Could it be possible to hijack physical finger prints in digital form and use them to gain access to other devices and locations?

Question

With more and more devices accepting finger prints in place of passwords, could it be possible to "keylog" these finger prints on mobile devices, for example, by installing a rogue application and then reproducing that finger print either digitally or physically in terms of 3D printing to gain access to other devices or locations?

One thing I was thinking too is what if someone develops an app(legit) and asks to use your finger print. From there they could technically reconstruct it and use it against you or even sell it and associate it to your identity.

Answer 1

Here's a relevant section of Apple's "iOS Security" document:

The fingerprint sensor is active only when the capacitive steel ring that surrounds the Home button detects the touch of a finger, which triggers the advanced imaging array to scan the finger and send the scan to the Secure Enclave.

The raster scan is temporarily stored in encrypted memory within the Secure Enclave while being vectorized for analysis, and then it’s discarded. The analysis utilizes subdermal ridge flow angle mapping, which is a lossy process that discards minutia data that would be required to reconstruct the user’s actual fingerprint. The resulting map of nodes is stored without any identity information in an encrypted format that can only be read by the Secure Enclave, and is never sent to Apple or backed up to iCloud or iTunes.

To me this implies that the fingerprint never actually passes through the standard iOS memory, but rather directly to the secure enclave. Once it's in the secure enclave, it's transformed in a way that the fingerprint cannot be reconstructed. So on Apple devices, this does not seem to be possible even on jailbroken devices, except maybe in the case of an attack on the physical hardware.

Other devices such as Android are different. I believe Google has design guidelines similar to Apple's but manufacturers do not need to follow it exactly. I'm fairly sure that some early Android devices simply encrypted finger print data in the standard storage, but I'll look for a reference as I could be wrong.

Edit:

1. https://www.extremetech.com/mobile/211985-htc-caught-storing-fingerprint-data-in-unencrypted-plain-text
2. https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Fingerprints-On-Mobile-Devices-Abusing-And-Leaking-wp.pdf

Answer 2

There is no reason why that is not possible, both at the digital level and physical level. Phones typically don't make the fingerprint data available to other applications, unless its a jailbroken phone with a rouge app which steals this data.

On the physical level, not only its possible but has been done in past. Refer: http://www.theepochtimes.com/n3/313493-in-china-fake-fingerprints-in-five-minutes-flat/

Answer 3

Probably yes, but...

does anyone care?

Possible or not, your finger is being used as a password. Both, your text input and your finger are being converted into digital information that at some point is going to be validated in one way or another. Many devices are compromised without the hacker ever getting access to any password. Hackers get access to your OS through exploits which fool the device into granting them privileges they shouldn't have. No authentication process is involved.

Technology & data changes

The string "Password123" will always be treated the same way by your device. Fingerprint scanners, or other biometric sensors, on the other hand will probably improve their resolution and effectiveness over the years, thus converting your fingerprint into a completely different set of data. The set of data red by that old sensor wouldn't be of much use at that point.

I don't see this becoming a major security issue.

Answer 4

You don't even need that direct of access to the fingerprint; a researcher has reproduced a politician's fingerprint based on photos from press events. So yes, absolutely.