Picking a biometric lock

Question

Suppose there's a vault secured with a numeric code and a biometric sensor. What technologies and methods could be used to open the vault if a character isn't registered on the system?

Here are a few biometric systems I'd be interested in seeing solutions to bypassing and some ideas I have already considered, though don't know if they're viable.

Finger-/handprint sensor -- A device that reads one or more fingerprints or the entire hand, requiring a 97% or better match to unlock.

• Cut off the hand of a valid user (seems rather violent and not feasible for a burglar)

• Place a sheet of material (graphene?) on the sensor thin enough to not be noticed and thick enough to record the finger-/handprint of a valid user

Genetic sensor -- A device that retrieves a fresh sample of DNA from a user, requiring a 97% or better match to unlock

• Retrieve a sample of a valid user's DNA from a third party (Red Cross looking for blood donors!) and construct a fake hand from pig flesh

Iris sensor -- A device that examines a user's eye, requiring a 97% or better match to unlock

• Rip the eye out of a valid user's head (again, infeasible for a burglar)

• Construct a device that mimics the pattern of a valid user's eye (though I don't know how to go about getting the pattern)

Face sensor -- A device that performs facial recognition, requiring a 97% or better match to unlock

• Use a 3D printer to create a foam replica from pictures of a valid user

These are just some of the biometric sensors I can think of. Answers to this question should be limited to bypassing the biometric portion of the vault security without resorting to drills and other vault penetration tools (or removing the power source) and should result in a minimum of proof of a burglar's presence. If there are other biometric systems you can think of, feel free to share them and a possible way to bypass them.

Answer 1

The three main biometric authentication technologies are fingerprint, iris, and face recognition. DNA-based identification is generally too slow to act as an identification token, requiring hours to process. However, I'll go through all four.

I'm going to assume that this is your standard cat-burglar/heist scenario, where the ultra-paranoid target is the only one with access, but any technique can be used to defeat the system. Cases like gaining access to a high-security facility are more difficult, since you are limited to methods that won't alert watching security personnel, and you may also be required to disguise yourself.

• Fingerprint recognition is trivial relatively easy to defeat. For example, it is already possible to fool Apple's TouchID using nothing more than an image of the authenticated user's fingerprint (and their fingerprints are generally all over the phone's glass!). In this video I watched recently, some guys manage successful authentication of a fake fingerprint on their first attempt (although they make a mold from the finger directly). With slightly better techniques, it is possible to create a detailed mold from an image of the fingerprint (that is, the mark left by the finger, not the actual finger itself), and make a fake fingerprint that way. You only need to acquire an image of the target's fingerprint (how exactly I'll leave up to you). Note that their specific technique (using graphite-impregnated silicone rubber) is only required for the iPhone's capacitive fingerprint sensor. For your more typical image-based sensor you only need a shape-accurate mold.

• Modern iris recognition typically works by taking an image of the iris in visible or near-infrared light and comparing it to a database. (Some implement additional live-tissue verification by changing illumination conditions to test whether the pupil contracts and dilates, but this is not typical.) A typical system could be fooled by presenting it with a high-resolution image (scaled 1:1) of the target's eye. Actually creating the image is not a problem: I've gotten very good images of my own eyes with Nikon's base-level DSLR (D3300) and cheapest macro lens (f/2.8 40 mm MICRO-NIKKOR) (the only difficulty was not being able to see the camera while lining up the shot!). The problems are in printing the image with the requisite resolution (a photographic reduction on either film or photographic paper should work), and actually getting access to your target's eye. (You might have to c-a-r-e-f-u-l-l-y open his/her eyes while they're sleeping, perhaps after slipping them a sedative.)

• Face recognition could conceivably be fooled using modern technology to create a face-mask. In Mission: Impossible III (starting at around 47 minutes in, if you happen to own the film) the heroes take several images of their target's face, using them to create a 3d model, which is then turned into a physical mask. Again, I've had success with such a technique: using an online service to make a 3d model out of images of my own face (still frames from a video of me turning slowly on an office chair), and then 3d-printing the model in plastic (albeit at a reduced size). With access to the proper software and a large-format, high quality 3d printer, you could definitely recreate someone's face from photographs. Of course, you could always just show one of the pictures to the camera, it would probably work.

  • Side note: in the same sequence from M:i:III, the heroes use a magic voice-changer sticker on the throat (under the facemask) to imitate the target's voice. While the depicted technology is probably not realistic, you could probably fool a voice-recognition system with a high-fidelity recording. Pose as a reporter and interview your target, in the process asking his/her name. (If the lock requires a voice password, you'll have to figure out what it is and reconstruct it from numerous audio clips.)

• Since DNA identification is not done in real life, I won't spend a lot of thought on this. However, you might look to the movie Gattaca for inspiration. The hero uses several methods to fool the movie's omnipresent DNA scanners, including blood-filled false fingertips for , and at one point secretly injecting himself with blood while a sample is being drawn (it's a great movie, but at times can be a little uncomfortable to watch for someone as squeamish as me). This clip shows some others methods. However, these all require a cooperative target who can give as much material as necessary. Your Red Cross idea is a good one, but your target may not give blood, like me (did I mention I was squeamish?). DNA can also be harvested from saliva, hair follicles, skin cells and other sources, so you might just need to dig through their trash. And if you target is male and the promiscuous type, you may be able to acquire some of their, uh, "genetic material."

