from china to louisiana should we blame the pursuit of clout for these recent tragedies and how do you not let social media ruin society yeah i mean this is going really viral right now it's a hot topic two terrible incidents one was in the bahamas involving an 18-year-old named cameron robbins who was dared to jump into shark infested waters at night and uh you know many people believe that he would he passed away was possibly eaten by sharks and this is all caught on video by the way there's another video from china of a live streamer called brother 3000 andrew he lost the challenge with other live streamers he had to drink three bowls of bijou which is uh like a very strong chinese liquor and he was found passed away the next day as well and this has a lot of people asking is social media ruining society is clout ruining society or is it more just human nature and social media is not to blame yeah well we're gonna get into it guys please hit that like button check out other episodes of hot pot boys as we delve into the comments section and give our own takeaways but i guess a main question that i have david is it is it as easy as saying social media and the pursuit of clout and all these platforms need to be regulated somehow just as people say hey guns don't kill people people kill people or it's not cars that kill people it's people in cars that kill people and it's not drugs themselves that kill people it's people overdoing drugs that kill people yeah i mean i definitely think that there's an argument for regulation i do think in america it's difficult because there's such a strong ideal of freedom of speech um i think it's different and even canada has different laws the uk australia has different laws regarding the usage of social media than we have in america so i think that i don't know it can you regulate industries specifically and compartmentalize it or is it like overarching like freedom is freedom and i guess anybody out there who feels like that social media should be regulated how do we do it do we just monitor demonetize certain types of content things like that uh to discourage people from making it but anyways let's get into the comment section for the uh tragic uh uh cameron robbins story somebody said mixing alcohol with kids on a cruise ship is just a bad idea in general however this was going on before social media and it will go on forever yeah so basically people have been doing or i guess boats have a really high accident rate in general a lot of people die on boats a lot of people die in the water happens somebody um at my middle school the summer of going into high school and or they passed away in our local lake but there was just no social media back then so some people are saying well it could or could not have happened with or without social media right guys i mean i just feel like because everything's being caught on video it seems like it happens more often which i think certain things definitely do happen more often nowadays but i'm not sure uh about this i mean because people are always doing stupid things people have uh overdosed on alcohol in in hazing uh situations right like even back to the 1940s 50s 60s like way before the internet even existed i would say this though do you think the people in the video that are actually like cheering him on and being like okay bye bye Cameron like trying to sound cool on video first of all i'm sure this kid feels horrible right now knowing what happened but i'm like he's trying to still sound cool for the clout on the video while his friend's like pretty much about to die yeah and i i don't know if everybody knew what was happening at the time so i'm not saying that obviously anybody wanted this kid to get sucked up by the boat or killed by sharks obviously i don't think anybody was wishing that on him but i don't think anybody had an idea what was going on everybody's just in a frenzy being drunk first of all they're underage and shouldn't be drinking and they're out in the Bahamas you're not supposed to jump off a boat you're not supposed to throw anything off a boat you're not even supposed to oftentimes be running around on a boat you know what i mean so there's just probably so many things that are going wrong somebody said we definitely all did some dumb ish as drunken men when we were growing up everybody who's 18 years old and filled with testosterone feels like they are immortal but i do think social media plays into that yeah i mean i have done some stupid things that didn't turn out as bad as it could have right and this was before social media so i understand that it happens but i guess the issue is like and you know what sucks for for this situation is that i'm sure he had jumped off a number of boats in his life this is not the first time he's been around a boat it's probably not the first time he's drank on a boat it's probably not the first time he's jumped off a boat but this was like the worst possible situation and the amount of crowd and cameras out just added to it like maybe maybe if the cameras aren't there and everybody's cheering him up he doesn't jump off this boat at night yeah the sharks are very active yeah i guess uh the prefrontal cortex of the brain andrew is not developed until the mid 20s so when people do social media that are below their mid 20s they are just more likely to just do some super erratic essentially to outside people viewed as very stupid behaviors yeah somebody said uh my son was trying to impress a girl at homecoming and he ate a metal dime he didn't tell me and a few days later we had to get emergency surgery to save his life because the metal inside of his body was just causing a lot of problems all right first of all man why are you trying to impress a girl by eating a coin that is i don't even know what like hey really i bet i bet you can't swallow this dime and if you do i'm going to think you're really cute like that word i don't know if she said that i you know i just think sometimes socially deviant behavior from the norms is just viewed as cool but obviously eating a dime that's just i don't make any sense somebody said uh how come