start	end	text
12930	18050	I'm going to refresh it again and see if it wakes up.
25240	28740	Plavrdi, are you seeing this? Ah, there we go.
30780	36780	Welcome, everybody! I want to thank everybody at DEF CON for coming to watch this Q&A session.
36940	41600	I'm Fallible, we have Plavrdi as our Lagoon, and we are here with Yamila...
41600	48180	Yamila Lavache, I believe. I totally did that wrong. She'll have to correct me here in a second.
48180	50280	No, no, no. You pronounced it right.
50640	56000	The talk is Bypassing Biometric Systems with 3D Printing.
56000	58660	I'm super excited about this one.
59000	67440	Any opportunity you have to talk about the details of how do you take biometric data
67440	70600	and make it a physical thing that you can exploit
71600	73860	because this is a really cool topic.
74240	77880	I'm excited to see what more you have to say about it,
77880	83740	and we're looking forward to questions coming in from the live Q&A audience.
83960	91300	Before we get too far into this, this is, as I understand it, your first DEF CON talk.
91300	92680	Is that correct?
92860	97160	As you well know, there is a tradition here at DEF CON.
97160	102960	For your very first DEF CON talk, we like to shoot the noob.
102960	108280	So I would like you to acquire the beverage that you have prepared.
108280	109780	Excellent.
110320	112540	To tradition.
112800	113880	Cheers.
113880	115080	Cheers.
117900	119420	Awesome.
119420	120560	Wow.
120560	123400	This is my beverage.
123420	124180	Oh.
124400	127260	Ginger liquor from Switzerland.
128520	131280	My whiskey just got to me. Excuse me.
132680	133780	Okay.
133780	136440	Yeah, you can certainly refill that glass if you want to.
136440	138380	Yeah, you're welcome to. This is your time.
138380	144480	I also have Fernet because this is the beverage that we bring in Argentina.
144480	148040	It's our beverage, our preferred beverage.
148040	149200	With Coke.
150080	152800	I also have Fernet here.
152800	157340	That's your nice mixer. You get it in with the Coke and it's the national beverage.
157340	158960	I like that.
159720	160960	Well, excellent.
161400	164040	Let's get you started with this...
164700	169300	Well, you prompted me with a couple of questions, but I want to go a slightly different direction.
169680	172540	Tell us what 3D printers you have.
172540	180040	Because a 3D printer capable of doing the things at the resolution that you're working in is obviously interesting.
180140	182700	So, you have a couple of them, right?
183040	185820	Yes, I have two.
185820	190640	The first one is an FDM, a filament 3D printer.
190640	196380	It's a clone of the Prusa i3 MK2.
196380	201960	I built myself, I assembled the 3D printer myself.
202180	204540	I love it.
205480	208300	Also, it was really interesting too.
208300	214750	It took like a month, but in the end, it's great.
215120	219080	And then, last year, I bought another one.
219080	222500	A resin 3D printer, the Anycubic Photon.
222500	233740	And this is the printer that I use for this research, because I needed the resolution of a resin 3D printer.
233740	237220	I can't do the research with the other printer.
237400	242400	And it sounds like it's doing the job, so that's useful for us to know.
242400	245240	And you might have mentioned that in the talk.
245240	248400	I'm sorry, I missed it when we came through, so thank you for that.
248400	249680	I appreciate that.
249680	254240	So, what got you into this area of research?
256620	272200	Last year, I learned that some people broke the authentication mechanism of Galaxy S10 with just a silicone cover.
272400	274200	That was interesting.
274200	281400	And also, I think it was the Geek Pong cybersecurity competition.
281400	290560	The research team from Tencent broke the authentication mechanism of three different phones.
290720	297700	Taking a photo of a fingerprint, a latent fingerprint in glass.
297700	305920	And then, 20 minutes later, they had a working fake fingerprint.
305920	314440	So, I was thinking that they might have used some type of 3D printing for that.
314440	326660	And that's one of the reasons that I wanted to try and see if I, in my home, with my home resin 3D printer, I can duplicate fingerprints.
326660	335180	Also, the leakage of biometric data from companies.
335760	339160	Say that part again. The leaked cache?
339380	353540	Oh, no. The leak of biometric data from several biometric companies also was inspiration, we can say, for this research.
