Could a Gummy Bear Access Your Phone?
Every since fingerprint recognition has been invented, it’s been marketed as one of the safest security measures in real life, being around 90% effective at protecting your phone. But what if I told you, that someone could unlock your phone with materials you could find at the dollar store!
It makes you wonder how safe biometric technology is, so in this article, we will go more in-depth about fingerprint recognition and explore the different approaches to obtain a fingerprint. I also attempted to capture my own fingerprint with a glue mold and test it against my iPhone 8, so you can try this experiment for yourself right here or check out my video.
What is Fingerprint Recognition
Fingerprint recognition is the most popular and efficient form of biometrics today. It exists everywhere, being most common in our phones.
How fingerprint recognition works in a nutshell, is that a scanner takes an image of your fingerprint, compares it to a stored image, and if the images match, you are granted access to your command, but if they don’t match, you are denied access.
It's a great biometric tool to use since everyone has a unique fingerprint and no fingerprint ever changes when aging, unless changed by unnatural causes. Not even identical twins have the same fingerprint, and the chances of so many phone companies favour fingerprint recognition for its simplicity.
However, there are some downsides to fingerprint recognition like your fingerprint becoming unrecognizable due to injuries on your finger, or other substances like dust or sweat coating your print. This is called a false negative when the user’s own fingerprint is rejected.
A false positive is when an invalid fingerprint is accepted, and this can be dangerous since your phone can be accessed by others. However, this is rare as fingerprint technology is very reliable against unknown fingerprints, so most criminals bypass fingerprint sensors by creating a copy of the user's fingerprint.
We are going to be that criminal and look at all the possible ways we can copy a person’s fingerprint to unlock their phone, but first, we must understand the structure of a fingerprint to do so.
The Sketch of a Fingerprint
Fingerprints are unique complex patterns made up of friction ridges, which are the raised portion of your fingerprint and thumbs. Friction ridges appear everywhere on our bodies from our palms, toes, and feet, but we mostly acknowledge them in our fingerprints.
Friction ridges are mainly categorized into three different patterns, which are loops, whorls, and arches.
- Loop prints are ridges that curve back into themselves to form a loop shape. These prints are divided into radial loops which are loops pointing towards the thumb and ulnar loops which are pointing towards the pinky. They are the most common print as 60% of the population accounts for them.
- Whorl prints are ridge patterns that form a circular pattern like a whirlpool. There are 4 different types of whorl prints, but all those prints make up 35% of the pattern types.
- Arch prints are ridge patterns that create wave-like patterns. The two types of arches are plain and tented arches, where tented has a steeper wave than plain. They are by far the rarest pattern as they make up only 5% of the population.
Once classified as one of the fingerprints above, forensic scientists can then classify the fingerprint by the minutiae.
Minutiae are the points where the friction ridge lines end or split, and they are the main part of the fingerprint that is unique, which makes it a great pattern to match with other prints. There are many types of minutiae, but here are a few types.
- Ridge Island: A smallish ridge line that occupies a middle space between two diverging ridges.
- Ridge Ending/Termination: A dead end in the ridge.
- Ridge Dot: Extremely small ridges.
- Ridge Bifurcation: The point where a ridge splits into two or more ridges.
- Ridge Enclosure/Lake: When a ridge splits into two and joins back to form one shortly.
The Three Types of Prints
There are other ways to obtain a fingerprint rather than getting the original user’s finger. One of which is finding prints left behind on objects, which you can collect for your own use. There are three types of prints you can create…
- Plastic Prints are 3D impressions and they are made by pressing your finger in molding materials such as wet paint, wax, and soap. They are easily seen by the eye and don’t require any processing for visibility.
- Patent Prints are created from the residue of foreign substances on someone’s finger. These substances are usually liquid such as blood, oil, or ink, and they leave a visible print on a smooth surface.
- Latent Prints are formed from natural oil produced by the skin. They can be found on various smooth surfaces, however, they require further processing as they are near invisible to the human eye. Fingerprint powder or ultraviolet light is mainly used to discover these types of fingerprints.
How to Steal a Fingerprint
Making a physical copy of a fingerprint is difficult, as you must acquire the original print as a template, but chances are that someone won’t let you take their fingerprint under their will, so there are three other ways to thieve someone’s fingerprint.
Making a mold
Using a mold is one of the most efficient and cheap ways to capture a plastic print. Household molding materials you can use include modeling clay, playdough, dental mold, and even the gelatin of gummy bears.
Once you obtain the fingerprint in the mold, you can use it to access anything. The downsides, however, are implanting the mold in the victim’s finger, since the victim would most likely be aware you are pushing molding materials in his finger.
Obtaining a scanner image
Believe it or not, you can obtain an image of a scanned fingerprint online, through companies that store biometric data, or even through the darknet. Once you have obtained your image, illegal or not, it must be turned into a 3D model via a 3D printer, which you can then use to access the user’s security.
Photographing a fingerprint on any glass surface
If you’ve noticed your victim touching any glass object like a wine glass, chances are that the remnants of a latent print may be left there.
You can take a high-definition photo of it, process the image for increased clarity, and finally create a 3D model of it through a 3D printer, making sure you have the correct dimensions and the right material (since some fingerprint scanners with capacitive screens function on electric charges).