the comments on the camera robin story are split into two camps where um some people are just making fun of him and other people feel so sad this is another outcome of social media where rather than just analyzing the situation some people are just pointing and almost like seem glad in their comments and other people are sad right i mean i think a lot of people on the in on the internet want to see stupid people suffer and people are like yeah he did something stupid i don't care that he's dead you know and i think that's too harsh i think that that i don't think that that person leaving that comment obviously has like a lot of maybe like happiness in their life but i don't think like yeah i'm not gonna mourn this kid because i don't know him and he would it was something silly to do you know but i guess i'm just trying to see what we can all learn from it for sure for sure it's terrible thing i mean at the end of the day somebody said are his friends going to be liable for his death that dared him this kind of goes back to your point about regulation like if you encourage somebody to do something stupid and they end up dying as a result of it do you bear any responsibility for it legally or in the criminal court system i think this case is a little different than like being pushed and forced to over drink alcohol you know what i mean by like outside forces like there was there was there's been a fraternity right that got everybody got charged for um partial murder because one of the rush people rushing overdose on alcohol and then like they didn't take them to the hospital soon enough right so in that case i think that there's a lot more responsibility to go around i think it's tough with this because unless he got pushed off and like these guys like picked him up and was like as a joke threw him off the boat those guys would probably get charged for it but i don't know what's gonna happen legally but i definitely think this brings up some questions especially as we move into this such a clout driven era and sometimes the pursuit of this cloud or this attention it goes down you saying they should somebody gotta be responsible should the friends be penalized should everybody on that boat be penalized somehow like should they get some type of mark on their record for being part of this even though they are not responsible for it i mean it's highly unlikely within the current system i'm just asking the questions moving on andre to the story from china san qian ge or brother 3000 he was a known live streamer andre i think he lost some sort of challenge to other live streamers he drank on camera three gigantic bowls of bio you know bio anywhere from really what 50 to 60 percent it's super strong bio is is a it's a no joke alcohol i mean that stuff it just feels like it burns right so of course i'm not saying that he shouldn't be drinking that much alcohol either but anyways but if there was beer he might not have passed away yeah and i think it's crazy because there's a video of it because he was live streaming himself obviously doing the punishment from losing the challenge other people were bringing up this referenced a case in 2007 andrew where this woman named jennifer strange was trying to win a wee console from an american radio station and died from water intoxication because she kept drinking gallons and gallons of water so this has even happened in america somebody said um in the chinese social media basically this guy had failed at a lot of different businesses and being an influencer was the only thing he was financially successful at and good enough at where he could support his father and uh mother right so i guess what what what do you say to this because that's why he basically because people were like why is this guy so committed to doing this and it's like because this is he found like he felt like he found his calling right right right and i think the tough thing is is like when you are a no talented like you have zero talent and you find out that you can garner attention then you just end up doing something that ultimately can hurt you but it's almost like you don't want to stop people from making a living right and supporting their family if that is how they're supporting their family so i don't know it's like a catch 22 i don't know what you do in this situation right yeah i mean it's really interesting i mean this is like another like mechanical thing but in china andrew they're saying the problems are arising a lot more from live streaming whereas in america you know live streaming is not as popular and it's almost more like clout videos that get spread around and going viral exactly um another there was another case in shaman andrew people were making fun of each other on live stream and that somebody attacked somebody with a sword wore the machete and they got their hand cut off and this is teenager on teenager yeah and i i would think that is surprising to hear in china because you don't imagine chinese people to be that like aggressive but i guess there are so many chinese people and chinese people are just like any other human right they want attention it's human nature to be doing things for money and attention and it just goes too far sometimes shamans and fujian too they get busy out there yeah um somebody said it goes to show you that chinese social media is just as toxic and bad as american social media for some reason we add everybody believing in america that they were just watching science videos all day yeah no and here's the thing listen china is such a big country you have to understand china has like 3.5 times the amount of people in china than in america so yes you are going to hear crazy stories but it's almost like i guess nobody ever everyone in the world is clout chasing it doesn't matter the country or the situation or the culture you're from it's human nature because clout is attention and everybody wanted attention they are clout chasing in some way and people are just taking it too far but this is an issue that plays into human nature all across the so andrew let's get into our takeaways is it the human nature that's messed up