That Fingerprint Sensor on Your Phone Is Not as Safe as You Think
Full human fingerprints are difficult to falsify, but the finger scanners on phones are so small that they read only partial fingerprints. When a user sets up fingerprint security on an Apple iPhone or a phone that runs Google’s Android software, the phone typically takes eight to 10 images of a finger to make it easier to make a match. And many users record more than one finger — say, the thumb and forefinger of each hand.
Since a finger swipe has to match only one stored image to unlock the phone, the system is vulnerable to false matches.
“It’s as if you have 30 passwords and the attacker only has to match one,” said Nasir Memon, a professor of computer science and engineering at N.Y.U.’s Tandon School of Engineering, who is one of three authors of the study, which was published in IEEE Transactions on Information Forensics and Security. The other authors are Aditi Roy, a postdoctoral fellow at N.Y.U.’s Tandon School, and Arun Ross, a professor of computer science and engineering at Michigan State.
Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number.
Apple said the chance of a false match in the iPhone’s fingerprint system was 1 in 50,000 with one fingerprint enrolled. Ryan James, a company spokesman, said Apple had tested various attacks when developing its Touch ID system, and also incorporated other security features to prevent false matches.
Google declined to comment.
The actual risk is difficult to quantify. Apple and Google keep many details of their fingerprint technology secret, and the dozens of companies that make Android phones can adapt Google’s standard design in ways that reduce the level of security.
Stephanie Schuckers, a professor at Clarkson University and director of the Center for Identification Technology Research, was cautious about the implications of the MasterPrint findings. She said the researchers used a midrange, commercially available software program that was designed to match full fingerprints, limiting the broader applicability of their findings.
“To really know what the impact would be on a cellphone, you’d have to try it on the cellphone,” she said. She noted that cellphone makers and others who use fingerprint security systems are studying anti-spoofing techniques to detect the presence of a real finger, such as looking for perspiration or examining patterns in deeper layers of skin. A new fingerprint sensor from Qualcomm, for example, uses ultrasound.
Credit
Roger Kisby for The New York Times
Phone makers also said that the ease of touching a finger to unlock a phone meant more users actually turned on security features instead of leaving their phones unlocked — a common habit in the early days of smartphones.
Dr. Ross acknowledged the limitations of the work. “Most of the current smartphone vendors do not give us access to the fingerprint image,” he said.
Still, the team’s fundamental finding that partial fingerprints are vulnerable to spoofing is significant, said Chris Boehnen, the manager of the federal government’s Odin program, which studies how to defeat biometric security attacks as part of the Intelligence Advanced Research Projects Activity.
“What’s concerning here is that you could find a random phone, and your barrier to attack is pretty low,” Dr. Boehnen said.
Phone makers could easily increase security by making it harder to match the partial fingerprint, he said, “but the average phone company is more worried about you being annoyed that you have to put your finger against the phone two or three times than they are with someone breaking into it.”
Adding a larger fingerprint sensor would also decrease the risk, Dr. Boehnen said. And some newer biometric security options, such as the iris scanner in Samsung’s new Galaxy S8, are harder to fool.
Dr. Memon said that despite his research he was still using fingerprint security on his iPhone.
“I’m not worried,” he said. “I think it’s still a very convenient way of unlocking a phone. But I’d rather see Apple make me enter the PIN if it’s idle for one hour.”
