U3. Biometric Attacks

U3. Biometric Attacks

1. 8 Classes of attack

   • 1. At Sensor
   • 2. Transmission from sensor to extraction
   • 3. At feature extraction
   • 4.Transmission from extraction to matcher
   • 5. At Matcher
   • 6. At Reference Template Database
   • 7 Between DB * Matcher
   • 8. Between matcher & Decison

2. Most vulnerable at time of enrolment

   • Using a fake ID or credentials to get enrolled
     • Your biometric feature will then be tied to that ID. You could not enrol with your proper ID as the biometric will already be registered

3. DOS attack

   • Attacker corrupts the authentication system so legitimate users cant use it
   • Online Authentication service is bombarded with false requests

4. Circumvention attack

   • Back door or zero day

5. Privacy attack

   • Attacker gains access to all the personal data in the database = reference templates

6. Contamination attack

   • Attacker gets biometric data of legitimate users to access system

7. Collusion attack

   • Legitimate user contaminates or modifies a system on behalf of a 3rd party so that the 3rd party can take advantage

8. Coercion attack

   • If a legitimate user is forced to access the system againt his will for 3rd party gain