4 ms·

This would be amazing if true, but after being burned on a bunch of "too crazy to be true" tech stories recently (toothbrush bot armies anyone?) I'm very skepti

This would be amazing if true, but after being burned on a bunch of "too crazy to be true" tech stories recently (toothbrush bot armies anyone?) I'm very skeptical. The idea that there is enough resolution in the sound of a finger swipe to determine the fingerprint ridges on that finger is really suspect to me.

arp242 3y ago
I also have to admit my skepticism. Skimming through the paper, I don't think they emulated "real-world conditions" as claimed in the conclusion. They had participants swipe the screen 25 times in a row. Real-world conditions would be giving them 12 hours of recording throughout the day, or something like that, because knowing when and where to look is probably a major challenge on its own. I'll also add that even if true, it's probably not a huge practical issue. Fingerprints are mostly used to secure personal devices: phones, sometimes computers. If I were to have your full fingerprints then that would be mostly useless because I don't have access to your physical device. Even things like "purchase on App Store with fingerprints" usually works by having the fingerprint only secure a key on the device itself (rather than sending the fingerprint data over the network). And if you have access to your physical devices, then I almost certainly also have access to your fingerprints via the good ol' "dust for prints" technique. There was a "fingerprints for everything!" push a decade or so ago, and that was harshly criticized because you leave fingerprints everywhere, and you can even lift them from photographs. Certainly the "enormous economic and personnel losses, and even a potential compromise of national security" claim at the start of the paper seems rather exaggerated, even hysterical.
- PeterisP 3y ago
  I don't think that real-world conditions would be giving them 12 hours of recording throughout the day - a malicious app that explicitly asks people to swipe left/right on pictures of kittens is a very realistic attack scenario and would know exactly when and where to look for the swipes.
mzs 3y ago
paper is pretty convincing: https://www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2024-618-p...
- kurthr 3y ago
  Actually, there are two things that stick out to me in the paper. 1 The low FAR (False Accept Rate) is unbelievably high at 0.01% 2 The "partial prints" are described as single or "mixed" minutia The FAR is 1-2 orders of magnitude off of even cheap mobile device authentication. The described size of the partial prints imply that the relative location of partials is not extractable. Since most fingerprint matchers rely on multiple (3-4) minutiae at a minimum and their relative location along with ridge orientation and pitch correlations it seems like this doesn't provide necessary information. More importantly, even with more information it can't construct that relative information, because it can't resolve symmetries (certainly not without knowing the direction of motion for the swipes and the orientation of the finger) correlated with those sounds. That requires other out of band information. It's interesting work, but there's probably a reason that you don't see fingerprint matchers with decent FAR/FRR using only the microphone on a mobile device and some software. There are a $B reasons to develop that every year, and yet there hasn't been one developed for 15-20 years.
  - PeterisP 3y ago
    Why wouldn't it know the direction of motion for the swipes and the orientation of the finger? Any mobile app has access to the touchscreen input which provides exactly that information.
    - kurthr 3y ago
      Unless you're playing fruit ninja there's really quite little control over the speed and direction of swipes... many people swipe very little at all or with a different finger than they enroll in biometrics or type on the screen. Some even swipe with multiple fingers. Then there's the fact that there are more than 20 minutia per finger so when referring to orientation, this means the angles and what portion of the finger is in contact with the touch surface... and thus which of those minutia (swirl, end, fork, etc) are in generating any sound.
lynndotpy 3y ago
The 'toothbrush bot armies' are entirely believable though. The story was not real, but is completely within the realm of reality. E.g. Perhaps the toothbrush has a connectivity check to OralB servers that triggers once per hour, but you can change it to check a victim webpage once a millisecond. Smart toothbrushes (and/or their docks) have little computers inside of them. Oral B smart toothbrushes offered an API eight years ago https://github.com/dukescript/dukebrush https://github.com/dukescript/dukebrush as well as a real-time web API: https://web.archive.org/web/20160310121235/https://developer.oralb.com/ https://web.archive.org/web/20160310121235/https://developer... All there would need to be is an exploit that allows someone to (1) identify and talk to the toothbrushes, (2) coerce the toothbrush to ping an arbitrary IP, and (3) cause step 2 to happen many times for just one trigger.
- hn_throwaway_99 3y ago
  > The story was not real, but is completely within the realm of reality. Of course. A good lie is defined by it being relatively believable. Re: the viability of the exploit, my understanding is that most smart toothbrushes do not connect to the Internet, and even if they did, the huge numbers originally presented in the story (3 million toothbrushes) are astronomically high.
  - lynndotpy 3y ago
    Yeah; even ~300K or so (like Mirai in 2016) would be surprisingly high.
- kube-system 3y ago
  Yes it has an API, but that doesn't mean it's on the internet. To connect via that API you have to connect to the toothbrush via bluetooth.
  - TeMPOraL 3y ago
    Bluetooth is a PITA, low-budget "smart" devices are all becoming Wi-Fi now.
yorwba 3y ago
The toothbrush bot army story got started by a Swiss newspaper writing about a scenario they heard from a cybersecurity company and claiming that even though it sounds like a Hollywood movie, "this really happened". When the company in question was reached for comment, they said it was hypothetical. In the end, the story's spread can be explained by a journalist's simple misunderstanding that made the story much more virulent. In this case, the journalist probably also doesn't understand the technical details, but we have a link to the researchers' own write-up right there in the article, which makes it much easier to rule out simple misunderstandings. So the situation is completely different. That said, they're not reconstructing the fingerprint ridges from the sound the way you're probably imagining. Instead, they build on an existing attack exploiting fingerprint readers' error tolerance with a set of "masterprints" that are unusually likely to be accepted as a match, and the sound is used to determine which masterprint to use first.
- hn_throwaway_99 3y ago
  > In the end, the story's spread can be explained by a journalist's simply misunderstanding that made the story much more virulent. Bollocks, you're letting the "journalist" off way too easily. That toothbrush story was simply "a story too good to vet", meaning, sure, the author had a convenient excuse blaming it on a "misunderstanding", and while I don't believe the author was necessarily lying, I do believe they had no incentive to dig any more deeply because the toothbrush bot army story was already clickbait enough.
  - lupusreal 3y ago
    Journalists seem to do an awful job with the kind of stories I understand, but surely they do better most of the time...
    - CaptainFever 3y ago
      Ah, the Gell-Mann Amnesia Effect. https://theportal.wiki/wiki/The_Gell-Mann_Amnesia_Effect https://theportal.wiki/wiki/The_Gell-Mann_Amnesia_Effect
yau8edq12i 3y ago
The toothbrush botnet story was also spread by tom's hardware in the English-speaking world. It seems like what they publish should be taken with a spoonful of salt.

