Play-Doh Can Foil 90% of Most Fingerprint Scanning Security Systems

Site Notices

[ARCHIVED THREAD] - Play-Doh Can Foil 90% of Most Fingerprint Scanning Security Systems

Posted: 1/25/2006 4:46:13 PM EDT

http://www.realtechnews.com/posts/2570

By Alice Hill
RealTechNews

Today, Fortune has a piece on plans by retail giants, Costco, Target, and Wal-Mart to move to fingerprint biometric technology as a way of cutting down on fraud and to expedite check-out line time. Sounds good, but it turns out that a simple “finger” molded from Play-Doh can foil 90% of these systems.

We say: D’oh. (Couldn’t resist!)

Associate Professor of Electrical and Computer Engineering Stephanie Schuckers and her team at Clarkson University found that most scanning systems can be fooled 90% of the time by taking a mold of the mark’s finger, filling the mold with Play-Doh, and using the fake digit to gain access. Don’t go running out to Toys ‘R Us just yet, though, as the Clarkson team also designed an algorithm that detects the spread of perspiration from the pores out to the ridges of a live person’s finger, and is only foiled by the Play-Doh method 10% of the time. Source: Engadget
From Fortune:

Here’s how biometric payment works: To set up an account, customers scan their fingerprint at an in-store kiosk, enter their phone number, and then submit checking and credit card account information. To make a purchase, they place their finger on a scanner at the register, enter their phone number, and choose how they want to pay (credit, debit, or checking.) Source: Fortune

we tried this with scanners at work today. didn't work for us.

Posted: 1/25/2006 4:48:45 PM EDT

[#1]

Im going to have to try that up here at work with our new biometrics system....

Posted: 1/25/2006 4:59:35 PM EDT

[#2]

we were able to get ours to read maybe 1 out of 20 or so tries. not consistant enough to be useful. the head of the security department was with us when we tried it. he was really interested to see if we could hack it.

Posted: 1/25/2006 5:08:33 PM EDT

[#3]

Quoted:
we were able to get ours to read maybe 1 out of 20 or so tries. not consistant enough to be useful. the head of the security department was with us when we tried it. he was really interested to see if we could hack it.

Ill do and see if I can freak out the security..

Posted: 1/25/2006 5:29:04 PM EDT

[#4]

Quoted:
http://www.realtechnews.com/posts/2570

By Alice Hill
RealTechNews

Today, Fortune has a piece on plans by retail giants, Costco, Target, and Wal-Mart to move to fingerprint biometric technology as a way of cutting down on fraud and to expedite check-out line time. Sounds good, but it turns out that a simple “finger” molded from Play-Doh can foil 90% of these systems.

We say: D’oh. (Couldn’t resist!)

Associate Professor of Electrical and Computer Engineering Stephanie Schuckers and her team at Clarkson University found that most scanning systems can be fooled 90% of the time by taking a mold of the mark’s finger, filling the mold with Play-Doh, and using the fake digit to gain access. Don’t go running out to Toys ‘R Us just yet, though, as the Clarkson team also designed an algorithm that detects the spread of perspiration from the pores out to the ridges of a live person’s finger, and is only foiled by the Play-Doh method 10% of the time. Source: Engadget
From Fortune:

Here’s how biometric payment works: To set up an account, customers scan their fingerprint at an in-store kiosk, enter their phone number, and then submit checking and credit card account information. To make a purchase, they place their finger on a scanner at the register, enter their phone number, and choose how they want to pay (credit, debit, or checking.) Source: Fortune

we tried this with scanners at work today. didn't work for us.

How are the bad guys going to get a cast of someone's finger without their cooperation?

Posted: 1/25/2006 5:30:41 PM EDT

[#5]

actually the forum on that site had a good discussion on that. it really doesn't look that hard if you have the will to do it. <assuming you can make it work>

mike

Posted: 1/25/2006 5:49:14 PM EDT

[#6]

I still wanna try the trick of turning an air can (think PC cleaner air in a can) upside down and "freezing" the last print and using a rubber glove or something...

OH!! Im emailing Mythbusters on this one...

Posted: 1/25/2006 5:51:40 PM EDT

[#7]

Quoted:
I still wanna try the trick of turning an air can (think PC cleaner air in a can) upside down and "freezing" the last print and using a rubber glove or something...

OH!! Im emailing Mythbusters on this one...

