1. DEFEATING BIOMETRIC AUTHENTICATION SYSTEMS Colin O’Hanlon COSC 480 April 11, 2012

2. 4/11/2012 Roadmap Types of Biometrics Biometric Process History Strengths Weaknesses Circumventing Systems Target Hardening

3. 4/11/2012 Types of Biometrics Def: Access control process that relies on positively identifying a measurable human characteristic. Fingerprint Iris Retina Hand Geometry Signature Recognition Voice Recognition Facial Scanning DNA

4. 4/11/2012 Biometric Process

5. 4/11/2012 History 1858: William Herschel first uses fingerprints as identification 1960’s: NSA and FBI focuses on automated systems 1970’s: Advances in electronic speech recognition DARPA Speech Understanding Research program 1975: FBI funds minutiae extracting technology 1988: First semi-automated facial search LA Sheriff’s office mug shots 1990’s: Rise in real-time facial recognition efforts 1994: First iris recognition algorithm patented 2003: Congressional biometrics committee established

6. 4/11/2012 Strengths Extremely unique access variables No passwords Verify identity without external documents Link people to events Who, what, when, and where Fast, quick identification process Eliminates “lost keys” problems Stolen, copied keys No tokens or extra devices needed

7. 4/11/2012 Weaknesses False positives False rejections Reader error, colds, injury, tone, aging Cost issues Match likelihood Not Boolean like passwords, no two reads are ever the same Compromised access data Initial key extraction.5% and 10% cannot enroll due to inability to find a solid reference point

8. 4/11/2012 How Biometrics are Hacked Software-based Approach Steal data transmitted between sensor and database Add to the database Change acceptance criteria minimums Sensor-repository redirection

9. 4/11/2012 How Biometrics are Hacked Biometric Cloning Fingerprint Scanners Dusted prints Matsumoto’s gelatin fingers yield 80% effectiveness Hand Geometry Alginate Proven Time consuming Not subtle

10. 4/11/2012 How Biometrics are Hacked Sample manipulation Facial recognition Thwart surveillance over gaining access Impacts the input and damages comparison Light disruption Camouflage techniques

11. 4/11/2012 Hack Prevention Combination Biometrics Sequence of systems Multiple embedded systems Biometric incorporated with more access system information to supplement UK biometric passport facial data Smart cards and passwords to match biometrics Minimum attempt requirements Focuses on likelihood acceptance criteria Network Security Traffic encryption Network monitoring

12. 4/11/2012 Conclusion Rise of Biometrics Technical Assets and Flaws Hacking Theory Prevention

13. 4/11/2012

14. References http://www.biometrics.gov/documents/biohistory.pdf http://www.cse.msu.edu/~cse891/Sect601/CaseStudy/DNABiometricIdentifier. pdf http://www.cse.msu.edu/~cse891/Sect601/CaseStudy/DNABiometricIdentifier. pdf http://www.giac.org/paper/gsec/2282/biometrics-hack-proof/103919 http://ntrg.cs.tcd.ie/undergrad/4ba2.02/biometrics/prosncons.html http://biometrics.cse.msu.edu/multi_bio.html http://stdot.com/pub/ffs_article_asten_akaseva.pdf http://www.fbi.gov/about-us/cjis/fingerprints_biometrics http://www.itgovernance.co.za/00/index.php?option=com_content&view=articl e&id=28:security-biometrics&catid=1:latest&Itemid=29 http://www.itgovernance.co.za/00/index.php?option=com_content&view=articl e&id=28:security-biometrics&catid=1:latest&Itemid=29 http://www.theinquirer.net/inquirer/news/1029539/how-hack-biometrics http://danishbiometrics.files.wordpress.com/2009/08/t08_06.pdf http://www.pcworld.com/article/144055/biometric_hacking_tool_debuts.html http://www.biometrics.gov/Standards/Default.aspx http://www.nij.gov/topics/technology/biometrics/welcome.htm