Security researchers disclosed new work at the Chaos Communication Congress showing how hackers can bypass vein based authentication.

Image: Krissler, Albrecht.

Devices and security systems are increasingly using biometric authentication to let users in and keep hackers out, be that fingerprint sensors or perhaps the iPhone’s FaceID. Another method is so-called ‘vein authentication,’ which, as the name implies, involves a computer scanning the shape, size, and position of a users’ veins under the skin of their hand.

But hackers have found a workaround for that, too. On Thursday at the annual Chaos Communication Congress hacking conference in Leipzig, Germany, security researchers described how they created a fake hand out of wax to fool a vein sensor.

"It makes you feel uneasy that the process is praised as a high-security system and then you modify a camera, take some cheap materials and hack it," Jan Krissler, who goes by the handle starbug, and who researched the vein authentication system along with Julian Albrecht, told Motherboard over email in German.

Vein authentication works with systems that compare a user’s placement of veins under their skin compared to a copy on record. According to a recent report from German news wire DPA, the BND, Germany’s signals intelligence agency, uses vein authentication in its new headquarter building in Berlin.

Caption: Slides from the researchers' talk showing the manufactured hand. Image: Krissler, Albrecht.

One attraction of a vein based system over, say, a more traditional fingerprint system is that it may be typically harder for an attacker to learn how a user’s veins are positioned under their skin, rather than lifting a fingerprint from a held object or high quality photograph, for example.

But with that said, Krissler and Albrecht first took photos of their vein patterns. They used a converted SLR camera with the infrared filter removed; this allowed them to see the pattern of the veins under the skin.

“It’s enough to take photos from a distance of five meters, and it might work to go to a press conference and take photos of them,” Krissler explained. In all, the pair took over 2,500 pictures to over 30 days to perfect the process and find an image that worked.

They then used that image to make a wax model of their hands which included the vein detail.

“When we first spoofed the system, I was quite surprised that it was so easy,” Krissler said.

Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

The researchers disclosed the details of their research to Fujitsu and Hitachi. According to Krissler they presented their research to employees from Hitachi while Fujitsu did not reply back to them in length. Neither company responded to a request for comment from Motherboard.

Krissler and Albrecht only spent around a month working on this research. A well-funded and resourced adversary, perhaps a state that is trying to break into an area secured with vein authentication, could likely replicate this research on a larger and more efficient scale. That may be particularly worrying when the sort of targets protected with vein authentication are sometimes exactly the ones that a state may want to target.

"Biometrics is always an arm race," Krissler said. "The manufacturers improve their systems, the hackers come and break it and then it goes back on."

\https://motherboard.vice.com/en_us/article/59v8dk/hackers-fake-hand-vein-authentication-biometrics-chaos-communication-congress?utm_source=reddit.com