India's Unique ID project: Biometrics Vulnerabilities & Exploits

8/9/2019 India's Unique ID project: Biometrics Vulnerabilities & Exploits

http://slidepdf.com/reader/full/indias-unique-id-project-biometrics-vulnerabilities-exploits 1/29

Biometrics

Vulnerabilities & Exploits

[email protected]





Authentication by Technology

• Requires the exchange of certain

FACTORS• Requires an authority who can verify these

factors

• Requires an authority who can providepermission to build a relationship andtransact



...Authentication by Technology

Factors are classified into 3 types

• Ownership factor like cards, badges or keys• Knowledge factor like user id, password

and pins

• Inheritance factor like weight, height, faceshape, color of eyes/hair, birth marks etc.all nicely encoded in a photo



Properties of different FactorsTable 1. Properties of different Factors

Factors Examples Desired Properties Available properties

Ownership factorWhat you have

Cards Unique and ShareableNo DuplicationRevocable

YesUsually can be duplicatedYes

Badges

Keys

Knowledge factorWhat you know

User ID Unique and Shareable Yes (within a particularcontext)

Password Hard to guess, easy toremember.Must be a secret

Usually the reverse

PIN

Inheritance factorWhat you are(Something Uniqueabout you)

FingerprintFaceIrisVoiceRetina

Easily DigitizedEasily VerifiableNon SpoofableTime InvariantEnvironment Invariant

Discussed below



The Inheritance Factor - Biometrics

The Subject of discussion for today is the

Inheritance Factor – Biometrics• Implementation difficulties

• Vulnerabilities

• The authentication process and it'svulnerabilities, in brief

• Since the UIDAI has choosen the use of

finger prints and iris as a means of authentication, we will be discussing onlythese factors



Finger Print ScannersMost commonly used Finger Print scanners

Sensor Technology Scanner types Live finger

detection

Number of

fingers

Optical

Capacitive

Thermal

RF Resistive Capacitive

Swipe

Static contact

Static non contact

Conductivity

Thermal

Both

Single

Paired

All

• Many variations on these basic techniques• Variations are primarily to reduce cost, size and

probably to overcome existing patents

• Some claims exist about the ability to sense below

the “dead skin” surface. However for our vulnerability assements, these claims are triviallyovercome

• Sensor technologies are not relevant to the scopeof vulnerabilites and exploits



Fingerprint Readers

Fig 1: Optical Sensing Fig 2: Capacitive Sensing

Fig 3: Optical Reader Fig 4: Opticalmodule

Fig 5: Multi-Slap



Iris Scanners

• Iris scanners use a Near Infra Red light

• Camera coupled with some autofocusingtechniques (commonly used in autofocus

cameras)

IRIS Scanners

Fig 6: Hand-Held Iris Scanner Fig 7: Iris scanner in field use



Iris scan - Base Technique

John Daugman (1994)

Pupil detection:

circular edge detector

Segmenting sclera

Fi 8: An Iris with circular se mentation and the maths involved in derivin the 2048 bit val

rr0 1

θ

θ

∫ ∂∂

00

00,,

,, 2),()(max

y xr y xr

dsr y x I

r r G

π σ

∫ ∫ +

−=

+

−=∈ ∂

∂8/

8/]10,5.1[

),(2

m ax00

π φ

π φ θ

δ

δ ρ

θ ρ ρ θ ρ π δ

d d I r r

r

r r r r



Fig 9: Biometric Enrollment and Verification process

The Process

• All id systems involve an enrollment process andan authentication process, followed by anauthorization process, to enter / exit / recieve /depoist etc



The Enrollement Process

• Capture image

• Process image• Extract Features

• Create Template

• Save raw data inthe case of criminal records

• Encryption• Transmission

• De duplicationand storage

Fig 10: Finger Print Capture

Fig 11: Index values extracted from fingerprint images



The Authentication process

• Capture image

• Process image

• Extract Features

• Create Template

• Encryption

• Transmission

• Receive result

• UIDAI has notspecified iris for authentication*

Fig 13: Comparison of minutae with stored template



Threats faced by biometric systems

• Threat agents

– Only simple impostor, without muchsophistication or resources. We shallleave out crossborder attack vectors, aspilfering state subsidies may not be their highest priority

• Threat Vectors

– Fake credentials and replay attacks• System Weaknesses

– Extraction of digital keys, use of internal

facilities of sensors



Desired Characteristics And

Limitations

• Easy and accurate Digitization of thepresented bio characteristic

• Time Invariant

• Environment Invariant

• Spoof proof



Fig 14: How not to place your finger on the sensor

... Limitations in enrollment / auth

• Easy and accurate Digitization – neither

easy nor accurate• Too many wrong

methods, resultsin

unreproduceabletemplate

• Guidedenrollment

useless for auth• Very difficult for

occasional users

• Manual overides= more holes



... Limitations in enrollment / auth• Time invariance – a myth

– Ageing changes fingerprints (1)