arp242 3y ago

I also have to admit my skepticism. Skimming through the paper, I don't think they emulated "real-world conditions" as claimed in the conclusion. They had participants swipe the screen 25 times in a row. Real-world conditions would be giving them 12 hours of recording throughout the day, or something like that, because knowing when and where to look is probably a major challenge on its own. I'll also add that even if true, it's probably not a huge practical issue. Fingerprints are mostly used to secure personal devices: phones, sometimes computers. If I were to have your full fingerprints then that would be mostly useless because I don't have access to your physical device. Even things like "purchase on App Store with fingerprints" usually works by having the fingerprint only secure a key on the device itself (rather than sending the fingerprint data over the network). And if you have access to your physical devices, then I almost certainly also have access to your fingerprints via the good ol' "dust for prints" technique. There was a "fingerprints for everything!" push a decade or so ago, and that was harshly criticized because you leave fingerprints everywhere, and you can even lift them from photographs. Certainly the "enormous economic and personnel losses, and even a potential compromise of national security" claim at the start of the paper seems rather exaggerated, even hysterical.

PeterisP 3y ago
I don't think that real-world conditions would be giving them 12 hours of recording throughout the day - a malicious app that explicitly asks people to swipe left/right on pictures of kittens is a very realistic attack scenario and would know exactly when and where to look for the swipes.

mzs 3y ago

paper is pretty convincing: https://www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2024-618-p...

