WEBVTT 00:01.040 --> 00:03.000 Hi, my name is Camila. 00:03.000 --> 00:08.660 I'm a security researcher at DreamLab Technologies and also a 3D printing enthusiast. 00:08.660 --> 00:16.880 And today we are going to talk about bypassing biometric systems with and without the help of 3D printing technologies. 00:19.040 --> 00:27.320 Humans have used features such as face, voice, and gait for thousands of years to recognize each other. 00:27.320 --> 00:34.240 But only recently, humans have started using biometric-based systems to authenticate individuals. 00:34.620 --> 00:50.240 Biometrics is the science of establishing or determining an identity based on the physical or behavioral traits of an individual, such as the ones we can see here in the slide. 00:50.240 --> 00:59.960 Fingerprints, DNA, signature, iris, face, voice, gait, vein pattern, ear shape, keystroke dynamics, and more. 01:03.650 --> 01:19.150 Biometric systems are essentially pattern recognition systems that read as input biometric data, extract the feature set from such data, and finally compare it with a template set stored in the database. 01:19.630 --> 01:30.590 If the extracted feature set from the given input is closed to a template set stored in the database, then the user is granted access. 01:34.460 --> 01:38.780 But biometric systems are prone to different attacks. 01:39.300 --> 01:46.000 Direct attacks, presentation, or spoofing attacks are performed at the sensor level. 01:46.500 --> 01:50.640 The sensor is full and not replaced nor tampered. 01:50.860 --> 02:16.180 Indirect attacks are performed inside the biometric system by, for example, bypassing or overriding the capture device, the signal processor, the comparator, or the decision engine, manipulating the data in the biometric reference database, or exploiting possibly weak points in the communication channels between the different components. 02:16.180 --> 02:28.320 But during this talk, we are going to focus on this, on presentation attacks, this part of the system. 02:32.080 --> 02:36.740 Now we are going to see presentation attacks in reality. 02:37.240 --> 02:47.060 These are real cases of criminals using silicon masks to fool security cameras, airport security, and facial recognition systems. 02:47.080 --> 02:52.700 The first one is a suspect in the robbery of a North Carolina bank. 02:54.100 --> 03:01.300 This one robbed four banks and a CVS pharmacy with a silicon mask from an online site. 03:01.300 --> 03:09.220 I think the of the mask name is The Player, from SPFXmask. 03:09.220 --> 03:18.320 It's a site that now is closed, but it used to sell this type of realistic masks. 03:18.980 --> 03:30.040 The third one is a suspect accused of robbery and several other crimes committed using a generic mask made by another online site. 03:30.040 --> 03:35.120 The name of this of this mask model is The Neighbor. 03:35.480 --> 03:46.300 And the last one is a passenger who boarded a plane in Hong Kong as an old man in a flat cap, but arrived in Canada as a young man. 03:50.630 --> 04:07.730 Regarding fingerprint biometric systems, this first case is a Brazilian doctor who faced charges of fraud after being caught on camera using silicon fingers to sign in for work for absent colleagues. 04:08.270 --> 04:25.730 The second case is a gang involved in the illegal preparation, this is the image, the illegal preparation and selling of cloned fingerprints to fool biometric attendance systems of several educational institutions. 04:26.890 --> 04:30.370 The last case was in my country, Argentina. 04:30.670 --> 04:42.390 Six employees of the local airline were fired after discovering that they falsified their entry to work with silicon fingers taking turns to attend. 04:42.390 --> 04:48.330 But on weekends, when the payment is double, all six attended to work. 04:51.740 --> 04:57.040 But how 3D printing could help bypass biometric systems? 04:57.040 --> 05:06.180 In this first case, researchers from Forbes fooled Android facial recognition systems with a 3D printed head. 05:08.140 --> 05:18.660 In this second case, the MSU Michigan State University team created a fake finger by 3D printing a mold. 05:21.140 --> 05:38.080 And in this last case, a group of researchers from BCAB demonstrated that it was possible to bypass the face recognition logging mechanism of the iPhone X using a cheap 3D printed mask made from a stone powder. 05:41.250 --> 05:50.150 I love 3D printing, I have two 3D printers at home, why not make my own experiments for bypassing biometric systems? 05:50.150 --> 06:03.470 But first, I wanted to try the traditional methods for attacking biometric systems to better understand how 3D printing technology will help make these attacks faster and better. 06:05.600 --> 06:12.660 But first, we need to know how is the fingerprint recognition process. 06:12.660 --> 06:22.180 Most fingerprint scanners compare distinctive features of the fingerprint, generally known as minutia. 06:22.180 --> 06:34.200 Typically, investigators concentrate on points where rich lines end or where one rich splits into two called bifurcations. 