Digital fingerprint door lock defeated by photocopied 'print

There's an old adage in the security community that any lock can be picked. Well in this modern age of digital doorlocks with fingerprint scanners, you can't exactly pick them with a bump key, nail file or other such assorted tools, now can you? Luckliy for budding criminals, the smart cats on "Mythbusters" discovered that one of these "never been broken" digital fingerprint scanner locks (they didn't cite the manufacturer) -- which also comes with thermal sensors (to detect if there's a real human behind that print) -- can in fact be quite easily duped. So how'd they do it? By copying the master fingerprint onto a piece of latex and attaching it to his thumb, Adam Savage was able to open the lock without a problem. Savage and his team then duplicated the feat by making another copy with ballistics gel. And to top it all off, they did it a third time (check the video link below) with a just a photocopy of the master fingerprint and a little saliva. Perhaps our own Marc Weber Tobias should have a word with the makers of these schlocky locks.

[Richard Lai @ Sep 22nd 2006 7:58AM]

Oh thanks, Mythbusters! Now everyone's going to try this on people's laptops!

[Matthew @ Sep 22nd 2006 8:52AM]

Actually, having watched the episode (two? weeks ago), they had a much harder time getting a run of the mill laptop scanner to read their prints. They were concerned about the door because it was supposed to be much harder (checking for pulse and humidity, etc.), but in the end, the door responded to the each of the three methods, whereas the only one that worked on the computer was the ballistics gel. In addition, they said they left one "key" step out on the air to prevent other people from doing this.

[Court Kizer @ Sep 22nd 2006 8:03AM]

I don't know why anyone uses fingerprint scanners in their laptops, probably because it makes them feel safe. As far as the door goes, this manufacturer is the same company that manufactures all the security on doors in the Pentagon and many of the ScrubRooms, that private conversations are held in on the Hill. Makes me feel really safe.

[iskra @ Sep 22nd 2006 8:18AM]

I've seen this show -- nice work, somebody is going to loose a lot of business/get sued :)

[LittleJoe @ Sep 22nd 2006 8:20AM]

my boys! makin' engadget headlines... woot!

[Superphreeq @ Sep 22nd 2006 8:25AM]

I loved this episode, but it was aired a long time ago. Like a month or two. Why is it making headlines now? Ah well I dun care...it was a great episode.

[Keith L. Dick @ Sep 22nd 2006 8:27AM]

I just saw that episode the other night... Didn't know it was old but it was still very interesting...

[Malfeis @ Sep 22nd 2006 8:33AM]

Of course, they neglect to mention the part about *getting* the finger/handprint photocopied. "Uh, excuse me, Mr. Rumsfeld, if you would just step over to this xerox for a second..."

[xiblack @ Sep 22nd 2006 8:40AM]

Just cut their fingure off. Problem solve.

[Doody @ Sep 22nd 2006 8:47AM]

that's not how they did it. They actually lifted a finger print just like you see on CSI then photocopied it. the guy they used for the fingerprint even tried to avoid giving them a chance to get his fingerprint on anything.

[Michael @ Sep 22nd 2006 1:45PM]

Actually, if you watch the full episode, they do address that very fact.

[psdiao @ Sep 22nd 2006 8:58AM]

"they said they left one "key" step out on the air to prevent other people from doing this"
I knew it, they had a key.

[z0idberg @ Sep 22nd 2006 10:14AM]

"In addition, they said they left one "key" step out on the air to prevent other people from doing this."

I didn't see the episode so it's a guess..but was the "key" step the fact that they would have had to reverse the print? i.e. a copy of the lifted print would have been a mirror image wouldn't it?

[Richard Lai @ Sep 22nd 2006 9:53AM]

Matthew: That's good to know (and I ought to watch the show more often), although I was referring to the USB "glass" scanners (well, they are for desktops as well) and silicon chip scanners (the full size ones rather than the swipe ones, and you can get them on PCMCIA cards - I used to have one!).

[Jimbo @ Sep 22nd 2006 10:31AM]

Wouldn't they have to reverse the photocopy? Haven't seen the show so I don't know if they did or not...

[russ @ Sep 22nd 2006 9:27AM]

what can't the mythbusters solve with ballistics gel?

[PEZ @ Sep 22nd 2006 9:30AM]

GOLLY GUS! I would think the companies who make these things would try every possible way to try and make it work - you know that thing they do? I bet they knew about this, and they said "no one will ever try that!"