that wants the clout and the attention or is it the tools that enable it or is it both because you can only regulate one you can't really regulate the human innate desire for attention exactly recognition you regulate the tool that enables that human nature to manifest itself in the worst way possible right allows them to release the endorphins to get the dopamine and the oxytocin i mean you have cars cars are dangerous for a number of reasons and that's why you have to get a license for cars obviously a lot of people are arguing that you need just as much training and licenses to own a gun because guns can kill a lot of people right if you just decide to one day right you just decide to kill five people you can do it right with a gun so i guess like the truth is i don't know social media doesn't right look like a weapon it doesn't look like a dangerous tool but clearly it can be used to for destruction in certain ways but and i do think it i don't know if it encourages a behavior that's not there but it can certainly exaggerate a pre-existing desire yeah so pre-existing desires that like want to get dopamine this way whether it's degenerate or not degenerate social media allows you to like really lean into that or is it just on the parents and being raised properly it it's on the parents and the teachers to teach these kids how to deal with social media just also that what parents got to teach their kids about guns right and how to handle a gun and then parents got to teach their kids how to drive right i think the most difficult thing and this is my actually honest answer that i just don't think will happen is i think you really have to separate your kids from social media for quite a few years when they're uh in their upbringing and raise them amongst real world and then introduce them later like you cannot raise somebody on social media that deep that early well the question is let's say parents are getting lazy and they're not trying to teach their kids things they're putting them on social media but social media is unregulated and then the kid has access to all these other things somewhere along that process there is not enough regulation if not by the parents then by you know the authorities yeah but anyway two tragic incidents are a beta everybody involved and um it's not meant to like you know make fun of anybody's death it's terrible but it's just like what can we learn moving forward to prevent this in the future all right everybody until next time please leave your comment down below we are the hot pot boys we out peace


Again, thanks for being part of this large-scale experiment. I hope you're having as much fun as we do in the background. So let me introduce you to the next speakers. It's a duo from Cisco Talos, Vitor Ventura and Paul Raskanier. Vitor Ventura is a Cisco Talos security researcher. As a researcher, he investigated and published various articles on emerging threats. Most of the days, Vitor is hunting for threats, investigating them, reversing code, but also looking for the geopolitical end or economic context that better suits them. Vitor has been a speaker in conferences like Rickon Brucell, Defconn Crypto Village, and besides Lisbon, among others. Prior to that, he has been the IBM X-Force Iris European Manager, where he was a lead responder on several high-profile organizations affected by the WannaCry and Nuttpedia infections, helping to determine the extent of the damage and to define the recovery path. Before that, he did a penetration testing at IBM X-Force Red, where Vitor led flagship projects like connected car assessments and oil and gas ICS security assessments, custom mobile devices, among other IoT security projects. Vitor holds multiple security-related certifications like GREM, CISM, among others. Paul is a security, well, no, to Paul. Paul is a security researcher within Talos, Cisco's threat intelligence and research organization. As a researcher, he performs investigations to identify new threats and present his finding as publications and at international security conferences throughout the world. He has been involved in security research for seven years, mainly focusing on malware analysis, malware hunting, and more especially on advanced persistent threat campaigns and root kit capabilities. He previously worked for several incident response team within the private and public sector. He is also familiar with the Nordsek organization, multiple time speaker, if I remember correct. So let me introduce them for their talk, high speed figure printing, cloning, myth or reality. Hi, I hope it works for you. Yeah, just waiting for the slide. Yeah, perfect. So yeah, I think this introduction was just perfect and covered more or less everything. And yeah, I'm really happy to be here for the first online edition of Nordsek. So my name is Paul Raskania. I was a speaker for a couple of time at this conference. I'm very happy to be here. And yeah, I'm mainly interested in malware analysis and APT research. So I work on cases such as Olympic destroyer, wanna cry or whatever. And I'm really into 3D printing. You may be so few of migration on my Twitter or whatever. And you will see it's really relevant for this talk where we will speak a lot about 3D printing. Hi, I'm Victor. I like, I like professing engineering. I like malware. I'm located in Portugal. And yeah, let's dive into our talk today. It's my first time on this conference, by the way. So a little bit about what are we going to talk about? So first we will start with the background. We'll talk about the state of the art of fingerprint authentication, then the different sensor types, and then we'll do a deep dive into our research. We'll define the threat models, our process, and we'll end up with the test and the wrap up. So talking a little bit about the state of the art. So fingerprint authentication, it really starts to be massively used when Apple introduced it on Touch ID back in 2013. And on that same year, it was already broken by the CCC conference. Throughout the years, it was adopted more and more in several devices, laptops, mobile devices, every kind of device. And