Fingerprint Reader Security Risk?

30-05-2007 02:24AM #1

Lots of laptops are now produced with fingerprint readers in lieu of passwords. What's the risk that a hacker/cracker could somehow use a modified RAT (or whatever programme) to capture the fingerprint and then use it to access the administrator of your laptop when online?

Second question. If using Vista Ultimate with a fingerprint reader activated, is there a way to also require a password (in addition as an added measure of security) after using the finger and before opening the administrator?

Capt'n Midnight · 31-05-2007 09:55PM

just use superglue fumes to get the finger print

or a clear plastic bag filled with water

31-05-2007 11:21PM

*Humour noted*

I guess nobody knows?

ecksor · 01-06-2007 02:57AM

My understanding is that a small sample of the fingerprint is used, but then hashed for checking against a database for the purposes of authentication, so there's no significant risk of reverse engineering a fingerprint. However, I'm not quite sure if that's what you're asking.

01-06-2007 05:48AM

OK, I'll try to reword my question...

Most users of rigs equipped with a fingerprint reader use it to open the administrator account, taking the place of a password. If someone is trying to hack someone else's rig, can they install software similar to a keylogger (except one that captures the fingerprint image rather than characters) and gain access to the administrator account? Is this a real security risk?

Cake Fiend · 01-06-2007 04:31PM

Depending on the fingerprint scanner used, you might be more at risk from someone hacking a "rig" like this with a photocopy of a fingerprint. Seriously - several of the low-end types are fooled by this method (or similar). I seem to recall seeing a mythbusters episode on it?

koloughlin · 01-06-2007 06:06PM

I like the idea of using gummy bears to defeat the security

http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/

02-06-2007 07:09PM

Cake Fiend wrote:

Depending on the fingerprint scanner used, you might be more at risk from someone hacking a "rig" like this with a photocopy of a fingerprint. Seriously - several of the low-end types are fooled by this method (or similar). I seem to recall seeing a mythbusters episode on it?

Methinks that this would work if you could physically access the rig with your photocopy. A techie at CompUSA had tried it and said it worked. What I was wondering was if it could be done remotely and electronically?

dubdvd · 03-06-2007 04:44AM

have a read through this

https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Kiviharju/bh-eu-06-kiviarju.pdf

http://www.reactivated.net/weblog/archives/2006/01/breaking-encryption-the-easy-way/

http://www.reactivated.net/weblog/archives/2006/02/more-fun-with-fingerprints/

H3LLg0d · 03-06-2007 12:05PM

I seem to recall seeing a mythbusters episode on it?

me too:D

dam must use my free time better;)

Fingerprint Reader Security Risk?

Comments