PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound

PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound

Speakers: Man Zhou

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=qfVAJ6q4xU4

Overview

Fingerprint authentication has become an indispensable part of modern life, securing everything from smartphones and online payments to national ID systems. However, its pervasive use also introduces significant security challenges, particularly concerning the leakage of biometric data. This talk introduces PrintListener, a groundbreaking side-channel attack that exploits a previously overlooked vulnerability: the subtle sounds generated by fingers swiping across device screens. Unlike traditional fingerprint attacks that require physical contact or visual access, PrintListener operates contactlessly, inferring crucial fingerprint pattern features from ambient audio.

The research highlights a critical shift in the threat landscape. Previous advanced attacks, such as MasterPrint and DeepMasterPrint, generated generic fingerprint sequences capable of dictionary attacks, but their success rates remained low, typically around 1-2% at a 0.01% False Acceptance Rate (FAR). PrintListener dramatically enhances this by inferring a victim's specific fingerprint pattern (e.g., left loop, right loop, whorl) from their unique finger friction sounds. This pattern information allows the generation of highly targeted PatternMasterPrint sequences, which are significantly more potent and can achieve success rates up to 27.9% on partial fingerprints and 9.3% on complete fingerprints within five attempts, even at the highest security FAR setting of 0.01%.

The significance of PrintListener lies in its stealthiness and pervasiveness. It leverages common social communication software with voice and video capabilities, utilizing built-in microphones to capture faint friction sounds without requiring any supplementary hardware or explicit user action. Users frequently swipe their fingers during online gaming, video calls, or scrolling, inadvertently transmitting biometric clues. This work demonstrates that even a seemingly innocuous sound can compromise biometric security, urging a re-evaluation of how we perceive and protect sensitive personal data in an increasingly interconnected world.

Background

▶ Watch: Introduction and motivation: fingerprint security challenges (0:00)

The landscape of fingerprint authentication has seen continuous evolution, with most Automatic Fingerprint Identification Systems (AFIS) relying on Level 1 features (patterns like left loop, right loop, whorl, arch) and Level 2 features (minutiae points like ridge endings and bifurcations). Historically, fingerprint attacks have predominantly involved physical methods, such as creating fake 2D or 3D prints from latent impressions or high-resolution photos. The intuitive defense against such attacks has been to simply keep fingerprints out of sight.

More sophisticated attacks introduced the concept of MasterPrint, a synthesized fingerprint template designed to match a large number of legitimate fingerprints by chance. Roy et al. pioneered this, and Bontrager et al. further developed DeepMasterPrint using Generative Adversarial Networks (GANs). While innovative, these generic MasterPrint approaches suffered from limited success rates, especially at stringent security thresholds. For instance, at a 0.01% FAR, their success rates were around 1.88% and 1.11% respectively, highlighting a need for more targeted attack vectors.

PrintListener's foundational hypothesis, H1, posits that PatternMasterPrints—those tailored to a specific fingerprint pattern type—would have a significantly stronger attack potential than generic MasterPrints. To validate this, the researchers utilized the livedet2011_ItaldataLive dataset, categorizing fingerprints into single-pattern datasets (whorl, left loop, right loop) and a mixed dataset. Statistical analysis confirmed H1: the False Acceptance Rate (FAR) for single-pattern datasets was substantially higher than for mixed datasets. Quantitatively, while 8.00% of fingerprints in the mixed dataset were potential MasterPrints, the proportions rose to 17.65% for whorl, 25.28% for left loop, and 13.73% for right loop in their respective single-pattern datasets, underscoring the power of pattern-specific targeting.

The acoustic principle behind PrintListener hinges on the physics of finger friction sounds. When a finger slides across a screen, it generates "roughness noise" due to the weak coupling between the finger pad and the surface. This involves three factors: friction (elastic deformation amplifies vibrations), dynamics (vibrations propagate through the finger and screen), and acoustics (audible sound radiates to the microphone). The sound pressure level (Lp) is influenced by factors like sliding speed and, critically, the arithmetic mean roughness (Ra) of the sliding surface. Ra, in turn, is directly influenced by the finger's morphological features, which are primarily determined by the fingerprint pattern itself. Different patterns—left loop, right loop, and whorl—exhibit distinct ridge morphologies that affect this roughness.