06:34.340 --> 07:01.540 Collectively, another distinctive feature, such as you can see here, delta, a short ridge, a spore, the bifurcation, rich enclosure, a crossover or ridge, an island, all these features together are called typica. 07:02.240 --> 07:09.860 The scanner uses complex algorithms to recognize and analyze these distinctive features. 07:09.860 --> 07:23.960 The basic idea is to measure the relative positions of the features in the same sort of way you might recognize a part of the sky by the relative position of the stars. 07:23.960 --> 07:38.280 But to get a match, the scanner doesn't have to find the entire pattern of distinctive features, both in the sample and in the print from the biometric database. 07:38.280 --> 07:46.160 It simply has to find a sufficient number of features and patterns that the two prints have in common. 07:49.530 --> 07:53.650 There are many fingerprint sensors on the market. 07:53.650 --> 08:02.110 These are optical sensors, you can recognize them for the light, in general they use light. 08:02.470 --> 08:07.970 These are capacitive sensors, and the last one is an ultrasonic sensor. 08:12.410 --> 08:18.830 Optical fingerprint sensors are the oldest method of capturing and comparing fingerprints. 08:18.830 --> 08:33.390 This technique relies on capturing an optical image and using algorithms to detect unique patterns on the surface by analyzing the lightest and darkest areas of the image. 08:38.040 --> 09:03.140 Capacitive fingerprint scanners, instead of creating a traditional image of a fingerprint, they use the body natural capacitance to read the fingerprints, because the charge stored in the capacitor will be changed slightly when a finger reach here is placed over the conductive plate, 09:03.140 --> 09:11.080 while an air gap or a finger ballet will leave the charge at the capacitor relatively unchanged. 09:11.480 --> 09:20.320 These changes can then be recorded and analyzed to look for distinctive and unique fingerprint attributes. 09:22.420 --> 09:27.680 The latest fingerprint scanning technology is the ultrasonic sensor. 09:27.680 --> 09:36.060 To capture the details of a fingerprint, the hardware consists of both an ultrasonic transmitter and a receiver. 09:36.480 --> 09:42.700 An ultrasonic pulse is transmitted against the finger that is placed over the scanner. 09:42.700 --> 09:52.700 Some of the ultrasonic pulse is absorbed and some of it is bounced back to the sensor, depending upon the unique details of each fingerprint. 09:52.740 --> 10:05.620 The sensor then calculates the intensity of the returning ultrasonic pulse at different points, resulting in a very detailed reproduction of the scanned fingerprint. 10:08.670 --> 10:13.690 Now, for our test, the devices to be tested are four. 10:15.050 --> 10:28.530 Two biometric attendance systems with optical sensors, and two mobile phones, one with the capacitive sensor and the other one with an ultrasonic sensor. 10:34.590 --> 10:41.710 This is the first photo of the materials bought for the experiments, and includes a lot of materials. 10:42.010 --> 10:55.610 Alginate, a hot glue gun, gelatin powder, gummy bears, candle wax, transparent tape, play-doh, instant glue, epoxy putty, UV resin, silicone fingertips, fingerprint ink, and more. 10:56.250 --> 11:09.090 But during the test, I realized that I missed important materials, like, for example, silicone, liquid latex, wood glue, and so much more, and the list grew, and grew a lot. 11:12.620 --> 11:16.420 The first attack to test was the grease attack. 11:16.480 --> 11:40.640 For grease attacks, you need to have a clear grease stain left on the surface of the fingerprint scanner, but this stain must have most of the important features of the fingerprint left on the pad, so that the scanner can reliably read the same line ends and curves that it detected on the previous user. 11:40.640 --> 11:58.340 The idea of the attack is to gently press different materials, such as gummy bears, play-doh, silicone fingertips, and latex gloves, against the fingerprint scanner, but with care, with careful, without ruining the stain. 12:04.230 --> 12:07.330 Here are the results of the grease attacks. 12:07.750 --> 12:22.490 With gummy bears, play-doh, latex gloves, and silicone fingers, the scanner detected a finger, but the fingerprint was not clear enough to fool the sensor, so this attack was unsuccessful on all the tested devices. 12:23.130 --> 12:35.750 But for me, this test was not a failure, because the gummy bears were really yummy, and kept me fed during the rest of the experiments, so no failure for me. 12:38.970 --> 12:50.120 The problem with grease attacks is that, in most cases, a regular grease stain on the scanner surface is not enough to fool the sensor. 12:50.380 --> 12:58.500 We need to enhance it with other substances to obtain better results, impersonating legitimate users. 12:58.500 --> 13:12.780 But this substance, so that the user does not notice them, and also with ointment consistency, to better enhance the fingerprint stain. 