Presentation Attack Detection Evaluation on Mobile Devices: Simplest Approach for Capturing and Lifting a Latent Fingerprint

Given that nowadays we store increasing sensitive data on our mobile devices (documents, photos, bank accounts, etc.), it is crucial to know how secure the protection of the phone really is. Most new smartphones include an embedded fingerprint sensor due to its comfort of use and security. In the last decades, many studies and tests have shown that it is possible to steal a person's fingerprint and reproduce it, with the intention of impersonating them. This has become a bigger problem as the adoption of fingerprint sensor cell phones have become mainstream. Thus, it is important to know how easy it really is for anyone to capture a latent fingerprint. For this work, we searched for the easiest process to steal a latent fingerprint from a phone screen. In 2013, the Chaos Computer Club proved that this was possible using a desktop scanner and image editing programs. Nowadays, smartphones have high quality cameras and document scanning apps that do exactly the image processing needed to obtain a fingerprint from a screen, making it very easy for attackers to steal someone's identity. Thus, the approach used in this work is taking a picture of the genuine subject's screen with a document scanner app that can be downloaded for free for the phone, and let it do the common processing for documents, which is one tap away for the attacker. Then, a PAD (Presentation Attack Detection) evaluation was made to check how many attempts were successful using this technique. This evaluation was performed on 5 smartphones, using 15 capture subjects and making a total of 17,100 attack attempts. All smartphones were successfully attacked using this simple technique with at least 3 out of 4 artefact species.