our goal when we decided to do this kind of research was to see if this has evolved. So with the time and with the adoption has security evolved on this kind of devices. So just while we were doing our research, Samsung S10, the fingerprint authentication was defeated by a simple silicon cover. And at the time we thought, oh, maybe our research is completely destroyed. And then there was on another conference, a team from XLAB that also did the same thing on three different devices almost on the fly. But they didn't reveal any of their process. They didn't reveal any of the details. And at that time we thought, okay, then we should really do this research and do as we think like releasing all the details of our process. But at the same time, we wanted to make it as real as possible. That's why we defined the threat models. But we'll go into that further ahead. So just before that, let's talk about the different sensors. There are three major kinds of sensors right now. There's the capacitive ones, which pretty much create a capacitor between our fingers and the sensor through the usage of the electricity in our bodies. So when you have a ridge, that will create the capacitor, which will be detected. And when we have a valley, that won't be detected. So there are a second type of capacitive sensor, which is the active one. In this case, the principle is the same, but instead of using the natural electricity in the bodies, it will send a signal from the sensor through our skin and then back into the sensor. So it's an active one because there's a signal being generated by the sensor itself. Then we have the optical ones. These actually were one of the first kind of sensors to be developed. In this case, as you can imagine, there's a light source that is projected into our finger. And then there's an image sensor that will read the image from our finger. And likewise, the ultrasonic ones, they have the same principle. There's an emission. In this case, it's an ultrasonic pulse, which will then be detected by the sensor. Both of these sensors are actually... The need for these sensors actually was increased when the full screen mobile devices came up because these two kinds of sensors, they can actually be put below the screen, the display. So you can have a borderless phone with it. That does not happen with the capacitive sensors unless you put the sensor on the back of the phone. So this is kind of the main reason why these two kinds of sensors were developed. Well, the ultrasonic one was developed and the optical one was brought back into the market. So now talking a little bit about our process. As I was saying, we wanted to have a real-life model of the research. So for that, we decided to define three different scenarios, thread scenarios. And to those scenarios, we have linked the collection methods. So the first collection method is the direct collection method. In this case, well, the finger is just put on a mold and which is then used. And you can imagine like someone that is unconscious and someone just picks its finger and then put it on a mold. The second thread scenario is the fingerprint sensor where the person just put the fingers on the sensor and the fingerprint is collected. And this you can just relate with all the biometric leaks that has happened in the past with some companies where huge number of fingerprints were leaked and no one really knows where they went. And the third method is a third-party collection method where basically you have an object and you lift the fingerprint from that object. In this case, it would be more like a spy movie thing but it's still a thread scenario. And it is important to have it here in order to establish a relationship between all the different thread scenarios. So our process is not just about the collection. Then we have two additional steps. One is the optimization. So once you collect the fingerprint, you actually need to optimize it and you need to work it so that you can actually then do the creation. And the creation is done through the creation of a mold which is then filled with the materials that will actually create the fingerprint. And for that, I will leave you, I will pass you now to Paul and that will explain all these details. Yeah. So let's speak about the collection and how we get data to work on. So our first case was direct collection. So we get the fingerprint directly from the finger. In this case, we decided to use plasticine which is a fake clay used by a sculptor and that reacts to heat. So basically on the right, you have a heat gun. You put it on the plasticine, it becomes soft and you can take the fingerprint directly on it and create a mold. It was the easiest way, no size issue we directly had from the finger and it was really straightforward and easy to do. The second approach is a connection from a sensor. So you can see here the sensor we use. So it's basically the cheapest sensor you can buy on the internet. It's connected in USB, it uses serial protocol to get data and it's very easy to use. On the right, you have the really bad application provided by the sensor and you can see a fingerprint captured with this sensor. As you can see, the resolution of the picture is really bad, it's really, really bad but I was surprised it was good enough.  The third approach we use to get data is third party connection. So like a movie if you wish. On the left, you have a picture of a fingerprint on the glass and on the right, you have the same one but I put some black powder to increase the contrast. I think on Twitch, maybe the resolution is not good enough but you can see picture on our blog we will give you the URL later. Here it's not my fingerprint. I don't want to leak my fingerprint on the internet so I use the palm of my hand for this specific picture and all the fingerprint you can see and you will see during the presentation are the fingerprint from Al Capone directly from the FBI website and not my or Vito fingerprint because yeah, who knows. So once we have all this data, data from the sensor, data from the camera, we need to optimize the picture. So as I mentioned, the resolution of the sensor is not really good. So I had to take a couple of different images, put them together and create a big one.  