Fingerprint forgery training: Easy to learn, hard to perform

D 2023

Fingerprint forgery training: Easy to learn, hard to perform

KRUŽÍKOVÁ, Agáta a Václav MATYÁŠ

Základní údaje

Originální název

Fingerprint forgery training: Easy to learn, hard to perform

Autoři

KRUŽÍKOVÁ, Agáta a Václav MATYÁŠ

Vydání

Benevento, Italy, Proceedings of the 18th International Conference on Availability, Reliability and Security, od s. 1307-1313, 7 s. 2023

Nakladatel

Association for Computing Machinery

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10200 1.2 Computer and information sciences

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14330/23:00131644

Organizační jednotka

Fakulta informatiky

ISBN

979-8-4007-0772-8

Klíčová slova anglicky

usable security; fingerprint forgery; spoofing; IT security; authentication

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 7. 4. 2024 23:22, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

Many services offer fingerprint authentication, including sensitive services such as mobile banking. This broad adoption could make an impression to the end-users that fingerprint authentication is secure. However, fingerprint authentication is vulnerable to various attacks performed even by not-very-sophisticated attackers, e.g., fingerprint forgery. Will participants perceive fingerprint authentication differently after relevant theory education and the creation of their fingerprint counterfeit to overcome misunderstandings, especially regarding security? How will they perceive the fingerprint forgery process? We prepared a hands-on seminar with fingerprint forgery simulation. We focused on the difference in perception before and after the theoretical lecture on biometrics and a practical seminar on forgery creation. We applied an uncommon approach, reconstructing the fingerprint from a photo of the actual finger rather than its print on some surface – to illustrate the case of an attack based merely on a “thumb-up” photograph. Our results show that 19\% of participants (out of 221) were successful in spoofing, according to the NIST Biometric Image Software, and 27\% of participants could register their counterfeit into the smartphone. Participants perceived fingerprint authentication as less secure after the simulation and reported their intention to use it less for mobile banking operations. They also perceived the forgery attack as easier to learn than before the simulation – but harder to perform. Our study implies that participants intend to change their behaviour based on their experience from our seminar, however, they did not consider two-factor authentication as an option.

Citovat

KRUŽÍKOVÁ, Agáta a Václav MATYÁŠ. Fingerprint forgery training: Easy to learn, hard to perform. Online. In Proceedings of the 18th International Conference on Availability, Reliability and Security. Benevento, Italy: Association for Computing Machinery, 2023, s. 1307-1313. ISBN 979-8-4007-0772-8. Dostupné z: https://doi.org/10.1145/3600160.3604990.

@inproceedings{2309397,
   author = {Kružíková, Agáta and Matyáš, Václav},
   address = {Benevento, Italy},
   booktitle = {Proceedings of the 18th International Conference on Availability, Reliability and Security},
   doi = {https://doi.org/10.1145/3600160.3604990},
   keywords = {usable security; fingerprint forgery; spoofing; IT security; authentication},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Benevento, Italy},
   isbn = {979-8-4007-0772-8},
   pages = {1307-1313},
   publisher = {Association for Computing Machinery},
   title = {Fingerprint forgery training: Easy to learn, hard to perform},
   url = {https://doi.org/10.1145/3600160.3604990},
   year = {2023}
}

TY  - CONF
ID  - 2309397
AU  - Kružíková, Agáta - Matyáš, Václav
PY  - 2023
TI  - Fingerprint forgery training: Easy to learn, hard to perform
PB  - Association for Computing Machinery
CY  - Benevento, Italy
SN  - 9798400707728
KW  - usable security
KW  - fingerprint forgery
KW  - spoofing
KW  - IT security
KW  - authentication
UR  - https://doi.org/10.1145/3600160.3604990
N2  - Many services offer fingerprint authentication, including sensitive services such as mobile banking. This broad adoption could make an impression to the end-users that fingerprint authentication is secure. However, fingerprint authentication is vulnerable to various attacks performed even by not-very-sophisticated attackers, e.g., fingerprint forgery. Will participants perceive fingerprint authentication differently after relevant theory education and the creation of their fingerprint counterfeit to overcome misunderstandings, especially regarding security? How will they perceive the fingerprint forgery process? We prepared a hands-on seminar with fingerprint forgery simulation. We focused on the difference in perception before and after the theoretical lecture on biometrics and a practical seminar on forgery creation. We applied an uncommon approach, reconstructing the fingerprint from a photo of the actual finger rather than its print on some surface – to illustrate the case of an attack based merely on a “thumb-up” photograph. Our results show that 19\% of participants (out of 221) were successful in spoofing, according to the NIST Biometric Image Software, and 27\% of participants could register their counterfeit into the smartphone. Participants perceived fingerprint authentication as less secure after the simulation and reported their intention to use it less for mobile banking operations. They also perceived the forgery attack as easier to learn than before the simulation – but harder to perform. Our study implies that participants intend to change their behaviour based on their experience from our seminar, however, they did not consider two-factor authentication as an option.
ER  -

KRUŽÍKOVÁ, Agáta a Václav MATYÁŠ. Fingerprint forgery training: Easy to learn, hard to perform. Online. In \textit{Proceedings of the 18th International Conference on Availability, Reliability and Security}. Benevento, Italy: Association for Computing Machinery, 2023, s.~1307-1313. ISBN~979-8-4007-0772-8. Dostupné z: https://doi.org/10.1145/3600160.3604990.

Přehled o publikaci