprint everywhere);
retinas
are readable from some distance... where do you get a new thumb-print,
when it
gets compromised? Yes, for good security it should be "know" and "have",
but
look at what's going on in practice: They want to introduce fingerprints
in
passports - why not have a pin as well?

b) security depends a lot on the reader, i.e. the "life-detection". Just
what will happen when all the countries agree on having fingerprints in
the
passports. Will the readers in some third-world countries be as secure
as in the
US/EU? What will happen when somebody can fake my entry into some
country? Or
assume it will be used for payment or something like that... Will all
the
readers be secure enough to detect gummy fingers? A pin-pad on the other
hand
is relatively simple...

c) Biometrics is always "fuzzy comparison". If I have a pin, it's either
correct or not. If the PIN/password is difficult enough, I can encrypt
stuff
with it. If only a hash is stored, then the device will not "know" the
correct
password to decrypt my secrets but can verify that the user knows it.
Biometrics on the other hand always compares to a reference stored
somewhere. The
reference is in the clear, because (to the best of my knowledge) there
is no
hash-function out there that will hash your fuzzy fingerprint to a
constant
value is it accepts and to something random if it rejects. That means
that data
on the Thumbdrives is most likely not "encrypted" with your fingerprint.
Most
likely it will make some comparison and then allow or deny access. There
is
some work in progress to extract keys from fingerprints, though.
However,
it'll take some time until we will find this in products...

Markus

--
The early bird gets the worm. If you want
something else for breakfast, get up later.

GMX ProMail (250 MB Mailbox, 50 FreeSMS, Virenschutz, 2,99 EUR/Monat...)
jetzt 3 Monate GRATIS + 3x DER SPIEGEL +++ http://www.gmx.net/derspiegel
+++

[Dave Aronson]

On Wed February 4 2004 13:37, markus-1977@gmx.net wrote:

> (to the best of my knowledge) there is no
> hash-function out there that will hash your fuzzy fingerprint to a
> constant value is it accepts and to something random if it rejects.

Law enforcement agencies use some kind of algorithm to convert
fingerprints to a numeric value, so that they can be easily compared.
This resulting value could of course be hashed. Question is, is this
something that (so far) a human must do, or is it automatable in real
time by a reasonably small and low-priced system?

--
Dave Aronson, Senior Software Engineer, Secure Software Inc.
(Opinions above NOT those of securesw.com unless so stated!)
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
Web: http://destined.to/program http://listen.to/davearonson

[David Brodbeck]

> -----Original Message-----
> From: Dave Aronson [mailto:spamtrap.secfocus@dja.mailme.org]

> Law enforcement agencies use some kind of algorithm to convert
> fingerprints to a numeric value, so that they can be easily
> compared.

My understanding is that this is only an approximate representation -- it's
not intended to be unique, it's only a method for quickly locating prints
similar to the suspect print. The final comparison between a print that's
on file and a suspect print is done by eye, and is actually somewhat
subjective.

[Eric Murray]

On Fri, Feb 06, 2004 at 10:06:22AM -0500, Dave Aronson wrote:
> On Wed February 4 2004 13:37, markus-1977@gmx.net wrote:
>
> > (to the best of my knowledge) there is no
> > hash-function out there that will hash your fuzzy fingerprint to a
> > constant value is it accepts and to something random if it rejects.
>
> Law enforcement agencies use some kind of algorithm to convert
> fingerprints to a numeric value, so that they can be easily compared.
> This resulting value could of course be hashed. Question is, is this
> something that (so far) a human must do, or is it automatable in real
> time by a reasonably small and low-priced system?


Fingerprints are matched on what are called minutae, which are
relative locations where lines break, join, etc.
(some systems may also look at whorl direction, the one I
worked with did not)

A typical digital fingerprint's got somewhere around 20-30 minutae.
Not all of them will be picked up in each scan, depending
on finger orientation, smudging, dirt, etc.

Search criteria will be for some percentage of matches, depending
on the desired false accept/false reject ratio.

So a simple hash of the minutae won't work very well as it will
result in an unacceptably high false reject ratio.

But the matching is easily automated.
The system I worked with used 4-byte ints to represent
minutae location and capped the number at 50.

Eric

[Charles Clancy]

> > Law enforcement agencies use some kind of algorithm to convert
> > fingerprints to a numeric value, so that they can be easily compared.
>
> My understanding is that this is only an approximate representation --
> it's not intended to be unique, it's only a method for quickly locating
> prints similar to the suspect print. The final comparison between a
> print that's on file and a suspect print is done by eye, and is actually
> somewhat subjective.