So I need to create a small square and put it together, increase contrast and make some Photoshop to have this kind of image you can see here from Al Capone. Another optimization I had to do, if we, I'm waiting for the next side. Yeah, if we take the third party collection is I need to crop the picture and I need to play a lot with Photoshop to increase contrast and have a clear line and clear black, white and gray picture. So it's simply a question of time and manipulating photo software. Here is an example. So on the left, you have Al Capone fingerprint, black, white and on the right, you have a 3D model of a mold of this fingerprint. So it's a negative cause it's a mold, it's how it works. And in this case, you can see it's pretty similar and how it works. In fact, you have black line and on 3D printing, we can use that as an alpha and the black is push the key, virtual key, digital key and the white doesn't do anything. And after you have the different level of grays that push more or less the fake, the digital clay. So you will see a video about how it works exactly. So creation, yeah, yeah, for the creation, here you can see the size of a mold. So the mold you can see on the bottom is a fake fingerprint of Al Capone and the other one is my fingerprint. So that's why they put in the other direction. And I use a standard 3D printer, something you can buy. Our budget was 2,000 Euro. So not a huge budget. We cannot buy a really crazy expensive printer, but yeah, that was an example of molds and you can see it's pretty small, yeah. So here is a video about how it works. So the software is named ZBrush. It's the standard in the industry and you have the alpha. So the black and white picture, it's on the left. You will see it in a few seconds become bigger, yeah. And I will use this alpha directly on the model and the alpha will push the virtual clay inside and the fingerprint will appear on it. And it's basically how it works. If Twitch resolution is bad, you can check on our blog, you can see it. It's really, really easy. So that's how I create a fingerprint mold. So let's speak about the printer. The printer I use is a 25 microns resolution printer. It's not super expensive. It's less than 2,000 euros. And if you think about dermal fingerprint ridges, it's about 500 microns wide and 20, 50 microns deep. So the resolution of a standard resin printer is pretty good, it's good enough. The other problem is the material use for casting because once you have a mold, it's nice, it's beautiful, but you can do anything with a mold alone. You need to cast something and create the fingerprint. We will see we got a couple of issues with that. And another big constraint is fully printing is not designed for micron. You know, it's designed to create a small object but not like micron object. If we speak about a figurine, it's 10 centimeters, it's not so small. And Zbrush doesn't have a real world size parameters. So you create something, it doesn't really have size, in fact. And in our case, we are speaking about microns. If the mold is few microns too big or too small, it doesn't work. The sensor will not recognize your finger because it's too big or too small. And something we discovered is the resin need to be cured. It's toxic when it got from the printer. It need to be cured in a UV chamber. And we discovered that the UV chamber generate retraction. So not big retraction for a figurine, you don't care. But big enough to create molds too small or too big for our context speaking about fingerprint. So we had to spend a lot of time dealing with this kind of issue because yeah, we had to be really careful about how many second we do curing, we always do the same curing, the same number of mold inside of the chamber, et cetera, et cetera. It was really, really time consuming to be really consistent and have always the same process and the same size, et cetera. Some picture on the left, you have seven molds directly from the printer. It's a small one, as you can see, but I can make seven molds in some time. On the right, it's simply the molds are taken from the bed. And here you can see on the right, you have normally, if it comes, yes, yeah. On the right, you have the UV chamber. So the circle in white turn and you have UV lamp and UV lamp have project on the mirror and it how resin is cured. And on the left, you have all my fail attempt. So all the mold you can see are too big, too small. I make some annotation on it to say, yeah, it's too small or it's too big or I was tired and I didn't do a negative but a positive of my fingerprints, this kind of stuff. So I had to create more than 50 bad molds to have the final one, which is good, perfect size and it works. So it's really time consuming when you know how many hours you need to print something. So, but yeah, when I want something, I spend time on it. So yeah, let's speak about the filling material. So when you have the mold, you need to fill material inside to create the object. Is that how it works? We use silicone, we use glue, et cetera. As Victor mentioned, some sensors are conductive. So you need to have conductive stuff to enable the sensor and start the authentication. Silicone is not conductive. So if you do a fingerprint in silicone, it won't do anything on this kind of device. I, we said, yeah, maybe we can mix silicone with graphite or aluminum, any kind of conductive powder and it will works. So no, it doesn't work. It doesn't work like that. And we had to find a really, really good materials that allow to have the same conductivity than our skin, our body. And finally we find a hack is to use textile glue. So it was pure luck because I found this stuff on my children home and I said, why not? Let's try it, we will see what happened. And if you create a really thin layer of, inside of the mold of fabric glue and it's thin enough to put a real finger behind, you will have the conductivity of your real finger. So it works if it's thin enough and you have a real finger behind. So it cost us a