13:13.560 --> 13:21.740 This substance could be spread in the legitimate user fingerprint, or in the fingerprint sensor. 13:22.020 --> 13:42.340 Using petrolatum ointment, paraffin, or cocoa butter lip balm, we successfully fooled the sensors, and were able to authenticate ourselves as the last user of the device, in optical and incapacitive scanners. 13:48.240 --> 13:51.500 Now we are going to see a demo. 13:51.840 --> 13:57.200 In this case, we are using cocoa butter lip balm. 13:57.200 --> 14:02.180 We are spreading the lip balm in the legitimate user fingerprint. 14:03.600 --> 14:09.260 We can see the enhanced grease stain in the fingerprint scanner. 14:10.860 --> 14:20.300 And then another user wearing a latex glove can be authenticated as the last legitimate user of the device. 14:23.080 --> 14:26.980 Now for consensual attacks. 14:27.300 --> 14:42.660 The term consensual suggests that the user we are taking the fingerprint from is aware of the process, and participates by pressing his or her finger into some kind of a mold. 14:43.080 --> 14:51.280 For molds, we use these materials, alginate, epoxy putty, play-doh, hot glue, and candle wax. 14:51.280 --> 14:59.900 And for casting, we use silicone, homemade ballistic gelatin, liquid latex, synthetic resin, and wood glue. 15:06.390 --> 15:31.070 You can see here, here, you can see here that the hot glue mold, of course, is the researcher's fingerprint are blurred, but in this part, you can see that the hot glue mold is really, it's very detailed, so it's a really good mold. 15:37.270 --> 15:42.830 For the molds, we obtained the best results with alginate and hot glue. 15:42.830 --> 15:49.620 And for casting, we obtained the best results using liquid latex, wood glue, and silicone. 15:50.450 --> 16:00.070 With the combination of a hot glue mold and liquid latex or wood glue casting, we were able to fool all the sensors. 16:00.070 --> 16:05.530 The same with the combination of an alginate mold and liquid latex casting. 16:07.930 --> 16:14.170 You can see here that the ballistic gelatin test didn't work. 16:14.170 --> 16:18.330 That's because ballistic gelatin is not so easy to make at home. 16:18.330 --> 16:26.810 We tried several combinations of gelatin powder, water, and glycerin, but the results were not enough to fool the scanners. 16:27.610 --> 16:31.790 Also, note that the working fingerprints are very thin. 16:32.870 --> 16:37.270 And please be careful if you plan to make hot glue molds. 16:37.470 --> 16:56.030 Let the glue cool down a bit and test the temperature under the foil and dip your finger in water because before, sorry, before pressing it against the hot glue, trust me, the glue can reach over 200 degrees. 16:56.030 --> 17:00.190 I've been there and it burns and it burns a lot. 17:04.650 --> 17:17.190 For unconsensual attacks, in these attacks, the user does not participate actively and latent fingerprints are obtained in a non-cooperative way. 17:17.550 --> 17:28.570 Assuming we have identified the correct latent fingerprint, we need to follow the following procedure. 17:29.690 --> 17:33.410 This procedure here. 17:33.430 --> 17:58.730 So, we are going to need to enhance the latent fingerprint with glue fumes or fingerprint powder, lift the latent fingerprint with a digital camera or transparent tape, digitally enhance the fingerprints with software, create a mold, and cast artificial fingers with silicone, 17:58.730 --> 18:00.930 liquid latex, or wood glue. 18:01.530 --> 18:10.150 The first option to enhance the latent fingerprint is dusting with fingerprint powder and a brush. 18:10.150 --> 18:18.810 The second option is encapsulating the latent print inside a container with instant glue. 18:19.030 --> 18:26.870 Fumes from the glue will be attached to the wrist of the latent fingerprint, making it possible to lift it. 18:33.610 --> 18:56.650 In this case, we obtain the best results lifting the latent fingerprints with a digital camera, using a fingerprint enhancement software in Python to digitally enhance the fingerprint image, offset printing a transparency, using the transparency as a mold, 18:56.650 --> 18:59.350 and casting it with liquid latex. 18:59.350 --> 19:04.670 With this procedure, we were able to fool the optical sensors. 19:05.050 --> 19:14.170 The fingerprint ink on a latex glove technique also worked on capacitive and ultrasonic sensors. 19:15.290 --> 19:39.190 You can see here that the offset plate technique didn't work, but it did not work because the offset plate was covered with some kind of rubber that is generally used in this type of plate, and the rubber interfered with the creation of the mold. 19:39.250 --> 19:44.710 But without the rubber, I think it's a technique that could work. 19:52.140 --> 20:20.360 For unconsensual attacks with 3D printing, we need an UV Resin SLA 3D printer, software to digitally enhance the latent fingerprint, a 3D CAD design tool, like for example Tinkercad, and a latent fingerprint in glass or a fingerprint inked in paper. 