A preliminary proof-of-concept study involving 9 participants demonstrated the feasibility of this principle. By analyzing Mel frequency cepstral coefficients (MFCCs) and Mel spectrograms of friction sounds captured from a Google Pixel 4, researchers observed distinct clusters corresponding to different fingerprint patterns, even with variations in pressure and speed. When fingers were blurred, these distinctions vanished, confirming that the fingerprint pattern itself, not just contact area, was the determining factor.

This research builds upon a broader body of work in acoustic side-channel attacks, which have previously been used to infer information such as keyboard keystrokes, user movements via ultrasonic beacons, or PINs and unlock patterns. However, PrintListener represents the first instance of extending this acoustic side-channel threat specifically to infer detailed fingerprint biometric information, marking a significant advancement in contactless attack methodologies.

The threat model for PrintListener is defined with clear assumptions. The attacker's primary goal is to deduce extensive fingerprint information and generate targeted PatternMasterPrints by analyzing finger friction sounds. The attacker's capabilities are realistic: they can access the victim's friction sound, for example, by initiating a voice/video call on platforms like Google Meet, Skype, Discord, or Apple FaceTime, or through malware with recording permissions. Crucially, the attacker operates with no adversary proximity or accessibility to the user, meaning they cannot directly observe or collect physical fingerprint impressions. Similarly, they have no access to personal devices. Finally, the attack requires no additional user action; sound collection occurs stealthily during routine online interactions. Once PatternMasterPrints are generated, they can be used to attack public fingerprint authentication systems or sold to malicious parties.

Key Findings

▶ Watch: PrintListener's key advantages: stealthiness and pervasiveness (1:45)

PrintListener makes several significant contributions and uncovers critical vulnerabilities:

• Novel Side-Channel Discovery: It is the first work to demonstrate that users' fingertip-swiping actions on device screens generate unique acoustic signals that can be leveraged to infer fundamental fingerprint pattern information. This opens a new, contactless attack vector against biometric systems.
• Highly Effective PatternMasterPrint Generation: By inferring Level 1 fingerprint patterns (left loop, right loop, whorl), PrintListener can synthesize PatternMasterPrint sequences that are dramatically more effective than generic MasterPrints. This validates the hypothesis that pattern-specific knowledge significantly boosts attack potency.
• Exceptional Attack Success Rates: PrintListener achieves remarkable success rates even at the highest security settings. At a strict FAR of 0.01% (a common threshold for high-security systems), it can successfully attack up to 27.9% of partial fingerprints and 9.3% of complete fingerprints within five attempts. This far surpasses the 1-2% success rates of previous MasterPrint techniques.
• Significant Improvement Over Baselines: Compared to the traditional MasterPrint method, PrintListener demonstrates substantial improvements. For partial fingerprints, it achieves an average 37.0% wASR improvement in one attempt at FAR 0.1%, and at FAR 0.01%, its 27.9% wASR is 1.8 times MasterPrint's success rate. For complete fingerprints, it shows improvements of 93.3%, 79.0%, and 69.2% for left loop, right loop, and whorl patterns respectively at FAR 0.1%, and at FAR 0.01%, its 9.3% wASR is 2.6 times MasterPrint's success rate.
• Robust Fingerprint Pattern Prediction: The system's Fingerprint Pattern Mapping module, utilizing a wide and deep combination model based on a VGGish-like network (wav2pattern) and KNN, achieved an impressive 88.4% classification accuracy for fingerprint patterns. This accuracy was further enhanced by data augmentation and remained robust across various noisy environments and common sampling rates (down to 32 kHz), demonstrating its practical applicability.
• Feasibility in Real-World Scenarios: The research confirms that the attack is feasible through mainstream social communication applications. Most popular audio/video apps maintain sampling rates above 16 kHz (often 32 kHz or 44.1 kHz), which is sufficient for extracting friction sound features. Audio compression in these apps was found not to interfere with the extraction process.

Technical Deep Dive

▶ Watch: PrintListener's strong attack power results (27.9% success) (2:49)

The PrintListener system is meticulously designed to address the challenges of extracting faint friction sounds, handling physiological variations, and efficiently synthesizing potent PatternMasterPrints. Its architecture is divided into three core modules: Data Pre-processing, Fingerprint Pattern Mapping, and PatternMasterPrint Synthesizing.

