[Paper Review] BrutePrint: Expose Smartphone Fingerprint Authentication to Brute-force Attack

Yu Chen, Yiling He|arXiv (Cornell University)|May 18, 2023

User Authentication and Security Systems4 citations

TL;DR

This paper presents BrutePrint, a novel brute-force attack framework that bypasses attempt limits and hijacks fingerprint images via zero-day vulnerabilities in smartphone fingerprint authentication (SFA) systems. By exploiting logical flaws in the SFA framework and leveraging SPI protocol insecurity, the attack enables unlimited fingerprint brute-forcing across 10 popular smartphones—achieving 71% spoof success while bypassing liveness detection using neural style transfer.

ABSTRACT

Fingerprint authentication has been widely adopted on smartphones to complement traditional password authentication, making it a tempting target for attackers. The smartphone industry is fully aware of existing threats, and especially for the presentation attack studied by most prior works, the threats are nearly eliminated by liveness detection and attempt limit. In this paper, we study the seemingly impossible fingerprint brute-force attack on off-the-shelf smartphones and propose a generic attack framework. We implement BrutePrint to automate the attack, that acts as a middleman to bypass attempt limit and hijack fingerprint images. Specifically, the bypassing exploits two zero-day vulnerabilities in smartphone fingerprint authentication (SFA) framework, and the hijacking leverages the simplicity of SPI protocol. Moreover, we consider a practical cross-device attack scenario and tackle the liveness and matching problems with neural style transfer (NST). We also propose a method based on neural style transfer to generate valid brute-forcing inputs from arbitrary fingerprint images. A case study shows that we always bypasses liveness detection and attempt limit while 71% spoofs are accepted. We evaluate BrutePrint on 10 representative smartphones from top-5 vendors and 3 typical types of applications involving screen lock, payment, and privacy. As all of them are vulnerable to some extent, fingerprint brute-force attack is validated on on all devices except iPhone, where the shortest time to unlock the smartphone without prior knowledge about the victim is estimated at 40 minutes. Furthermore, we suggest software and hardware mitigation measures.

Motivation & Objective

• To investigate whether large-scale fingerprint brute-force attacks are feasible on off-the-shelf smartphones despite existing security controls.
• To identify and exploit logical vulnerabilities in the SFA framework that allow bypassing attempt limits and enabling unlimited authentication attempts.
• To demonstrate hardware-based man-in-the-middle (MITM) fingerprint image hijacking via insecure SPI communication on fingerprint sensors.
• To develop a practical cross-device attack method that bypasses liveness detection and maintains fingerprint matching accuracy using neural style transfer.
• To validate the feasibility and effectiveness of the attack across diverse smartphone models, OS versions, and fingerprint sensor types (optical, capacitive, ultrasonic).

Proposed method

• Exploits two zero-day vulnerabilities—Cancel-After-Match-Fail (CAMF) and Match-After-Lock (MAL)—in the SFA framework to bypass attempt limits on Android and HarmonyOS devices.
• Uses a custom hardware device to perform MITM attacks on the SPI bus, intercepting and injecting fingerprint images directly into the sensor-to-processor channel.
• Employs neural style transfer (NST), specifically CycleGAN, to transform arbitrary fingerprint images from public databases into styles compatible with target SFA systems.
• Automates the brute-force process by systematically testing transformed fingerprint images against the target device’s authentication interface.
• Designs a low-cost, novice-friendly adversarial hardware setup compatible with multiple smartphone models and fingerprint sensor types.
• Validates the attack pipeline across screen lock, payment, and privacy app use cases to demonstrate real-world exploitability.

Figure 1 : The workflow of state-of-the-art SFA systems.

Experimental results

Research questions

• RQ1 Can brute-force fingerprint attacks be practically executed on off-the-shelf smartphones despite attempt limits and liveness detection?
• RQ2 What logical or implementation flaws in the SFA framework enable bypassing of attempt limits and unauthorized fingerprint image access?
• RQ3 To what extent can neural style transfer techniques be used to generate spoof fingerprint images that bypass liveness detection while maintaining matching accuracy?
• RQ4 How effective is the proposed MITM attack in hijacking fingerprint images via the insecure SPI interface across diverse smartphone models?
• RQ5 What is the real-world feasibility and success rate of large-scale fingerprint brute-forcing on modern smartphones with varying sensor technologies?

Key findings

• The BrutePrint framework successfully bypasses attempt limits on all tested Android and HarmonyOS devices, enabling unlimited authentication attempts.
• On iOS devices, the attempt limit is bypassed to allow 10 additional attempts beyond the standard limit, with an estimated 40-minute time-to-unlock without prior knowledge.
• Liveness detection is consistently bypassed in 100% of tested cases using neural style transfer (CycleGAN), with 71% of spoofed attempts successfully authenticating.
• Fingerprint image hijacking via SPI MITM is confirmed on all 10 tested smartphones, including devices with optical, capacitive, and ultrasonic fingerprint sensors.
• The attack is effective across diverse applications, including screen unlock (100% success), payment authorization (100% success), and privacy app unlocking (100% success).
• The vulnerability is not limited to specific models or OS versions, as it stems from logical flaws in the SFA framework, affecting all tested devices except iPhones to a lesser extent.

Figure 2 : The attack overview of BrutePrint .