Study finds fingerprints can be copied by the sound of a finger moving on a scanner

A research team from the US and China has identified a fingerprint authentication vulnerability. It is based on the sound of finger friction, the devices can record sound waves and even minor changes in the surface of the finger as it moves over the fingerprint sensor.

Attackers can use the detected audio characteristics to recover fingerprints and create fake fingerprints that can be used to bypass the authentication system.

The attack process could be as follows:

1. Data Collection: Attackers can use microphone-enabled chat programs, such as Telegram, Skype, or Discord, to record sounds made by rubbing their fingers against the fingerprint sensor.
2. Sound Analysis: The resulting audio recordings are then analyzed to identify characteristic sounds associated with finger movements on the sensor.
3. Fingerprint Recovery: Based on audio data, attackers can attempt to recover partial or full fingerprints, which can be used to spoof or bypass authentication systems.

To protect against such attacks, device manufacturers can use various methods, such as improving protection against acoustic eavesdropping and analyzing fingerprint data. It is also recommended to implement biometric authentication methods that are not susceptible to such attacks, for example, facial scanning or iris scanners. It is also important to ensure that biometric data is stored and securely transmitted to prevent leakage and misuse.

The PrintListener attack seems difficult to implement, but scientists managed to overcome a number of problems that prevented them from obtaining the result:

• Weak sounds of finger friction – an algorithm has been developed for localizing the sound of friction based on spectral analysis;
• The dependence of the ability to separate finger patterns from the physiological and behavioral characteristics of the user has been largely overcome thanks to the techniques of minimum redundancy, maximum relevance (mRMR) and adaptive weighting strategy;
• The transition from determining the primary characteristics of fingerprints to the secondary ones is carried out using statistical analysis of the relationships between these characteristics and a heuristic search algorithm.