The Data Pre-processing module is crucial for isolating weak friction sounds from noisy environments. It begins with Background Noise Isolation, employing a finite impulse response (FIR) high-pass filter with a 4 kHz passband to eliminate common low-frequency noise while preserving critical fingerprint information. Following this, Noise Compensation is applied, using a short-time amplitude and phase spectrum method to enhance the signal. The core of this module is the Friction Event Segmentation, a three-step localization algorithm based on frequency spectrograms. First, silent regions are excluded by analyzing audio energy spectral density differences between adjacent time windows. Second, full-frequency energy verification identifies potential friction events by checking for a uniform increase in spectral energy across the 0-22 kHz range, distinct from most interfering sounds, using thresholds for spectral energy density difference (TDif) and variance (Tvar). Finally, a duration verification step (TDur) confirms these segments as genuine friction sounds. To expand the dataset and simulate real-world variations, Data Augmentation techniques like time stretching (by factors of 0.8 and 1.2) and pitch shifting (by 2 semitones) are used, mimicking changes in swiping pressure and speed.

The Fingerprint Pattern Mapping module is responsible for inferring the Level 1 fingerprint pattern from the processed friction sounds. This module utilizes a novel wide and deep combination model. For Interpretable Audio Features Extraction (the "wide" part), a two-stage feature selection strategy is employed. Spectrogram analysis, involving Discrete Fourier Transform (DFT) and Discrete Cosine Transform (DCT) for cepstrum coefficients, generates initial features. Then, the minimum redundancy maximum relevance (mRMR) criterion, combined with mutual information and a Wrapper method, selects nine key features: six frequency-domain features (LSF, Chroma, Spectral Kurtosis, Skewness, Contrast, Centroid) and three cepstral-domain features (MFCC, LPCC, RASTA-PLP). For Deep Representation Features Extraction (the "deep" part), a VGGish-based Convolutional Neural Network (CNN) is leveraged. Friction segments are converted into Mel spectrograms (96 overlapping spectrograms, forming a 96x64x1 matrix). A fine-tuned VGGish-like CNN encoder, pre-trained on AudioSet and consisting of 8 convolutional, 5 pooling, and 2 fully connected layers, processes these spectrograms to output a 1x128 dimensional embedding, capturing multi-level features. The final Weighted Joint Prediction combines the insights from both the wide and deep models. Using an adaptive weighting strategy (score_i = (w_wide prew_ji + w_deep pred_ji)), the module calculates prediction scores for left loop, right loop, and whorl patterns, with the highest score determining the inferred pattern. The system was extensively evaluated using 10-fold cross-validation and compared against multiple classifiers (KNN, Decision Tree, Random Forest, Adaboost), with the VGGish-like+KNN combination yielding the best performance (88.4% accuracy).

The PatternMasterPrint Synthesizing module generates the potent targeted fingerprint sequences. Since AFIS often allows multiple attempts, the goal is to create a sequence of five effective PatternMasterPrints. Initially, Independent PatternMasterPrint Generating selects the top-five fingerprints with the highest average matching scores within a single-pattern dataset. This is refined by Sequential PatternMasterPrint Generating, which iteratively selects the best-matching fingerprint, removes it, and repeats the process to ensure distinctness and reduce overlap. The most advanced method is Synthetic PatternMasterPrint Generating, which uses a random-restart hill-climbing algorithm to optimize the sequential PMPs. This algorithm incorporates a Crucial Region (CR) Area Detection mechanism, focusing the optimization on the central 200x250 pixels of the fingerprint where minutiae collision probability is highest, thereby improving iteration efficiency. The Minutiae Random Restart Hill Climbing (Algorithm 1) starts with a sequential PMP as a seed and incrementally or degressively modifies template details based on matcher output scores, aiming to maximize the Attack Success Rate (ASR). The process quantizes minutiae direction into 16 equidistant intervals (22.5 degrees) and continues for up to 500 iterations or until a target ASR is met.

The extensive evaluation of PrintListener involved multiple datasets. Dataset-1 (45,500 segments from 65 users, 180 fingers on Google Pixel 4 and iPhone 13) was used for model robustness. Dataset-2 (22,500 segments from 90 fingers on Pixel 4 in varied noise) assessed noise impact. Dataset-3 (4,500 segments on Samsung A20s) tested generalization. For fingerprint images, Dataset-4_PatternFinger (complete, 2160 images), Dataset-5_FingerPassDB7 (partial, 8640 images), and Dataset-6_Livedet2011 ItalData (complete, 2000 images) were used, all subdivided by pattern type. Experiments were conducted across various noise environments, using the open-source NBIS fingerprint matcher and evaluating attack capability at FAR settings of 1%, 0.1%, and 0.01%, with weighted attack success rate (wASR) as the primary metric.