[Paul @ Sep 22nd 2006 9:34AM]

An interesting thing to note is that they first did their tests on a run of the mill USB finger print scanner, and it was not even fooled by the paper photocopy of the fingger print, they had to make a detailed silicon fingerprint in order for it to work.

[Luke @ Sep 22nd 2006 9:50AM]

The step they left out was they reversed blakc and white once they had cleaned up the print. This gave them a negative image on the copper plate so they could make a positive with the gel/latex. If you look close enough at the plate they make they had put it both ways, it only makes sence that they would have to reverse the image to get a positive of the actual print. ;)

[Morder @ Sep 22nd 2006 10:08AM]

odm
"Capacitive ones are much better."

The scanner they tested used that technology. To bypass it they just licked their fingers. Which offered capacitance

[will @ Sep 22nd 2006 10:09AM]

I remember a while ago when People were hacking these fingerprint scanners with gummy bears. http://www.pcworld.com/article/id,103535-page,1/article.html

[Gregory Schmidt @ Oct 20th 2006 4:29PM]

The model of the lock was CFS-1800M. Haven't been able to find the manufacturer yet, but I have a friend who runs a lock shop, and I'll bet he'll have that info.

[Ryan @ Sep 22nd 2006 10:34AM]

This is what bothers me about the new trend in society - where everyone is trying to incorporate biometric scanners into everything. computer security, I believe theres one or two cars that open via a fingerprint scanner, and most recently I've seen news stories advertising these companies that are using fingerprint scanners to replace debit cards. What happens when someone gets a copy of your fingerprint? It's not like they can issue you a new finger like they issue new atm/credit cards. I don't know if this system requires a pin...but even if it did ... sure they could change your pin after someone stole your fingerprint, but with most pins nowadays being 4 digits...thats not a very secure system for financial transactions.

[Jason @ Sep 22nd 2006 10:51AM]

When they created these stupid locks their reasoning was, apparently, to reduce the odds of someone creating a matching key from scratch (in this case a fingerprint). The obvious thing they missed is that keys don't have to be created from scratch--they can be *copied*. And unlike real keys, fingerprints leave copies of themselves everywhere.

Moronic.

[Rick @ Sep 22nd 2006 11:46AM]

Just another reason why using single methods of security is a bad idea. While fingerprint scanners are far from ideal, used in conjuction with another method (such as a proximity card) the level of security rises because its just one more item that someone who wants to circumvent the system has to possess to gain access.

For most consumers the thought of having a fingerprint scanner makes them feel like they are safe and protected against theft and that is good enough for them and the people who market these devices.

[magnetman_exe @ Sep 22nd 2006 11:40AM]

You always learn something new on mythbusters!

[Shawn @ Sep 22nd 2006 3:00PM]

Exactly. That's why the "high security" doors at my place of employment use three layers of security: RFID proximity card, 5 digit minimum security code, and a fingerprint scan.

[CubeGuy @ Sep 22nd 2006 12:00PM]

I have the same scanner that they tested for the PC. The flaw in their tactics is that I never use my thumb. Good luck guessing which one of my other fingers I used, suckers. =D

[Jeff @ Sep 22nd 2006 12:55PM]

Mythbusters remains one of the best shows on TV for stuff like this. And the thing I love about them is they'll tackle almost anything, from beating security systems to testing whether you can use an umbrella as a parachute. And they always blow something up on every episode. The whole concept is pure genius!

I wish I had their job.

One of the other things they showed on this episode is that you can beat a thermal motion detector with a white bed sheet. That was shocking even to them.

The thing about security, though, is that anybody will tell you that you shouldn't be relying on a single device to secure anything. Sure, it's possible somebody would have a white bed sheet. It's possible somebody would have a bump key. It's possible somebody would have your alarm system's master code. It's possible somebody would have a copy of your fingerprint.

But to have *everything* someone would need to defeat these multiple layers of technology would require some serious time, energy and skill. Unless you're storing the Hope Diamond in your house, it's really not going to be worth it for 99% of thieves.

Me, I've just got a monitored alarm system and a security camera, and I can't see how anybody's going to defeat both.

Any home alarm system at all, btw, will render bump keys totally useless. Provided you've got sensors at every door, of course, but that's a pretty standard setup.

[Robert @ Sep 22nd 2006 3:28PM]

i was able to get into my microsoft reader with just a perminent marker and a peice of paper and my spit in less than 2 minutes also will try to lift a print off my mouse for those of you who say where well do you get the print what happend to the mouse buttons!!!!

