It became a fingerprint reader one of the central pillars which support the security of your smartphone, although some models have been betting on more advanced solutions for some time, such as the Apple iPhone, which, as our regular readers already know, uses a 3D facial recognition system that cannot be fooled by photos or videos.

There is no doubt that both security systems do its advantages and disadvantages when used on a smartphone, and that ultimately there is no perfect solution, but the truth is that defeating a fingerprint reader is much easier than it seems, and it is not necessary to use advanced or particularly expensive technology.

A group of experts has shown that it is possible to overcome the fingerprint reader of various terminals based on Android and iOS, which include e.g. Galaxy S10+, iPhone SE, OnePlus 7 Pro and Xiaomi Mi 11 Ultrausing a fingerprint brute force attack known as “Brute Print”.

In order to carry out this type of attack, she resorted to plate that costs just $15and which integrates an STMicroelectronics STM32F412 microcontroller, a two-channel bidirectional analog switch known as RS2117, an SD flash card with 8 GB of storage capacity containing a huge database of fingerprintsand a board-to-board connector that connects the phone’s motherboard to the fingerprint sensor’s flexible printed circuit board.

This type of attack exploits vulnerabilities that allow unlimited fingerprint identification attemptsand from there it will start using the database of fingerprints that the board contains to send them to the smartphone until it is unlocked. I know what you’re thinking, how can I miss a fingerprint? The answer might surprise you, but the truth is that they don’t really need your fingerprint for this attack to work.

The crux of the matter is that a fingerprint authentication system has a reference edge or threshold that is relatively wide, meaning that does not require an exact match at the fingerprint level, but it is enough for this picture to be considered an acceptable approximation. In other words, if a fingerprint similar to ours is found in that database, the attack will succeed and the security of our smartphone will be compromised.

On the other hand, it should also be noted that with “BruteForce” manipulation is done so that the false acceptance rate is higher, which greatly facilitates the margin of success when using images similar to our actual fingerprint. Obviously, in order to perform this type of attack, it is not only necessary to have the plate, but also you have to connect it to your smartphone and turn its fingerprint database into a kind of “dictionary” usable, but not particularly difficult for people with minimal knowledge.