This should not be news to anyone. Chaos Computer Club demonstrated almost the same technique in this 2006 video https://www.youtube.com/watch?v=OPtzRQNHzl0
Yeah, this isn't new. It's just cheaper.
[deleted]
Fingerprints can be hacked
291–300 of 333 posts
Re: Fingerprints can be hacked
#292Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain p…
There is a reasonable chance that the print is available on the very device it is needed to unlock (the phone screen, for example), perhaps enough for a thief who snatches your phone to have a decent chance.
Re: Fingerprints can be hacked
#293Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain p…
>If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentic…
You'd be surprised how low the bar is for "highly technical" among the general populace, particularly those inclined to steal used technology from targets of opportunity. How many people do you know who even own a laser printer, a subscription to photoshop and the skill to use it, and know what an "acetate sheet" is? The vast majority of people, if they have a printer at all, use cheap inkjets, they don't know how to use photoshop and don't care to learn, and they've never heard of acetate sheets.
Could an enterprising criminal master this technique? Sure, but I'm not convinced it's reliable or lucrative enough to make the time/risk investment worth it for someone with that skill-set.
Re: Fingerprints can be hacked
#294Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain p…
There is a reasonable chance that the print is available on the very device it is needed to unlock (the phone screen, for example), perhaps enough for a thief who snatches your phone to have a decent chance.
Assuming they have a laser printer, photoshop skills/subscription and know about acetate sheets. I'm willing to bet most phone snatchers don't even have one of those ingredients.
Re: Fingerprints can be hacked
#295Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain p…
Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole different and enormously scarier/more challenging threat scenario. > Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. Isn't that genuinely getti…
I'm no guru but the only widespread use of spy cameras for password theft I've heard of is false covers on ATMs to catch PIN codes, which makes sense as an ATM eliminates a lot of variables. (angle camera needs to be at, number/size/position of keys on keyboard, required resolution/range, increased number of victims, etc).
In the wild I imagine it's one of those things that's simple in concept but difficult in execution due to all the edge cases. Even if you get 80% of a password, if you're not at the perfect angle to catch those last few key-strokes you haven't accomplished much.
Re: Fingerprints can be hacked
#296Earlier quoted context omitted.
Not since June 25, 2011 when they started randomizing assignment[1]. They still don't use 666 as an area number, though. [1] https://www.ssa.gov/employer/randomization.html
This is a good change, but since it's not retroactive anyone born before that date (which is 100% of adults and probably roughly 50% of minors, who are likely not good targets for identity theft) are still at risk.
And it's still a problem since everyone uses it as a secret, not a username. So if leaked, you are still at risk. This is why the number realy should have been public from start so companies would not get the idea to use it as password.
Re: Fingerprints can be hacked
#297Earlier quoted context omitted.
There is a reasonable chance that the print is available on the very device it is needed to unlock (the phone screen, for example), perhaps enough for a thief who snatches your phone to have a decent chance.
Assuming they have a laser printer, photoshop skills/subscription and know about acetate sheets. I'm willing to bet most phone snatchers don't even have one of those ingredients.
Most phone snatchers aren't after the information on the phone. The point is not that this would not be a targeted attack (it would be), but that it might not require a particular combination of circumstances or set-up to follow one around and snap just-the-right-angle photo.
Re: Fingerprints can be hacked
#298Earlier quoted context omitted.
wait it's based on birth month/year/place? is there an algorithm to generate it or something?
There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is t…
My dad and myself have SSN numbers that are 5 apart because we immigrated at the same time.
Re: Fingerprints can be hacked
#299Earlier quoted context omitted.
And what is involved in the DNA sequencing? And the DNA assembly service will probably take record of the operation itself (it is not a common service). In the context...
OP was referring to state level actors.
Interesting (I had not thought of that side), but it remains revealing. When there is reason to suspect that the case was manipulated it may suggest that that level of capability is involved. Or that somebody "rubbed a drinking glass" on the scene...
Re: Fingerprints can be hacked
#300As an IT professional you should know to never use fingerprints or facial recognition for logins.
It seems you are stating that biometrics should not be used to restrict account access according to specific individuals ("John can only access john.harrey and finance.12")
Not bio-metrics but passive logons. Retina scanners can detect this I believe. Fingerprints are used by criminals to get access to services. Girl follow guy home. Drug him and then a team uses the fingerprints. May even take pictures to avoid having the person report to the police. It happened here in my city, in western Europe, so it can happen pretty much everywhere.