From Seaweed to Security: The Emergence of Alginate in Compromising IoT Fingerprint Sensors
Pouria Rad, Gokila Dorai, Mohsen Jozani
TL;DR
This paper investigates the vulnerability of IoT-capacitive fingerprint sensors to spoofing using Alginate, a seaweed-derived biopolymer with skin-like properties. It couples material testing with an image-to-3D-model pipeline to fabricate fingerprint molds and conducts controlled spoofing experiments on smart Locks, complemented by a hypothetical attack scenario leveraging publicly available fingerprint images. Results reveal device- dependent susceptibility, with some locks exhibiting appreciable vulnerability while others resist spoofing, underscoring significant security and privacy implications. The work highlights the need for stronger anti-spoofing measures and for digital forensics to adapt to threats arising from material spoofing and image-based fingerprint reconstruction.
Abstract
The increasing integration of capacitive fingerprint recognition sensors in IoT devices presents new challenges in digital forensics, particularly in the context of advanced fingerprint spoofing. Previous research has highlighted the effectiveness of materials such as latex and silicone in deceiving biometric systems. In this study, we introduce Alginate, a biopolymer derived from brown seaweed, as a novel material with the potential for spoofing IoT-specific capacitive fingerprint sensors. Our research uses Alginate and cutting-edge image recognition techniques to unveil a nuanced IoT vulnerability that raises significant security and privacy concerns. Our proof-of-concept experiments employed authentic fingerprint molds to create Alginate replicas, which exhibited remarkable visual and tactile similarities to real fingerprints. The conductivity and resistivity properties of Alginate, closely resembling human skin, make it a subject of interest in the digital forensics field, especially regarding its ability to spoof IoT device sensors. This study calls upon the digital forensics community to develop advanced anti-spoofing strategies to protect the evolving IoT infrastructure against such sophisticated threats.