But your ambient body heat should melt the "frozen" superthin print..

If you send an email to Mythbusters, tell them how tracers really work.

Posted: 1/25/2006 5:56:57 PM EDT

[#8]

Quoted:
Quoted:
I still wanna try the trick of turning an air can (think PC cleaner air in a can) upside down and "freezing" the last print and using a rubber glove or something...

OH!! Im emailing Mythbusters on this one...

But your ambient body heat should melt the "frozen" superthin print..

If you send an email to Mythbusters, tell them how tracers really work.

And that they're not illegal.

Dang Californians.

Posted: 1/25/2006 6:00:47 PM EDT

[#9]

Quoted:
Quoted:
http://www.realtechnews.com/posts/2570

How are the bad guys going to get a cast of someone's finger without their cooperation?

You don't want to know. Something involving finger theft.

Posted: 1/25/2006 6:06:26 PM EDT

[#10]

Quoted:
How are the bad guys going to get a cast of someone's finger without their cooperation?

First thing that came to my mind:

Posted: 1/25/2006 6:15:22 PM EDT

[#11]

All your Play Douh are belong to us

Posted: 1/25/2006 7:40:23 PM EDT

[#12]

Quoted:
Quoted:
How are the bad guys going to get a cast of someone's finger without their cooperation?

First thing that came to my mind:

www.creativecookware.com/images/cleaver%20knife%20set3.JPG

You'd have to stick it up your butt to keep it at the proper tempature.

Posted: 1/25/2006 7:42:53 PM EDT

[#13]

Quoted:
Quoted:
How are the bad guys going to get a cast of someone's finger without their cooperation?

First thing that came to my mind:

www.creativecookware.com/images/cleaver%20knife%20set3.JPG

I was thinking bolt cutters

Posted: 1/25/2006 7:44:16 PM EDT

[#14]

Quoted:
we were able to get ours to read maybe 1 out of 20 or so tries. not consistant enough to be useful. the head of the security department was with us when we tried it. he was really interested to see if we could hack it.

I guess that depends on the "pain" a perp feels when rejected.

If I get 1 out of 20 "jackpots", with no detriment to my freedom or activity, it's still easy money.

Posted: 1/25/2006 7:54:10 PM EDT

[#15]

Isn't this just a rehash of the gummy bear hack from a few years ago??

Posted: 1/25/2006 8:04:19 PM EDT

[#16]

Quoted:
Quoted:
How are the bad guys going to get a cast of someone's finger without their cooperation?

First thing that came to my mind:

www.creativecookware.com/images/cleaver%20knife%20set3.JPG

The startup I worked for developed a unique scanner.

The sensor generated an RF that penetrated into the deeper levels of the skin. The RF field measured the capatance changed as the ridges valleys of the print passed the scanning area.

Using a severed a finger would not work, as the dielectric constant of the tissue would change from the loss of blood etc. Not bad for a $10 part.

I think it would be impossible to spoof the ultrasound scanners ($$$$).

Posted: 1/25/2006 8:22:02 PM EDT

[#17]

You don't need boltcutters... some of those hook shaped plant trimmers should do it.

Posted: 1/25/2006 8:26:06 PM EDT

[#18]

Getting the positive impression of the finger print is the tough part - the negative impression shouldn't work. A Chinese hacker demo'ed this about 18 months ago using clear tape, Photoshop, a copper circuit etching and gummi bears. I've been using a u.are.u fingerprint scanner on my home computer for three years or so ... they haven't cracked in yet (as far as I know).

Posted: 1/25/2006 8:27:30 PM EDT

[#19]

Quoted:
they haven't cracked in yet (as far as I know).

As far as you know....

Posted: 1/25/2006 8:31:48 PM EDT

[#20]

btw- and I know I don't have to say it here... dont ever sign up for any of that shit. (biometric payment)

1984 is still 22 years late, I'd like it to take a little longer.

Posted: 1/26/2006 4:09:11 AM EDT

[#21]

the big problem we had was get the right pressure to allow it to scan properly yet not enought to deform the playdough.

Posted: 1/26/2006 10:16:51 AM EDT

[#22]

The two greatest challenges I see are:

1) How do you obtain a good impression to begin with?

2) Unless there is no one around and the cameras aren't watching, you're going to look like an idiot pulling a piece of playdoh out of your pocket. It would be hard to do this without being obvious about it.