353540	360500	Now, I don't think I've heard of a leak of biometric data from other companies. Can you talk a little bit more about that?
361480	374500	Yes, it was last year that a leak from a biometric company and all the fingerprints and other data was leaked.
374500	387240	And I was thinking about how, if an attacker can use this information to create fake fingerprints for a person.
387240	398220	Because I can't change my fingerprints. And if my fingerprints are on a leak and a person can do a duplicate.
398660	404380	So, that was one of the reasons for doing this research also.
404380	421100	That's great. There was a question I really wanted to ask you. Is there evidence that there are people who are amassing these people's biometric data and then using that somehow?
421100	432860	I think that the way I was going to put this out there was, what of the methods that you discussed in your talk are things that we can share?
432860	439040	That I could digitize and create a database of other people's biometric data?
439760	452240	Yes, I think this technique can be used. As you can see in the paper and in the video, it's not easy, all the process to duplicate the fingerprint.
452560	460860	It takes time and experience, but I think that it can be done.
460860	471060	And also with other equipment, because my research was a very low budget one. I only have my 3D printer.
471360	481440	For example, I don't have a digital microscope to measure the reach height and something like this.
481440	493700	But I think with more resources, it could be possible to do it in a bigger scale, not just one.
494860	506060	So with that, what was your failure rate? How often did you have to reprint the fingerprints that you were creating?
506060	513740	And each of your examples, I know that you had your, hey, it worked on this version, it didn't work on this version.
513740	519620	But I didn't see where you were discussing how many times you had to try in order to get one that actually worked.
519620	526900	Yes, I have here some of the failure. I don't know if you can see. A lot of failure.
529600	535480	So I have here the molds and some of the fake fingerprints.
536600	542460	The most important thing with the duplication of the fingerprint is the size.
542460	556820	If you can configure the correct size and specifically the reach height, because we can't measure the reach height without a specific technology like the microscope.
556820	558520	I don't have one.
559780	577920	So for that reason, and also the configuration of the printer, according to the resin and this type, I print at the end, I print like 10 batches.
578400	584060	And in each one, I print several fingerprints, not just one.
584060	594520	And also I try with different, for example, I print this in a horizontal way and it works better in a vertical way.
594520	605960	You can see here that it has the support because I needed to print in vertical. The resolution was better in vertical than in the horizontal.
605960	612320	So that's information that you discover when you are testing and experimenting.
613300	616680	I wouldn't think of it before.
616820	618420	Absolutely.
618640	624980	And also I don't have experience in criminalistic or nothing.
624980	635060	It's just I wanted to try if a regular user with a 3D printer can duplicate fingerprints.
635060	638080	That was the idea of the research.
639020	642160	It's very fun to try all the other methods also.
642160	645500	Not when I burn myself with hot glue.
648000	654080	Yeah, I think that a lot of makers are going to be familiar with that particular one.
654400	655600	Oh, yes.
656820	664900	I learned about this experience and now I do it with a lot of care.
664900	666640	Live and learn. I like that.
666640	669950	So did you try these attacks on other devices?
671820	679060	I tried only on the devices that are in the paper and in the talk.
679060	684940	But also the people from Cisco, from Talos, they made very similar research.
684940	691060	I was talking from one to one of them with Paul and he used the same printer.
691060	695960	And he tested in different, totally different devices.
695960	702760	Like computers and padlocks and I think other phones.
702760	707160	So also you can make data results.
707160	714440	Because it's similar but they use the same printer and other software, different software.
714440	717220	And they test on other devices.
717220	721400	So I think it can be used to see.
721400	725080	But they succeed in most of the devices.
725080	727880	So it's an attack that is feasible.
728060	729320	Excellent, that makes sense.
729320	736520	And it's something that you can, if a person wanted to, this could be expanded into a pile of other devices.
736660	744720	So beyond just other devices, what other types of biometric attacks would you be interested in researching in the future?
746580	750960	I am very interested in facial recognition.
751180	754940	In two different aspects of facial recognition.
754940	758260	The first one is avoid facial recognition.
758260	761780	I think it's an interesting topic.
761780	766660	And the other one is using fake biometric trace.
766660	771200	For example, a mask or a 3D printed head.
