Hacking Multifactor Authentication

16Attacks Against Biometrics

This chapter covers attacks against MFA solutions that use biometrics as part of their authentication factors and explores the various ways to hack them. This subject includes a lot of information, so it will be one of the longer chapters.

Introduction

Many years ago, I was on a team that was tasked with seeing if we could hack fingerprint readers. The organization we were working for was considering requiring biometrics for network logon and wanted to know whether or not the fingerprint readers could be fooled. If you watch spy TV shows or movies, it seems like any fingerprint reader can be easily fooled by any spy, but we wanted to see if that is reality. Fingerprint system vendors would have you believe that it is mostly hype and is far more difficult in real life.

We purchased 22 different fingerprint readers—some as part of laptops in which they were built in and others as stand-alone devices. We had finger swipe–style, bar readers, where you swipe the first joint section of your finger front to back across a thin fingerprint reading sensor, as well as pad-style, where you simply pressed or rolled your first finger joint across a flat glass or plastic pad.

Long story short, we hacked all of them with fake fingerprints using multiple methods. Nearly every single method we tried worked across a majority of them. Fake gelatin fingers, check! Silly Putty fingers, check! Rubber glue fingerprints, check! My favorite hack was simply cupping my hands ...