lot of attempt to find it and it was purely by luck, but we can be lucky in life. And yeah, no, let's speak about the tests we did, the device we tested, et cetera. So I let Vito speak about this part of the presentation. Okay, so we wanted to make sure that we would test the different kinds of sensors and the different kinds of devices. And finally, the different kinds of operating systems behind those devices because the way that fingerprint authentication works, it will do the comparison between the fingerprint and the template on different places of the stack. Let's say like that. So let's see a movie about our tests. So as you can see, Paul has a glove on this and it works because in this case we are using the Samsung S10 and the sensor is an ultrasonic sensor. So there's no need for connectivity. On the other devices, it's more, they are using active capacitive sensors. They need this. They actually need the real finger behind the fake fingerprint in order to have the conductivity. Yes. I want you to look at this device, for instance, as the padlock and you should notice that there is a gray ring around it. There was the same thing around the iPhone and this is actually the place where the signal comes into our finger to go back into the sensor. As I mentioned before when I was talking about the sensors. So in the end, our results show that the direct collection method actually has the best results and that really makes sense because we are taking the finger directly into the mold and on one side, the mold is more perfect but also we don't have the problems with the retraction and everything that Paul was talking about because there's no retraction. We have the mold directly to be casted upon. The other thing that you should notice is that pretty much every sensor that was defeated with the direct fingerprint collection was also defeated by the other methods with more or less success rate. If you notice, we were never able to defeat the windows, the laptops based on windows and even on different brands. And we'll have more or less an explanation for that ahead and the same thing happened with both thumb drives. I also want to mention a special case about the Samsung A70 which we never broke but at the same time, it doesn't really work very well when you are using the real finger. So our guess is that, well, it's not something that should be considered as a good example of being good at using the fingerprint because in reality, it doesn't work that well even on normal cases. So, and now the wrap up. So we wanted, when we decided to do this project, we wanted to put some parameters on it so that we were sure that this would lead to something which can be related to real life. We don't want to make something that we are using a huge amount of money and then we can prove that someone can do it but then it doesn't relate to real life, it doesn't relate to the threat profile of each person. So that's why we decided to have, okay, let's have a budget which is under $2,000. Also the limitation for the right collection, we didn't want to have any kind of limitation there because there are different ways to do it and we wanted to have some method which would almost be used like a baseline to all the others. On the limitation side, okay, we know we have talked about it. There's a problem with the scale, with the resolution and we know that there have been some advances on this. Paul will talk about it later when we talk about the future work and of course there's the problem with the resin that can be retracted with the UV while doing the curation process. So now about windows and why did we had more difficulties? Well, in the end, this is a question of having, it's security versus commodity. So we unlock our phones several times a day and if we go and we compare all the points, we'll have more false positives, false negatives, sorry. So we'll have more times where we put our finger and the reading is not correct. At the same time, on the laptop, that doesn't really happen that often. So our guess is that windows is comparing more points of our fingers as with the mobile phones in order to have a better security but at the same time doesn't have such a big impact on usability as if that was happened on the phones. So it's a question of how many points in the simple terms, it's a question of how many points are you comparing on the finger and how much are you concerned about usability and user experience? And for the mitigations, I will pass you to Paul now. Yeah, so let's speak about mitigation. There is a few steps that vendors can do about mitigation. If we look at the number of attempts, if you take Apple devices, you can only test your fingerprint five times. If it's five times, you need to enter the pin, no choice. If you check Samsung devices, for example, it's 50 attempts. So you can try 50 times and it won't ask you to pin until this 50 false attempt. You simply need to wait a few seconds between five attempts, but it's 30 seconds, I think, and you have five attempts, 30 seconds, five attempts. So you can do it, it's okay. And if you take Honor device, I tried more than 70 times and it doesn't ask me for the pin. So it's probably unlimited, or it's 100 or whatever. I didn't spend my day trying to unlock the device. And yeah, that's something that I think could be improved by making less attempts like Apple did, or maybe to put this stuff under the control of the users. Maybe you can decide it on parameters. I want five, 10, or whatever attempts before switching to the pin. It could be an approach. Something else vendor can do is to jump, if we jump on Vito explanation on Windows system, maybe we can propose to the users to configure a number of points to be controlled and say, okay, I want a very strict device. I want to control a lot of points. And if it fail, I accept it, I will enter my pin. And we can have some other users with other profiles that decide, okay, I don't really want to use my pin and I want to be really soft on the number of points I want to unlock my phone. So it can be some mitigation and improvement that could be done by vendor. Yeah, if we look