771320	774360	I am working on that.
774360	779980	And I am testing this type of attacks in facial recognition systems.
779980	784960	I don't have conclusive results yet, but I am trying.
784960	789840	And I'm having a lot of fun because I love doing this type of research.
789840	791540	That's fantastic.
791740	793960	That's the right way to take that.
794560	798860	Let's check, do we have any good questions coming in?
800200	803060	Not seeing too many questions coming in.
803060	808340	A lot of people are talking about some of the data dumps that have been coming through.
808840	813420	Many thousands of fingerprints getting released.
814100	818800	That could be a problem with government and federal contractors.
819320	822680	Fingerprints getting released to the public as well.
822680	827340	Which is a really interesting thing to direct the conversation towards.
827340	830680	As more and more people are...
832120	834900	As more of this data is out there and available.
835420	841460	The type of research you are doing is probably more important for some of these companies.
841460	845300	It's that old statement, I think you even said it in your talk.
845300	849700	That once your biometric data is out there in the world.
849700	853500	You only have 10 fingers.
853620	854620	You can't reset it.
854620	856660	You can't reset those.
857000	863960	I think that my ocular scan is owned by Microsoft somewhere.
864480	871100	There is only a limited number of options that you have.
871820	881940	You are definitely going in the direction of the physical manifestation of these rebuilding things physically.
883200	885100	What would be...
886740	893300	You already mentioned that having a good microscope would help you approach the next...
893820	896120	Whatever the next milestone is on this.
896120	900360	If you can't really measure the ridge height, then you are having a difficult time.
901300	903980	Determining which ones are going to work or not.
904300	909340	What other pieces of technology do you think you'd want in order to move your research further?
911220	916540	I think for the resolution of the printing.
916540	921780	I think with my 3D printer it's okay.
922340	926980	Perhaps with a better 3D printer.
926980	933880	We will succeed in less tries.
933880	937720	But also the microscope will be good.
937720	941440	Because the worst problem was the ridge height.
941440	943060	I needed to try.
943060	947000	I know the normal human ridge height.
947000	954840	But I need to try a lot to find out the exact one to duplicate the fingerprint.
954840	958540	So that was a lot of tries.
958640	960120	That makes sense.
960300	962380	We did have one question come in.
963520	969340	Lefebunachi wants to know, do you think you'll be back next year to discuss facial recognition?
969460	977080	And what might help you to be able to do enough research to be able to present on that next year?
978300	979040	No.
981080	982280	Yes, I don't know.
982280	983900	I am trying.
983900	989700	Now we are working with the masks and the 3D printed head.
990000	991680	We need a scanner.
991680	993540	It's another technology.
993540	997340	So we are trying to achieve that.
997340	999680	But I think it could be possible.
999680	1002400	With this research or with others.
1002940	1008600	It was always my dream to contribute with DEF CON in some sort of way.
1008600	1012500	And I'm very happy to present a talk this year.
1013860	1017500	Well, you definitely hit the ground running with this one.
1017680	1020880	I really like your research and the way you put this together.
1021600	1026780	I love that Palavrity just came up with this idea to share with me.
1027140	1038480	And I think you actually talked about this a bit in your talk of creating fake fingerprints for yourself so you could be somebody else to an effect.
1038600	1044800	Would you talk a little bit about the TSA agents in some other country?
1044800	1052780	Was it Argentinian TSA agents or somebody that got fired for using fake fingers?
1053600	1054200	Yes.
1054200	1062640	Here in Argentina, the local airline fired, I think it was six people.
1062640	1065180	Because they were using silicone.
1065180	1068940	I am going to show... I have now the silicone.
1069240	1074700	This is just a silicone fingerprint.
1074700	1082320	But they use a silicone finger to impersonate the different users.
1082320	1089880	To try to... I don't know how to say the word.
1089880	1096580	But they try to falsify their entry to work.
1097120	1100340	The different people.
1100340	1102320	So, only one of them...
1103400	1105560	If show time is six o'clock.
1105560	1107300	Show to people.
1107300	1109320	Show to the work, sorry.
1109320	1113600	And with the other five people, silicone fingers.
1113940	1114820	Wow.
1115940	1117380	That's fascinating.
