German Cyber Agency Warns Against Fingerprint-Only Phone Unlocking

Germany’s federal cybersecurity agency has told people to stop relying on a fingerprint alone to unlock a phone or open a sensitive app, arguing that photographs already posted online can yield a working copy of the print.

The Federal Office for Information Security, known as the BSI, made the case in a social media post with the line “your fingerprint is online, without you knowing.” A photograph of someone making a peace sign, the agency said, can carry enough detail for an attacker to extract the fingerprint with an AI tool, reproduce it on a 3D printer and present it to a handset sensor. Image quality keeps improving, which makes the attack easier to set up, so the agency suggested people avoid showing fingertip detail in uploaded pictures or reduce the resolution of photos and videos.

A BSI spokesperson told Information Security Media Group that the post was “an awareness post intended to highlight general risks” rather than a response to a particular spoofing case. Criminals “can use a representation of a fingerprint to create a synthetic fingerprint that is sufficiently similar to the real one and can thus potentially unlock smartphones if those devices lack additional security measures capable of detecting such synthetic fingerprints,” the spokesperson said.

The agency’s specific concern is banking apps and password managers gated on a fingerprint and nothing else. A compromised fingerprint cannot be reissued the way a stolen password can, and the BSI recommended multifactor authentication combining biometrics with a password or PIN.

The agency jointly runs Germany’s Biometrics Evaluation Center with the Institute for Security Research at Bonn-Rhein-Sieg University of Applied Sciences. The centre has built facilities for testing biometric authentication on smartphones and has researched optical coherence tomography, a light-based technique borrowed from medical imaging, for fingerprint scanning detailed enough to make spoofing harder. Detection of that kind is what the field calls presentation attack detection, and laboratories now certify products against it, as when Neurotechnology’s face liveness technology passed a Level 2 evaluation at BixeLab.

Cisco Talos researchers reported in 2020 that 3D-printed fingerprints bypassed biometric security on a range of devices, with roughly an 80 percent success rate on handsets they defeated at least once, including first-generation ultrasonic sensors mounted under screens. European law enforcement has raised the same alarm from a different angle, with Europol warning that AI-generated fakes can bypass phone biometric security.

Sources: BankInfoSecurity

–

By the ID Tech Editorial Team