Fingerprint Reader Security Risk?

Black Swan

Lots of laptops are now produced with fingerprint readers in lieu of passwords. What's the risk that a hacker/cracker could somehow use a modified RAT (or whatever programme) to capture the fingerprint and then use it to access the administrator of your laptop when online?

Second question. If using Vista Ultimate with a fingerprint reader activated, is there a way to also require a password (in addition as an added measure of security) after using the finger and before opening the administrator?

Capt'n Midnight

just use superglue fumes to get the finger print

or a clear plastic bag filled with water

Black Swan

*Humour noted*

I guess nobody knows?

ecksor

My understanding is that a small sample of the fingerprint is used, but then hashed for checking against a database for the purposes of authentication, so there's no significant risk of reverse engineering a fingerprint. However, I'm not quite sure if that's what you're asking.

Black Swan

OK, I'll try to reword my question...

Most users of rigs equipped with a fingerprint reader use it to open the administrator account, taking the place of a password. If someone is trying to hack someone else's rig, can they install software similar to a keylogger (except one that captures the fingerprint image rather than characters) and gain access to the administrator account? Is this a real security risk?

Cake Fiend

Depending on the fingerprint scanner used, you might be more at risk from someone hacking a "rig" like this with a photocopy of a fingerprint. Seriously - several of the low-end types are fooled by this method (or similar). I seem to recall seeing a mythbusters episode on it?

koloughlin

I like the idea of using gummy bears to defeat the security http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/

Black Swan

Cake Fiend wrote:

Depending on the fingerprint scanner used, you might be more at risk from someone hacking a "rig" like this with a photocopy of a fingerprint. Seriously - several of the low-end types are fooled by this method (or similar). I seem to recall seeing a mythbusters episode on it?

Methinks that this would work if you could physically access the rig with your photocopy. A techie at CompUSA had tried it and said it worked. What I was wondering was if it could be done remotely and electronically?

dubdvd

have a read through this


https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Kiviharju/bh-eu-06-kiviarju.pdf

http://www.reactivated.net/weblog/archives/2006/01/breaking-encryption-the-easy-way/

http://www.reactivated.net/weblog/archives/2006/02/more-fun-with-fingerprints/

H3LLg0d

I seem to recall seeing a mythbusters episode on it?

me too:D

dam must use my free time better;)