1117460	1123500	Because you always heard of times when one person would go into work and just pull the punch cards for everybody and put those in.
1123500	1126380	So they thought they solved it by forcing the fingerprint.
1126380	1131460	And it sounds as though they were like, yeah, we'll just do silicone reprints of everyone's fingerprints.
1131780	1132460	Sign them in.
1132460	1140580	Another interesting side of this story is when I was showing this research to friends and people,
1140720	1145560	a lot of them asked me to reproduce their finger for this type of...
1145560	1147400	Of course, I don't.
1147400	1149220	Of course, I don't.
1149220	1160280	But a lot of people asked me, especially in optical sensors, asked me for a silicone copy of their...
1160280	1164420	But no, don't DM me asking for that.
1164420	1166840	Well, I mean, that is the next question, right?
1166840	1172340	If you've done a bunch of these different systems, are you talking about an optical fingerprint scanner?
1172340	1174820	Or are you talking about the retina scanner?
1174980	1179900	Because I would really like to know how you would attack something like a retina scanner.
1180860	1187400	Yes, we are not attacking iris yet.
1187400	1188020	Not yet.
1188020	1193000	And also the finger vein.
1193000	1204510	I was trying to get one of these.
1205540	1211300	I'm talking to the vendor, but not yet.
1211300	1212640	You haven't managed it yet.
1212640	1218240	Well, maybe someone who has some access to that is listening now and will go,
1218240	1220520	Oh, well, we need to make sure you get that.
1220520	1227580	So hopefully that's something that will come of your DEF CON talk time.
1229080	1237300	So, let's see, people are doing more commentary in the chat channel about some of the relative comfort
1237300	1242620	or how often some of these different biometric systems are in use out in the world.
1242640	1244980	That's kind of interesting.
1245520	1249240	So, let's see, you have your collection over here.
1249240	1251220	You have your silicone fingers.
1251220	1255140	Yes, I can show some of these.
1255140	1261800	I have here the alginate molds.
1261800	1266740	It's like the same alginate that they use for dental molds.
1267740	1280440	Also, I have to buy the alginate in a dental office, so it was complicated.
1280440	1288900	Also, the fingerprint powder, I have problems to get that.
1289580	1293980	You probably have to answer some really interesting questions, I'm assuming.
1293980	1295220	Yes.
1295860	1304540	Also, I have here, the best molds are the hot glue molds, because they are really, really detailed.
1304540	1310820	Also, the alginate molds are very good, but the hot glue molds are better.
1310820	1321280	And for the fake fingerprints, material that worked better for us was latex.
1321280	1326300	I use liquid latex, you can see here, it's really thin, really, really thin.
1327580	1330120	But you can use a school glue also.
1330120	1336280	I use liquid latex, the same one that they use for special effects.
1336640	1342380	I think it will be better, but I think with the school glue, it's enough.
1343500	1352740	Silicone works great in the optical scanners, but not in capacitive, because silicone is insulating, so no.
1353160	1358580	For the capacitive scanners, we need to use latex.
1358580	1367160	And with your real finger behind, the conductivity is enough to fool the scanner.
1367160	1368820	Interesting.
1368820	1373900	Yes, that part is really interesting.
1378470	1384660	Ah, wood glue. I also use wood glue, it's very thin also.
1384660	1385680	Which kind of glue?
1385680	1387440	Wood glue.
1387440	1400840	Wood glue works great, but you can use it one or two times and then it gets rigid and it won't work anymore.
1400840	1407580	But latex, you can use it several times for a lot of time. And silicone also.
1407580	1420200	Okay, so it looks like a lot of what you've just gone over are things that you need the assistance of the person who has the fingerprint in order to build this. Is that correct?
1420200	1428900	How many of these methods can you, if you lift a fingerprint off of a glass or a picture like you were mentioning earlier?
1430620	1438960	Yes, the 3D printing part was only on a non-cooperative way.
1438960	1453620	We obtained the fingerprints in glass or an inked fingerprint, one that you can obtain in the police, that type of inked fingerprint.
1453620	1459700	So we used that to create the 3D printed mold.
1460440	1465080	We created a mold, a negative and a positive.
1465360	1472980	The positive, because the resin is hard, you can see here that I can't bend it.