kurthr 3y ago
Actually, there are two things that stick out to me in the paper. 1 The low FAR (False Accept Rate) is unbelievably high at 0.01% 2 The "partial prints" are described as single or "mixed" minutia The FAR is 1-2 orders of magnitude off of even cheap mobile device authentication. The described size of the partial prints imply that the relative location of partials is not extractable. Since most fingerprint matchers rely on multiple (3-4) minutiae at a minimum and their relative location along with ridge orientation and pitch correlations it seems like this doesn't provide necessary information. More importantly, even with more information it can't construct that relative information, because it can't resolve symmetries (certainly not without knowing the direction of motion for the swipes and the orientation of the finger) correlated with those sounds. That requires other out of band information. It's interesting work, but there's probably a reason that you don't see fingerprint matchers with decent FAR/FRR using only the microphone on a mobile device and some software. There are a $B reasons to develop that every year, and yet there hasn't been one developed for 15-20 years.
- PeterisP 3y ago
  Why wouldn't it know the direction of motion for the swipes and the orientation of the finger? Any mobile app has access to the touchscreen input which provides exactly that information.
  - kurthr 3y ago
    Unless you're playing fruit ninja there's really quite little control over the speed and direction of swipes... many people swipe very little at all or with a different finger than they enroll in biometrics or type on the screen. Some even swipe with multiple fingers. Then there's the fact that there are more than 20 minutia per finger so when referring to orientation, this means the angles and what portion of the finger is in contact with the touch surface... and thus which of those minutia (swirl, end, fork, etc) are in generating any sound.

lynndotpy 3y ago

The 'toothbrush bot armies' are entirely believable though. The story was not real, but is completely within the realm of reality. E.g. Perhaps the toothbrush has a connectivity check to OralB servers that triggers once per hour, but you can change it to check a victim webpage once a millisecond. Smart toothbrushes (and/or their docks) have little computers inside of them. Oral B smart toothbrushes offered an API eight years ago https://github.com/dukescript/dukebrush https://github.com/dukescript/dukebrush as well as a real-time web API: https://web.archive.org/web/20160310121235/https://developer.oralb.com/ https://web.archive.org/web/20160310121235/https://developer... All there would need to be is an exploit that allows someone to (1) identify and talk to the toothbrushes, (2) coerce the toothbrush to ping an arbitrary IP, and (3) cause step 2 to happen many times for just one trigger.

hn_throwaway_99 3y ago
> The story was not real, but is completely within the realm of reality. Of course. A good lie is defined by it being relatively believable. Re: the viability of the exploit, my understanding is that most smart toothbrushes do not connect to the Internet, and even if they did, the huge numbers originally presented in the story (3 million toothbrushes) are astronomically high.
- lynndotpy 3y ago
  Yeah; even ~300K or so (like Mirai in 2016) would be surprisingly high.
kube-system 3y ago
Yes it has an API, but that doesn't mean it's on the internet. To connect via that API you have to connect to the toothbrush via bluetooth.
- TeMPOraL 3y ago
  Bluetooth is a PITA, low-budget "smart" devices are all becoming Wi-Fi now.

yorwba 3y ago

The toothbrush bot army story got started by a Swiss newspaper writing about a scenario they heard from a cybersecurity company and claiming that even though it sounds like a Hollywood movie, "this really happened". When the company in question was reached for comment, they said it was hypothetical. In the end, the story's spread can be explained by a journalist's simple misunderstanding that made the story much more virulent. In this case, the journalist probably also doesn't understand the technical details, but we have a link to the researchers' own write-up right there in the article, which makes it much easier to rule out simple misunderstandings. So the situation is completely different. That said, they're not reconstructing the fingerprint ridges from the sound the way you're probably imagining. Instead, they build on an existing attack exploiting fingerprint readers' error tolerance with a set of "masterprints" that are unusually likely to be accepted as a match, and the sound is used to determine which masterprint to use first.

hn_throwaway_99 3y ago
> In the end, the story's spread can be explained by a journalist's simply misunderstanding that made the story much more virulent. Bollocks, you're letting the "journalist" off way too easily. That toothbrush story was simply "a story too good to vet", meaning, sure, the author had a convenient excuse blaming it on a "misunderstanding", and while I don't believe the author was necessarily lying, I do believe they had no incentive to dig any more deeply because the toothbrush bot army story was already clickbait enough.
- lupusreal 3y ago
  Journalists seem to do an awful job with the kind of stories I understand, but surely they do better most of the time...
  - CaptainFever 3y ago
    Ah, the Gell-Mann Amnesia Effect. https://theportal.wiki/wiki/The_Gell-Mann_Amnesia_Effect https://theportal.wiki/wiki/The_Gell-Mann_Amnesia_Effect

yau8edq12i 3y ago

The toothbrush botnet story was also spread by tom's hardware in the English-speaking world. It seems like what they publish should be taken with a spoonful of salt.