Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Saturday November 02 2019, @04:26AM   Printer-friendly
from the under-your-thumb dept.

Submitted via IRC for AndyTheAbsurd

Hackers Unlock Any Phone Using Photographed Fingerprints In Just 20 Minutes

According to the Chinese blog Abacus, Tencent's X-Lab team showed how this technique works at the recent GeekPwn 2019 hacking conference in Shanghai. X-Lab's leader Chen Yu asked an audience member to touch a glass and took a photo of the fingerprints.

Yu then ran the photo through an app they have developed in house, which extracts and process the necessary data to clone a physical fingerprint. The team didn't show the physical cloning process, but we can assume that they used a 3D printer like other people have done in the past. He then proceeded to use the cloned fingerprint to open three smartphones that had been registered with the audience member's fingerprint — plus two event registration machines that use fingerprint scanners.

[...] Each of those phones used one of the three existing fingerprint scanning technologies: capacitive, optical. and ultrasonic, like the one in the Samsung Galaxy S10. The latter one is especially worrying, since this technology is supposed to avoid this type of hack by scanning the three-dimensional structure of your fingerprint.

[...] In other words: fingerprint security sucks. And facial identification is not that much better, really. If you are really worried about security, the only thing you can do is probably use a longer password.

Still harder than shoulder-surfing or having no password, right?

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by vux984 on Saturday November 02 2019, @11:34PM

    by vux984 (5045) on Saturday November 02 2019, @11:34PM (#915158)

    "No qualms with things such as RSA generators beyond the fact that they're ultimately useless since basically all sites will allow you to reset your generator even if you lose your generator and your 1-time emergency key for it."

    This is pretty much it right here.

    That said...

    One factor authentication, passwords, have not been shown to be able to be effectively bypassed, let alone trivially, in any way, shape, or form.

    Well, except for all the truly shitty I forgot my password reset systems out there.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2