1474020	1486120	So the positive worked only on one of the optical scanners and in the ultrasonic, but it was not good.
1486120	1493440	But the mold was great and we cast the 3D printed mold with liquid latex.
1493440	1504660	This work on all the type of sensors that we try in the capacitive, in the optical and also in the ultrasonic.
1505440	1507340	Got it, all of them.
1507600	1513420	How many different manufacturers are there of these different fingerprint scanners?
1513420	1516720	And how many of them have you had an opportunity to test on?
1518060	1523960	I tested only four, but I think there are a lot.
1525860	1533500	Where do you intend to take this portion of your experimentation as you go forward?
1533500	1541660	I know I asked a little bit of this question before, but we've already covered there's a few gaps that would be interesting to fill.
1541660	1544500	What is next? Where do you go?
1548380	1549380	I've lost you.
1549380	1568800	Another attack vector that I didn't try is obtaining a fingerprint from, for example, a liquid biometric database and from the sensor, directly from the sensor.
1568800	1576910	I think that in this way, perhaps we don't need to enhance the fingerprint.
1577700	1589140	And we can't, because for all of that, we need an enhancement process because the obtained fingerprints were not directly actionable.
1589140	1594140	We need to enhance it in order to do the mold.
1594140	1602060	But in that case, I think it could be possible to make a mold without the enhancement process.
1602060	1604780	So I would like to try that.
1605620	1606200	That's good.
1606280	1607940	Yeah, I like that.
1608100	1612120	Well, we are rapidly approaching the end of our allotted time.
1612760	1618020	Plarity, did you see any extra questions in the chat that we should hit?
1618960	1621940	Yeah, I think there's probably two that have come in.
1621940	1628820	One from the ironically named Dexterous said that I've seen biometric hand scanners.
1628820	1634540	Not sure how they work, but I've noticed that when a person loses a lot of weight, they have to get the handprint redone.
1634540	1636400	Does that happen with fingerprints?
1636520	1641020	And if it does, could you just resize a copy of the fingerprint to work correctly?
1643340	1652860	I didn't understand. I understand that it's a hand, like all the fingerprints are scanned at the same time?
1653060	1659080	Yes, they're saying if they do the whole hand and then somebody loses a lot of weight, they have to redo it.
1659080	1662500	And do you think it would be the same thing with just a finger?
1663300	1676740	It could be because the reach height, sorry, the reach width varies with the health.
1676740	1684860	And I can see complexity of the people and it could be the same.
1684860	1689860	It's interesting to try. I will love to try that.
1689860	1694920	And have you also looked at how fingerprint data is stored in the devices?
1694920	1702900	Is it just stored with numbers or actually, how do devices store fingerprint data?
1702920	1708840	The devices that I analyze, they are images.
1709380	1713080	A biometric database with images.
1713080	1715480	So that's what's the interesting part.
1715480	1722600	I want to try if you can obtain in some way the database.
1722780	1730640	I would like to try and see if you can reproduce the fingerprint from that data.
1730880	1733140	I think it's interesting too.
1733380	1735940	That sounds like a wonderful place to aim next.
1735940	1744140	So we are right at the end. I really appreciate your willingness to come and give the presentation and spend some extra time with us in this Q&A.
1744140	1760140	If you are willing to do so, we like to have presenters drop into the track one at the end and give contact information, Twitter or websites or anything if somebody wants to reach out and address you afterwards.
1760560	1769800	And then I would really like to ask you one final question of what would be the big takeaway that you would like us to have to grab from your talk?
1770040	1772540	What's the big punchline here?
1773060	1791140	I think the big takeaway is geometric systems in a special fingerprint are not secure enough for using it as an authentication method.
1791140	1809060	I know that for regular people, perhaps it's not a problem, but with different treat models, other people, more exposed people, it's just not a good way to authenticate to the devices.
1809060	1822080	Because if a printer in my home can duplicate the fingerprints with more resources, then it could...
1823080	1837580	It's not secure enough for depending upon your threat model. Okay, excellent. Well, thank you so much. If anyone has any additional questions, they are welcome to reach out and there will be some contact information hitting track one soon.
1837580	1844420	Otherwise, have a great rest of your convention. I wish you the best and hope to see more from you later.
1846240	1847360	Thank you.