The Different Types of Scanners
In the past, forensic scientists had to identify fingerprints by hand. Now we have revolutionary machines that can analyze fingerprints in seconds to determine if a print is a match or mismatch. The three most common scanners are optical, capacitive, and ultrasonic sensors.
Optical scanners
Optical scanners work by capturing an optical image of your fingerprint. It then analyzes the minutiae on your fingerprint by differentiating the light levels on your fingerprint, which results in the ridges being the lightest and the valleys being the darkest, so an additional light source is used to brighten the print.
This is the oldest and most common method for fingerprint capturing, and the major drawback of this scanner is that it can easily be fooled. Since this technology is based around 2D images, molds and even high definition images can fool this scanner.
Capacitive scanners
Capacitive scanners use an array of tiny conductive plates to collect your fingerprint. These plates are extremely small, and when your fingerprint ridges come into contact with these plates, it creates a full circuit since your skin can conduct electricity, resulting in a voltage drop in those plates.
Only your fingerprint ridges come in contact with these plates, not the valleys since there is a tiny air gap between your skin and the plate, and this maps out your fingerprint. Capacitive scanners are a lot tougher to fool since 2D images and some molds won’t work, which is why they can be found on phones.
Ultrasonic scanners
Ultrasonic sensors work by using echolocation similar to a bat. It uses an ultrasonic transmitter to send signals, and an ultrasonic receiver to receive signals. When it sends an ultrasonic pulse against the finger, some of the pulses are absorbed in the valley, but the other pulses bounce back due to fingerprint ridges and minutiae.
This creates a complex 3D model of your fingerprint. It’s currently in development to be integrated into phones, and it’s a more secure alternative to capacitive sensors. Qualcomm is a company working on integrating better ultrasonic fingerprint technology in phones.
Analyzing our Opponent
Clocking in with an A11 six-core Bionic chip, standing at a whopping 5.45 inches tall and weighing 5.22 ounces, the iPhone 8 is a fierce opponent to crack with its revolutionary fingerprint scanner.
The phone utilizes a capacitive scanner on the home button to capture images of your fingerprint in a 360 degrees orientation.
Apple’s Touch ID then categorizes each fingerprint into an arch, loop, and whorl, and then it lays out the details of the minutiae and compares the data to the stored fingerprint. To compensate for a better user experience, the sensor only looks for a partial match to make it easier for the user to open.
Since I don’t have access to a 3D printer, I will only be testing the effectiveness of homemade molds on this iPhone’s scanner.
Testing the Molds
I tested two different types of molds for this experiment, which were glue and playdough molds.
I first melted a hot glue stick over a candle to create a blob of glue on the tip. I then placed that glob on a piece of cardboard. From there, I proceeded to dip my thumb in water and imprint my thumb in the blob of glue so it leaves a mold of my fingerprint when hardened. I repeated this process 8 times and waited for the glue to cool down a bit.
After that, I poured liquid Elmer’s glue and let the glue settle for a day. While that was drying, I also created playdough molds simply by imprinting my thumb in a ball of playdough.
When the day came to test it, I used my index finger to weld the thumb molds and I pressed it against my phone’s scanner. Unfortunately, not a single mold worked. I tried all of the glue molds and the playdough molds, but not a single one of them could open my phone.
Analysis
Let’s see how the molds were defeated. First of all, since the iPhone 8 contains a capacitive sensor, it requires a conductible material to function, both of which playdough and Elmer’s glue isn’t conductive.
The molds also came out flat or slightly indented inwards, and since the scanner scans your fingerprint in a 360-degree rotation, it could possibly detect a faulty fingerprint.
So to conclude, it seems like all basic household molds won’t work against modern fingerprint scanners, but it may fool more primitive scanners such as optical sensors or weaker capacitive sensors.
Sources of Error
There are plenty of sources of errors that could have potentially changed the result of my experiment. Some of which include:
- Air bubbles in the glue could have caused the ridges to be deformed.
- Leaving the glue out to dry for a day may have caused the print to become too rigid and lose its elastic properties.
- The molds may not have been big enough to capture the surface area of the entire scanner.
- The playdough may have been too soft and it might have torn easily upon contact with the scanner or my finger.
- The playdough could have been too thin and the scanner scans right through it.
It’s unfortunate that none of the molds worked, and all these sources of errors could have contributed to a faulty fingerprint, but at the same time, it’s relieving to know that fingerprint recognition has greatly improved over the past years, considering you were able to do this on an iPhone 5.
With time, fingerprint recognition is only going to get better, so be prepared to see a surge of biometrics in everything!
TL;DR
- Fingerprint recognition works by comparing a taken image of your print to a stored one.
- Fingerprints consist of complex patterns of raised portions of your fingerprint called friction ridges, which are characterized into arches, loops, and whorls. Can be deeper characterized by the minutiae too.
- The three types of prints left behind are plastic prints (molds like wax), patent prints (blood, ink), and latent prints (natural oil).
- Stealing a fingerprint can either be done by making a mold (the project I replicated), obtaining a scanner image, or photographing a print on glass. My glue and playdough molds failed to open an iPhone 8’s Touch ID.
- The three types of fingerprint scanners are optical, capacitive, and ultrasonic, all of which authenticate in different ways.
If you want to see more articles about biology, technology, and other things, you can subscribe to my Medium to check out the rest of my articles. You can also check out my Linkedin and subscribe to my newsletter. Thanks for reading!