– Skin ailments makes auth difficult if not impossible

– No large scale studies on heterogenous

populations – Will require frequent re-enrollment – aka more

holes

– No (available?) studies on iris variations due toageing

– Errors due to unknown causes (2)

1) https://www.cerias.purdue.edu/apps/reports_and_papers/view/3155/

2)http://biometrics.nist.gov/cs_links/quality/workshopII/proc/Kim_Analysis_of_Effect_ofingerprint_Sample_Quality_in_Template_Ageing.pdf



... Limitations in enrollment / auth• Environment invariance – a myth

– Water logged hands changes fingerprintsmachine readbility

– Dry skin changes fingerprints machine

readbility – Will require frequent re-enrollment – aka more

holes

– No (available?) studies on iris variations dueto harsh environments

– Inter device variationshttp://www.slideshare.net/bspalabs/2008-investigating-the-

relationship-between-fingerprint-image-quality-and-skin-characteristics.



... Limitations in enrollment / auth

• Non- Spoofability

– Biometrics are the worst

– Fingeprints are spoofed by gummy finger techniqe

– Iris are spoofed by photographs

– Iris are spoofed by patterned contacts



Spoofing made easy - Fingerprints

http://cryptome.org/gummy.htm

• Uses common

ingredients

• Fools allsystems withgreater than60%repeatability

• Newer

mateials andtechniqueseven moreeffective



Spoofing made easy - Iris

http://www.visiondirect.com/lens/default.asp?

catid=10774&trx=LeftNav&trxp1=27087&trxp2=10774&trxp3=2

• Buy from the net to

create fake ids for sale

• PCB etching

techniues for masqureading

• Older techniqueusing high resphotograph withpupil holes

Fig A.3-1: Spiderman returns



Attack Vectors requiring skill

• Template reconstruction

– Biometric id systems store data as atemplates, usually a few kilobytes insize. It has been shown that a biometric

fingerprint system can be compromisedby recreating the biometric using thestored template

– Template extraction and storage afeature of systems



... Attack Vectors requiring skill

• Key duplication – Trivial to break into the device and

extract keys

– Addition deletion of keys a feature – Even in locked down devices, the key

can be recovered by simply copying the

onboard flash to a pc and reusing thebackup in a device purchased from themarket



... Attack Vectors requiring skill

• Replay attack at sensor pins – The sensor interfaces are relatively

simple

– Produce raw data (Fig 4). It is possibleto record all data, and then replay thatdata

– This attack requires some technical skill – However once developed it can be

mass produced and will be

undetectable



Biometrics WORST CHARACTERISTIC

• Cannot bewithdrawn

• Cannot be changed

• This violates thebasic requirementof any id system



Inherent problems with Biometric

Systems• FAR - False Acceptance Rate indicates the

number of wrong matches of a presentedbiometric – mistakenly identyfying one personas another

• FRR - False Rejection Rate (also called FalseNon Match Rate) indicates the number of wrong rejects of a presented biometric.

• Best FAR of .00060 for fingerprints• Best FAR of .000120 for Iris

• Best FRR of .0060 for fingerprints

• Best FRR of .0012 for Iris



... Inherent problems with Biometric

Systems

F A R ( % ) F R R ( % ) A d u l tP o p u l a t i o n

( M i l l i o n )

F a l s ea c c e p t a n c e

( M i l l i o n )

F a l s e R e j e c( M i l l i o n )

F i n g e r p r i n t 0 . 0 0 0 6 0 0 0 . 0 0 6 0 8 5 0 0 . 5 1 5 . 1I r i s 0 . 0 0 0 1 2 0 0 . 0 0 1 2 8 5 0 0 . 1 1 . 0 2

• FAR and FRR closely linked to template size

• Reducing FAR increase FRR

• Reducing FRR increases FAR



... Inherent problems with Biometric

Systems

• Requires very good power • Requires very good telecommunications

infrastructure

• Both of very poor quality in many areas• Even in Maharshtra in the Konkan region,

such infratructure is poor due to natural

causes – Hilly terrain

– RF shadow regions

– Heavy rains and lightning

S mma



Summary• Biometrics as a unique id in an automated system

has never been tested on a large scale

• The inherent characteristic of biometrics is it'sirrevocability. This is in direct contradiction of anyid / security system, where keys must berevocable and reissueable

• Fingerprints are easily spoofable

• Iris patterns are easily spoofable

• Biometrics are very susceptible to the naturalbiological processes of growth, ageing andenvironment

• Numerous technical vulnerabilities are availble for

exploitation at the sensor system interface

Documents

India's Unique ID project: Biometrics Vulnerabilities & Exploits