ubc – computer security october 4, 2007 gordon ross – president virtual perceptionsystems inc....
TRANSCRIPT
UBC – Computer Security
October 4, 2007
Gordon Ross – President
VIRTUAL PERCEPTIONSYSTEMS [email protected]
www.my-spy.com
Biometrics:
A unique physical or behavioral characteristic which can practically be collected, stored, and compared against; for the purpose of positive identification.
Behavioral and physiological Static and dynamic One to one compare One to many searching False Acceptance Rate (FAR) False Rejection Rate (FRR) Failure to Enroll (FTE)
Fingerprint Facial recognition Iris Voice recognition Hand Geometry
Keystroke dynamics Retinal Scan Palm Print Signature
Capture a Biometric-Enrollment Process the Biometric-Algorithm Store Result-Template Compare-one to one
verification Find-one to many
identification Accept or Reject
Controlling access Monitoring Authentication Identification ATM applications
Open the door please. Is this the person on record? Who are you? Can this smart card log me in? Am I the rightful owner of this password?
Open doors-physical access City of Baltimore-Department of Public
Works uses Voice Authentication for Access Control
Is this the person on record? Identification State of Connecticut-Department of Social
Services uses Finger Print Imaging to reduce welfare fraud-$23M savings
Who are you? Nation Bank - TX ATM application
Do we know you? Facial recognition at Super Bowl in Florida. Match against known image.
Am I the rightful owner of this password? Login by:
Typing user name and password
AND
Your unique Biometric.
Social Engineering Collusion Theft or Fraud
**Making A Mold
Soften Plastic Material with Hot
Water Press Live Finger into
Plastic.
Final Mold.
**From Tsutomu Matsumoto’s research..
Make the Liquid and Gelatin mix where the gelatin is at 50% wt.
Add Boiling Water 30cc to 30g of gelatin and mix. Process takes approximately 20 minutes.
Artificial Finger Print
**From a Real Finger.
**From Tsutomu Matsumoto’s research..
**From a Real Finger.
Pour Liquid Into Mold.
Refrigerate To Cool.
Final Gummy Print.
This Process takes approximately 10 Minutes.
**From Tsutomu Matsumoto’s research..
Manufacturer/Selling Agency Type Sensor Type
Live Detection
1 Compaq Computer Corp. DFR -200 Optical Unknown
2 Mitsubishi Electric Corp. FPR-DTmk11 Optical Unknown
3 NEC Corp. N7950-41, PK-FP002
Optical Unknown
4 OMRON Corp. FPS-1000 Optical Unknown
5 Sony Corp. FIU-002-F11,FIU-710
Capacitive Yes
6 SecuGen Corp. SMB-800 Optical Unknown
7 FUJITSU Limited FS-200U Capacitive Unknown
8 Siemens AG EVALUATION-KIT
Capacitive Unknown
9 Enthetica Inc. MS 3000 Optical Unknown
**From Tsutomu Matsumoto’s research..
Tsutomu Matsumoto [email protected]://www.cyberpunks.org/display/630/article/
c’t Magazine from Germanyhttp://www.heise.de/ct/english/02/11/114/
Just “Google” - “Defeating Biometrics” for more information.
*FaceVACS-Logon can be outfoxed with a short video clip of a registered
person.
Once Live-Check has been activated all attempts at deception with stills are foiled.
A short .AVI video clip with the webcam in which a registered user was seen to move his head slightly to left and right. The program did in fact detect in the video sequence played to it a moving 'genuine' head with a known facial metric, whereupon it granted access to the system.
*c’t magazine – Germany
Quantify likelihood of previous cases Costs
Technology Acquisition (HW & SW) User training-hard enrollment FTR Deployment-configuration check Process change Help desk calls Hardware product lifecycle
Biometrics field is old, industry is new Entire industry was $65M in 1999 Global Industry Analysts Inc. states biometric sales
are to exceed $6.48 billion by 2010… (July 2007)
Not a technology issue but a people issue Due diligence is key. Privacy is also a concern.
Biometrics helps with authentication Nothing is absolute!
www.bioapi.org www.ibia.org www.biometricgroup.com www.biodigest.com
QUESTIONS?Gordon Ross – BScEE – CET – HSG
VIRTUAL PERCEPTION SYSTEMS [email protected]
www.my-spy.com