at the conclusion, we think that fingerprint authentication is good enough for the majority of people. It's a question of threat model. If you are really worried and you are someone with, I don't know, a journalist or this kind of sensitive profile, maybe, and if you are afraid about secret agency or government or whatever, maybe it's not good enough. Maybe it's not, maybe they should have the capacity to clone a fingerprint without using a massive budget. If you are worried about someone that steal your phone at the bar, yeah, it's good enough. Don't worry. For one fingerprint, for my finger spending time on it, it cost me most to do that. And yeah, I think you really need to define your threat model and what you want to be protected from. So that's really, really most important part of the conclusion. The process take time. It was really time consuming. It spent me months of research trying to do molds and dealing with size, et cetera, et cetera. So I'm pretty convenient that someone without any experience cannot do it really, really easily. Something that's really interesting for me at least is fingerprint technology has not really involved with time. And something that is really uncommon in our industry is it even roll back. If we take optical sensor, it was the first technology, it changed to a capacitive sensor because you must have a real finger behind, it must be conductive, et cetera. And due to user experience, we roll back and came back to optical sensor because we don't want any frame on the device. We want to have a unique screen and have our fingerprint reader on it. And it generates a rollback to a previous technology because we cannot have capacitive sensor directly included in the screen with our current level of technology. So yeah, just one thing, some people ask us, yeah, but why you didn't create directly the fingerprint with a printer? So it doesn't work, doesn't work like that. It's too small to think, it's not conductive. It will break during the curing process and it's not a good way to do it. We really need to think about doing a mold and cast something to create the fingerprint. We don't have a magic approach. As you saw, it works on a couple of device but we have some device, it doesn't work really well and some other device, it didn't work at all. So it's not an ultimate approach but I think we have pretty interesting results. Yeah, of course from the bad guys point of view, you can make some improvement to our process. Maybe if we have a bigger budget, we can have access to electronic microscopes that support micron. Maybe if we can use a high precision latch there engraver system, we can improve the whole process and engrave directly the fingerprint. Maybe we can have access to medical printer. So you can have a 3D printer dedicated to medical domain that create object in micron. So they can create fake skin. So maybe the fake skin is conductive enough. I don't know, I don't have access to this kind of device but I think it could be improved by doing that. I mentioned some size issue with the mold. Yeah, maybe we can make some scripting to optimize the creation and provide a high resolution image and said it's this size and this size and maybe generate the 3D model automatically and not as I did on the ZBrush. So I think there was a couple of improvement but it will increase a lot the cost of doing fake fingerprint. We think if you have a very motivated team and well funded, they can do it more efficiently than what we did. You can find our world research on our blog post. At this URL, you can ping me on Twitter. You can ping Vito on Twitter. We will be happy to reply to you if you are shy and don't want to ask on the platform. And yeah, have fun and take care of your finger. All right, thanks so much, Paul and Vito. That was really scary. Yeah, it's concerning but it's also very interesting. So we'll give one or two minutes for participants who have questions. So in the meantime, maybe I can point out that we just released 50 tickets for the conference of 2021 as early bird. It's special just for today. Well, it's actually until it's sold out. So the tickets are just for the conference since we are on the conference part, but maybe we don't know there's a CTF coming in the next few days. So stay tuned and register. It's a good way to show us that you appreciate the work we're doing. Okay, I guess we're kind of running out of time for the questions you can still ask or about questions while the presenters are answering. So I'll start with the first question. So some safes claim to have heartbeat detection on the fingers. Did you encounter any? Did your sleeve technique bypass it? Yeah, so we didn't try. So we basically mentioned all the device we tried. So if it's not on the list, we didn't try it. But it's only speculation, but I think if you use the technique of the thin glue layer and with a real finger behind, as it's conductive, I'm pretty sure you have the heartbeat also. So I didn't try, but I won't be surprised if it works on the same way as a conductive. If you have a real finger and it's thin enough, it should work, but we didn't try it. Really interesting, really interesting. And I guess now that we know how these things work, people can try it. Yeah, if they have time, yes. Vita, did you want to add something? No, I was just going to say that none of the devices that we tried said that they did that on the sensors. So even if they do it, it's not documented as a feature. Makes sense. So let's go with the second question. Can this be used in unsighted physical security assessment? So I guess speaking about the speed to which you can implement it. The speed is really long. So if you want to do it with direct collection, so if you take fingerprint of someone directly on Plastiline or whatever, you can do it really quickly. It's in one hour you have a copy. If you want to do it from picture or biometric data like picture from a sensor, it's super long. It costs me more than three months to have a correct mold by using picture. So yeah, it's a question of time and a resource. If you have a lot of time and a lot of resource, why not? If