Finally, note that (depending on your definition of "biometric") there may be some credentials that are not possible to duplicate. See this very cool paper, which describes how a "password" consisting of a learned task (playing certain sequences of notes in Guitar Hero), subconsciously trained into a user, cannot be consciously or unconsciously disclosed by the user (meaning that it is impossible to communicate your credential to someone else, even if you want to). The system used by the researchers is impractical, but in the far future uncopyable passwords may be possible.

I wish your characters the best of luck!

Answer 2

There's another option: Go around the biometrics.

At some point, there's going to be a computer making a decision, then sending out a voltage or message to a device that activates/deactivates a solenoid/motor/electromagnet/whatever the actual locking mechanism is.

Someone skilled enough with electronics or software might well be able to bypass the biometric aspect entirely. You'd have to watch out for tamperproofing when you opened things up, but it mitght be possible to attack the system in a variety of ways.

Examples of attacks of this nature I can think of:

• Directly applying/removing voltage to the locking device
• Replacing the chip containing the firmware/storage containing the software with some of your own. (Or equally just the storage that remembers who is supposed to be let in) Directly injecting the trigger signal (be it a simple voltage on a bus/wire, or a key message
• Replacing the detector with a dummy that provides whatever the software is expecting
• Discovering a bug (or deliberate back door added by developer/intelligence agencies) that causes the software to respond in an unintended way to a specific input and open the door If the lock is networked (seems foolish, but it there is a central security office that tracks these things, not impossible) attack it through the network
• At some point, the biometrics of the persons who are authorised access have to be loaded on to the device. This gives you several routes of attack to get you, the burglar, added to it. If it's done via a network, you can try to update this directly given you get access to the target's network. If it's done via a physical file transfer, you can try to get your biometrics on to the file system, then create a reason/wait for the regular update. If details are loaded by directly interacting with the lock, then you can try and gain access to the ability to do so - it's likley a passcode or something that an administrator would have. There's probably also a way for service engineers of the manufactorer to reset things in the event that a customer loses access.

Answer 3

Finger-/handprint sensor :

Mythbusters did a test on this type of lock. They lifted a fingerprint from getting the target to burn a CD. Then did some processing (filling in missing lines).

Then to get through the lock they printed it on paper, put a little moisture on it and then they were able to use it on their own finger.

SIMPLE ANSWER: you just need paper and moisture to fool the sensor.

Answer 4

Since 2012rcampion does a good job (IMHO) covering the biometric side, I'll remind you not to overlook the obvious weaknesses not directly related to biometrics. These could still be used to break biometric security.

Back end

In a biometric system the data the biometrics is compared to is in a database as are the access rights the recognized user will get. The security of a biometric system can't be better than the security of that back-end. And the back-end needs access for administration, maintenance, and backups. And while those would presumably have high security levels it might be lower than for a vault or area a burglar tries to get in.

Hacking the administration would allow adding a new user you can match, adding access rights to user you can match, or changing biometric data of an existing user. Ability to perform a maintenance update might allow adding a back door that makes all locks open to a scan test device. Such test mode might already exist in the code and be available for use by editing some settings. The system might in general have testing, debug, or maintenance modes available.

Access to a backup, which presumably would be stored off-site, and thus might have lower security or need a data transfer that can be intercepted, might give you access to all the data you need to fool the biometrics. Presumably the biometric data would be securely hashed to prevent this, but the hashing function used might have a known flaw. Since performing updates might itself be a security risk, old code might live for a long time. And old backups might still be available with even lower security. And the biometric data would still be valid. Reminding users that the security system has been updated and they should change their DNA doesn't really work... Neither does telling people to use different DNA on different systems, so you can compromise an entirely different lower security system and have access to biometrics valid on a high security site.

People

Make somebody who has access do what you want. Realistically this would be used to bribe a systems administrator or head of security to tamper with the database. But if you have the bank managers family at a secure location with nasty people with knives, you can have access to anything the manager has access to. The same goes for the actual owner of the thing you are trying to steal, if it has one.

I doubt these examples are of direct use to you, but the general concept of dealing with a secure system by committing other crimes to make it less secure is a long tradition in fiction and should not be ignored.

Answer 5

Social Engineering

eg: Most people don't think up new passwords. They reuse their old passwords, and every website thinks they should require people to get their own account (or uses a service, which just means the service is a bigger target, and not under the website's control). Boom, lots of stolen passwords, every site needs to have good security, etc, etc.

So, you tell your target that if they want to use the new iPhone/cool-thing$^t$$^m$} they need to give up their biometric data, then you have access to that, for nearly as long as you can keep data around (biometric data can change over time, but it takes a long time).

Now that you're evil Apple, you've got 100s of millions of people's biometric data, and you can sell that to anyone who wants it. Mmm, profits. You can wait for those kids to grow up and get security jobs. Basically the same plan as cops fingerprinting children in school ("for the safety of the children!!").

Just go to Apple (or your shell company), and buy/harvest your target's data, then go and use it.

Answer 6

Go to you tube and search for the lock picking lawyer.

He has a hobby of "picking" and bypassing locks of all types.

His answer for most biometric locks is a powerful magnet. Such locks use a solenoid to retract the locking mechanism. A powerful magnet placed beside the lock will pull back the mechanism without having to energize the solenoid.