Most fingerprint systems convert the fingerprint image into what's called
a template. This is a numeric representation, but comparision between
two templates is not as simple as "==". Different portions of the
template represent different minutae on the fingerprint, and an actual
feature matching algorithm still needs to be used. Thus, we cannot hash
these templates because there is no way to perform matching on the
template hashes.

So far nobody has produced an algorithm to reliably extract a symmetric
key from a fingerprint without any side information. However, with some
extra information it is possible to obscure a private key on a smartcard
such that the key is only recoverable given a fingerprint that matches the
original. This allows all the biometric processing to happen on a
smartcard (and not on an untrusted terminal) without storing the
fingerprint itself on the smartcard. An attacker needs both the card and
your fingerprint to recover your key.

[ t. charles clancy ]--[ tcc@umd.edu ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]------[ university of maryland, college park ]

Fingerprint data is difficult to hash since the comparators are fuzzy in =
nature. Basically you are dealing with vectors or distances between =
minutiae (points of interest) and their direction including slant/curve. =
Minutiae readings will differ slightly with each print sampling. For =
accuracy each print has to be compared to each sample seeking a match. =
The matching process can be time consuming.

That being said there is a way to fuzzify a representation of the print =
in a numeric form. Since the algorithms produce an encrypted output of =
end points and vectors you are left to trying to attach statistical =
significance to the decrypted version of the algorithm output data. Or =
you can fuzzify a representation of the image itself as most API's allow =
capture and storage of a bitmap of the print. The captured prints will =
have variance in placement on the print window and will collect more or =
less white-space or skewed position. Prints will also have more or less =
surface area depending on the pressure applied during the print capture =
process. (This is why the algorithms look for points of interest on the =
print and will refuse many finger placements during the print =
enrollment/verification process.)

Since I get paid for figuring out how to index prints I'll keep the =
secret to myself but you have the basics of what's needed to figure it =
out with the help of a little high school math.

Enjoy~
David Cross

P.S. hashing is a bad technique in this case because hash's must produce =
a unique result that you end up extremely similar inputs having vastly =
different hash output values. In this case you want to reduce the pool =
of candidate prints and then do a 1 on 1 comparison of the reduced set. =
Think more along the lines of averages rather than hashes...

Most systems will make you enter a pin or a username and then will do =
the 1 on 1 comparison because of the time cost of comparing all prints =
in the database. Some companies sell systems that compare all prints in =
the database 1 on 1 to the input but you have the issue of buying an =
expensive server and you give up the two factor safety aspect.



-----Original Message-----
From: Dave Aronson [mailto:spamtrap.secfocus@dja.mailme.org]=20
Sent: Friday, February 06, 2004 8:06 AM
To: bugtraq@securityfocus.com
Cc: markus-1977@gmx.net
Subject: Re: Hacking USB Thumbdrives, Thumprint authentication

On Wed February 4 2004 13:37, markus-1977@gmx.net wrote:

> (to the best of my knowledge) there is no
> hash-function out there that will hash your fuzzy fingerprint to a
> constant value is it accepts and to something random if it rejects.

Law enforcement agencies use some kind of algorithm to convert=20
fingerprints to a numeric value, so that they can be easily compared. =20
This resulting value could of course be hashed. Question is, is this=20
something that (so far) a human must do, or is it automatable in real=20
time by a reasonably small and low-priced system?

--=20
Dave Aronson, Senior Software Engineer, Secure Software Inc.
(Opinions above NOT those of securesw.com unless so stated!)
Email me at: work (D0T) 2004 (@T) dja (D0T) mailme (D0T) org
Web: http://destined.to/program http://listen.to/davearonson

[Lyal Collins]

[> Most fingerprint systems convert the fingerprint image into
[> what's called
[> a template. This is a numeric representation, but
[> comparision between
[> two templates is not as simple as "==". Different portions of the
[> template represent different minutae on the fingerprint, and
[> an actual
[> feature matching algorithm still needs to be used. Thus, we
[> cannot hash
[> these templates because there is no way to perform matching on the
[> template hashes.

There has been some interesting work done with facial biometrics that
leverages the predictability of facial features (most eyes look similar,
noses have a similar basic shape etc) to allow the generation of a
'false' facial image that will match to the template of a chosen target
template. This iterates the placement and subtle variations in the
faked facial image until this fake image results in an acceptable match
through the same template generation process. The image doesn't need to
be exactly the same (and the example images I saw were barely "human" to
the naked eye) - merely that theey result in a similar template as the
true image.

I suspect the same process of iteratively varying whorls, ridges etc
could, and would, result in a fales fingerprint that results in an
acceptable template match to the real finger.

Has anyone researched this with fingerprints?
Lyal