20:20.860 --> 20:32.760 In this case, we can use FDM or filament 3D printers for these attacks because we need the precision of an UV Resin printer. 20:36.830 --> 20:43.830 To obtain a working fingerprint through 3D printing, we need to follow these steps. 20:43.850 --> 20:50.110 First, we need to lift the latent fingerprint with a digital camera with macro functionality. 20:50.210 --> 20:54.410 Then, we need to use fingerprint enhancement software. 20:54.410 --> 21:03.830 In this case, I use a software in Python, but you can use any kind of graphic software for this task. 21:04.310 --> 21:18.430 Then, we need to import the enhanced image of the fingerprint into Tinkercad and configure the dimensions and add the reach height to create the 3D model. 21:18.430 --> 21:25.170 One negative or hollow for casting and one positive for direct tests. 21:25.430 --> 21:29.870 Then, we need to print the models on the 3D printer. 21:29.870 --> 21:35.810 In this case, the Anycubic Photon 3D printer with UV Resin. 21:35.810 --> 21:46.390 And then, we need to use isopropyl alcohol and UV post curing lamp or direct sunlight to complete the final curing process. 21:46.570 --> 21:53.630 At the end, we need to cast the models with wood glue or liquid latex. 21:53.630 --> 22:00.110 It took us 10 retries to achieve the optimal printer settings and reach height. 22:00.110 --> 22:06.490 But the most important step of this procedure is this one. 22:06.490 --> 22:08.790 It's the step four. 22:09.190 --> 22:19.690 If the step four is okay, the fake fingerprints will work in the different sensors and scanners. 22:19.690 --> 22:32.830 So, it's really important to configure the fingerprint length, height, and the reach height in a correct way. 22:37.040 --> 22:38.500 The results. 22:40.220 --> 22:49.160 The fingerprint obtained from the 3D model with liquid latex or wood glue casting worked on all sensors. 22:49.520 --> 22:59.840 And the positive fingerprint print directly on UV Resin worked on the ultrasonic sensor and in one of the optical sensors. 23:01.220 --> 23:12.520 In the optical sensor, we had to spread the fingerprint with cocoa butter lip balm or petrolatum for the sensor to recognize it as a finger. 23:13.440 --> 23:20.460 And here, you can see a summary of all the process. 23:20.700 --> 23:31.700 Here is the fingerprint enhancement, the models in Tinkercad, the printed models, and the casting with wood glue and liquid latex. 23:31.700 --> 23:43.000 And then, at the end, we are using the fake fingerprints to authenticate in an optical scanner. 23:44.340 --> 23:48.340 Now, we are going to see the demo of this attack. 23:54.160 --> 24:09.960 Here, we have the fake fingerprint and we are using it to authenticate ourselves in a Samsung S10 phone with an ultrasonic sensor. 24:09.960 --> 24:17.620 In this case, we use as a mold the 3D printing mold that we were talking before. 24:17.620 --> 24:20.340 And for casting, we use liquid latex. 24:20.340 --> 24:26.900 In this case, we use liquid latex with a skin color, but it's not necessary. 24:26.900 --> 24:32.500 You can use any color of latex and it will work. 24:35.890 --> 24:59.470 For biometric face recognition, biometric face recognition is the process and ability to identify the face of an individual, either to grant access to a system or to find out the details of a person by matching the face with the data in the biometric database. 24:59.950 --> 25:25.010 What a biometric face reader does is map and extract the distinct features, for example, these points and these points here, features of a person's face that can be used for recognition and stores the data in the biometric database along with the identity of the individual. 25:25.870 --> 25:39.030 Our next step in this research is to perform presentation attacks in face recognition systems by using 3D printed masks and heads to fool the different scanners. 25:39.370 --> 25:43.050 Now we are working on that and it's really fun. 25:45.670 --> 25:51.270 We published a paper of this research that you can download for more details. 25:51.270 --> 25:56.330 Another interesting research was made by Paul Raskaniers from Talos. 25:56.330 --> 26:05.130 We met in Switzerland when we were researching about using 3D printers to create fake fingerprints. 26:05.130 --> 26:09.790 He used the same 3D printer for the test, but different software. 26:09.790 --> 26:17.310 Also, he tested different devices, so if you are interested in this subject, it is worth to check it out too. 26:17.310 --> 26:20.490 It's the first link of the reference materials. 26:21.270 --> 26:33.470 Also, I have other reference materials in case some of the topics discussed in this talk are of interest and you want to know them a little more. 26:37.120 --> 26:38.380 Thank you. 26:38.380 --> 26:42.400 It was an honor to present this talk at DEFCON. 26:42.560 --> 26:51.080 And also thanks to my co-workers and friends that helped me with this research, especially Las Vivas Infosec. 26:51.080 --> 26:55.500 They are always there for me. 26:55.580 --> 26:57.760 So, stay safe, everyone.