it's something to do quickly in one week, it doesn't work like that. And I guess the tech is just beginning. So maybe in two years. Oh, yeah, maybe definitely you, maybe some people will improve it. And for the printer, the price decrease, the quality increase, and maybe we will be able to have crazy device in two or three years for a few thousand euros. I don't know. Perfect. So next question, did you consider using something like gelatin or connectivity? No, we didn't. But the point is it must be super thin because the gelatin in this case must enter in the line of the mold, the ridge of the fingerprint. And I'm not sure it will work, but we didn't try. Okay. Another open research direction. And the last question for today, can fingerprint data be imported from one sensor vendor to another or is it proprietary? So there is a format defined to transfer fingerprint information, but the point here is not from one vendor to the other because the comparison is usually done on the OS side because they need to store the templates. So, and if they follow that format, then of course they can pass it from one device to the other, but usually the vendors themselves they don't store the information. They actually pass that information to the OS that will do the templates to do the comparison afterwards. All right. Perfect. So another question was added. Did you see the fingerprint cloning displayed in the last season of Mr. Robot? What did you think of it? Yeah. So I can reply to this one because in fact, we started our research before. We made our choice before. So he copied us. Let's be clear. And the way he's doing it on Mr. Robot is not possible technically because they decided to take filament 3D printer because it's more visual for public and they didn't take resin 3D printer.  So yes, it's possible, but not with the printers they decided to took for visual effect and makes stuff cool. All right. Thank you. Maybe it's just out of my curiosity. It's going to be the last question and it's an open-ended question. Considering it's getting easier and easier to copy biometric data and it's not really possible to regenerate your biometric data randomized, what is the solution in the near, like medium to long future using biometric data like that? It's for you, Victor. Oh, thank you very much. You're welcome. Well, in reality, so as we said, there were some deficits we're not able to defeat, right? And that comes back to how you make the comparison. Of course, if you go into the really, really, compare a lot of points, a lot of dots, a lot of direction in the regions, maybe you can improve the security of the fingerprint. But right now, that's not definable by the user. And at the same time, it will create some kind of more false negatives. So I would say that there's a lot of improvements that can be done on fingerprints, iris, face ID, and we will see how that will work out. But all of the technologies can improve on how they make the comparison. Right. All right, thank you. Good answer. So that's all for us for today. Thank you very much, Paul and Victor. And we wish you a great end of day. Yeah, thank you. Stay tuned with us in 10 minutes. We're going to have Itzien Mini talking about defending human rights in the age of targeted attacks. Have a great day.


Hey guys, welcome to OxyVlogs! If this is your first time here and you would like to know more about life in Dubai, don't forget to hit the subscribe button and the notification icon so you will not miss anything. Today many people want to become a freelancer. It's quite popular today, especially among young generation. And if you want to be a freelancer in Dubai, you need to get a freelance permit and you need to have a residence visa. Once you get a freelance permit, you can work as a one-person company and do business under your own name, not a startup company. Another important thing you need to know that you can get a freelance permit only if you work in one of these three sectors, media, education and IT. For example, if you're a photographer, graphic designer, social media manager, web developer and so on. How much does it cost to get a freelance permit? If you have a visa and you need just a permit, it will cost you 7,500 dirhams per year. But if you need to apply for a visa, the whole package will cost you between 10,000 and 20,000 dirhams. It depends whether you need a visa for one year or three years. How can you get your freelance permit? Go to this website, fill out the application form, submit the required documents and once the application form is approved, you need to make a payment and then you will get your permit within 10 to 15 days. But what if you live outside the UE and you are just planning to move to Dubai and you need a visa? So you need to follow the same steps. First of all, you need to get a permit. So you go to the same website, you fill out the application form. Once a permit is approved, you can apply for your visa and I believe the same company can help you to get a visa for you.  But you cannot hire or sponsor any employees under freelance permit. Now, what about taxes? As you know, VAT was introduced in the UE in 2018. So now, if you have business in Dubai, you need to pay taxes. If you make more than 375,000 dirhams per year, you need to register for VAT and the rate of VAT is 5%. So guys, this was an overview of how you can get a freelance visa and freelance permit. As I said, it's quite an easy and quick process. Just go to this website, apply for the permit, follow the steps and these guys will guide you through the whole process. But another important thing I want to highlight. If you've been living in Dubai, you have a residence visa, you have Emirates ID, maybe you have full-time job or you're just housewife and you want to do some freelancing on the site, you want to sell your services, you have an option to apply for an E-Trader license, which costs only 1000 dirhams. Because if you compare freelance license costs 7500 dirhams, E-Trader license costs only 1000 dirhams. But I will talk about this license in my next video. Thank you for watching and I will see you soon. Bye bye.