[Murc @ Sep 22nd 2006 7:26PM]

Yeah I saw this episode a month or so ago...its was a good one...I was suprised how easy it was to fool the doors and cameras.

The funny thing is the old "lock & key" is actually better then these new fangled finger print readers.

[Dave @ Sep 23rd 2006 12:38AM]

MacGyver did that in one episode. :-) But he used wax on his finger and some carbon off a pencil I think.

[obm @ Sep 23rd 2006 3:56PM]

There are methods for electronic fingerprint scanning, each having a vulnerability of its own, but this particular one is the worst I guess. Is it an older optical one? Capacitive ones are much better.

What is that alarm anyways?

By the way, why are you trying to deceive the scanner/keypad? If opening the door is the goal, most of the locks use solenoids for locking mechanism, and shielding magnetic fields is not easy, with a strong enough field every electronic door can be opened, if you know the intrinsics.

On second tought, carrying a huge solenoid of your own raises too much suspision I guess.

[pradeep @ Oct 9th 2006 1:59AM]

can u give me the circuit of it

[johnseattle @ Aug 11th 2007 10:38PM]

M32 Fingerprint door lock uses UPEK silicon sensor-the most reliable fingerprint sensor in the word. Please visit http://www.akmelock.com for more information.

[Anthony @ Oct 26th 2007 8:24PM]

Lock Jaw Security (www.lockjawsecurity.com) can defeat this...it's a simple and safe solution.

[Anthony @ Oct 26th 2007 8:25PM]

Home invasion is huge and is on the rise as a result of the epidemic of "lock bumping". When you're home, you deserve to feel safe and secure. A new product, Lock Jaw Security, has been on QVC, HGTV, network news and radio. It's a great product. Their website is: www.lockjawsecurity.com

[Will @ Dec 13th 2007 10:57PM]

Re: Anthony

So... how much is your commission for these "lock jaws," 'cause you sound chezier than an infomercial?

[johnseattle @ Mar 23rd 2008 4:51AM]

How often do you see someone forget or, worst
case scenario, lose his office keys, while everyone is waiting for him to unlock
the door? Not to mention the fact that it will cost and exorbitant amount to
have a professional locksmith unlock the door and have the door lock replaced. fingerprint
door locks are the solution.

[johnseattle @ Mar 24th 2008 3:49AM]

Kwikset SmartSca[fingerprint door lock](http://fingerprintdoorlocks.biz/) is designed for unsurpassed security,
style, keyless and ease of use. Keys are no longer needed with the Kwikset SmartScalock. Kwikset SmartSca [fingerprint lock](http://fingerprintdoorlocks.biz/) wake up automatically
when you swap your finger on sensor. The [biometric lock](http://fingerprintdoorlocks.biz/) will check your fingerprint. You also can delete user individually. You can even access the lock with a
key. The lock rival the security levels that the Pentagon has. Kwikset SmartSca biometric Door lock is excellent for the residential
home or commercial office.

[fingerprint door lock @ Apr 2nd 2008 12:10AM]

Please visit http://http://reviews.fingerprintlocks.info to find biometric door lock reviews.

[fingerprint door lock @ Apr 2nd 2008 12:15AM]

Fingerprint door lock incorporates the proven technology. Fingerprint scanning is the most mature and tested type of biometric technology. Recent studies on biometrics have shown that compared to the hand method, fingerprint is more accurate and cost-effective. The duplication of biometric fingerprint technology is virtually impossible, only one in one billionth of a chance. Biometric security guarantees a positive method of user identification with something that cannot be lost, replicated or stolen. Please visit (http://www.akmelock.com) to find best deal.

[fingerprint door lock @ Apr 2nd 2008 12:18AM]

Best biometric fingerprint door lock review site(http://reviews.fingerprintlocks.info)

[johnseattle @ Apr 2nd 2008 2:38PM]

Fingerprint door lock incorporates the proven technology. Fingerprint scanning is the most mature and tested type of biometric technology. Recent studies on biometrics have shown that compared to the hand method, fingerprint is more accurate and cost-effective. The duplication of biometric fingerprint technology is virtually impossible, only one in one billionth of a chance. Biometric security guarantees a positive method of user identification with something that cannot be lost, replicated or stolen. Please visit http://www.akmelock.com to get great fingerprint door lock dealer.

[akmelock @ Jun 26th 2008 4:44PM]

Adel Trinity 788 biometric fingerprint door lock is latest model of LA9-3, LA9-388 and FTL. It is availavle to sell at http://www.akmelock.com. ONLY $189.