Demo / Proof of Concept

▶ Watch: Statistical validation of PatternMasterPrint's higher success rates (3:40)

The efficacy of PrintListener was demonstrated through a multi-faceted approach, starting with a foundational proof-of-concept and culminating in extensive real-world attack simulations.

The initial proof-of-concept study established the core feasibility of inferring fingerprint patterns from friction sounds. This involved 9 participants swiping their fingers across a Google Pixel 4 equipped with a matte screen protector, varying pressure and speed. The researchers then analyzed the generated friction sounds using advanced audio features like Mel frequency cepstral coefficients (MFCCs) and Mel spectrograms. The results, visually represented through clustering, clearly showed that different fingerprint patterns (left loop, right loop, whorl) formed distinct clusters in the feature space, even when accounting for variations in swiping dynamics. Crucially, when fingers were blurred, these distinctive features could no longer be differentiated, providing strong evidence that the unique morphology of the fingerprint pattern itself, rather than just the general contact area, was the determining factor in the acoustic signature. This initial demonstration validated the fundamental principle that friction sounds contain exploitable biometric information.

Building on this, the full PrintListener system served as a large-scale demonstration of the attack's practical capabilities. The Evaluation and Results section showcased the system's ability to first predict fingerprint patterns with high accuracy and then generate potent PatternMasterPrints. The Fingerprint Pattern Prediction module, using its combined wide and deep network (wav2pattern), achieved an 88.4% classification accuracy on a dataset of 45,500 friction sound segments. This module demonstrated robustness against noise, maintaining an 87.5% weighted-average precision (wP) even in moderately noisy corridors, and showed viability with common social app sampling rates down to 32 kHz.

The ultimate demonstration was the PatternMasterPrint Attack itself. Using the NBIS fingerprint matcher and targeting various security levels (FARs of 1%, 0.1%, 0.01%), PrintListener showcased its ability to compromise fingerprint authentication. On partial fingerprints (Dataset-5_FingerPassDB7), PrintListener's synthetic PatternMasterPrints achieved an average 27.9% wASR within five attempts at the highest security FAR of 0.01%. For complete fingerprints (Dataset-6_Livedet2011 ItalData), it achieved an average 9.3% wASR within five attempts at the same stringent FAR. These figures represent a significant practical demonstration of the attack's power, being 1.8 times and 2.6 times more successful than traditional MasterPrint methods for partial and complete fingerprints, respectively. The attack was shown to be particularly effective against partial fingerprints due to their higher information entropy loss. These results collectively serve as a compelling proof-of-concept for PrintListener's ability to turn seemingly innocuous finger swipes into a critical biometric security threat.

Defensive Implications

▶ Watch: Acoustic principle and proof-of-concept study for feasibility (4:15)

The PrintListener attack highlights a significant, previously unaddressed side-channel vulnerability in fingerprint authentication, necessitating a multi-layered defensive strategy involving users, application developers, and biometric system designers.

From a user perspective, the most straightforward countermeasure would be to consciously avoid swiping their fingers on device screens during audio or video calls, especially when sensitive information is being discussed or processed. However, this is often impractical and challenging, particularly in scenarios like online gaming or prolonged scrolling during a video conference, where swiping is an integral part of interaction. Relying solely on user vigilance is unlikely to be an effective long-term solution.

Social communication application developers have a crucial role to play in mitigating this threat. The research shows that most popular audio and video social networking apps maintain sampling rates above 16 kHz (often 32 kHz or 44.1 kHz), which is sufficient for PrintListener to extract friction sound features. A robust defense would involve these applications actively limiting their audio sampling rates to below the threshold required for effective feature extraction. As demonstrated, lower sampling rates significantly reduce the recall in classifying fingerprint patterns. Additionally, apps could implement more sophisticated automatic speech noise reduction algorithms specifically designed to identify and destroy the unique characteristics of friction sounds, rather than just general background noise. Implementing pop-up reminders or visual indicators to caution users about microphone activity during screen swipes could also raise awareness, though this might lead to user fatigue.

For biometric system designers and AFIS implementers, the findings suggest a need to re-evaluate the robustness of their matching algorithms against PatternMasterPrint attacks. While the talk doesn't explicitly detail AFIS-level defenses, the demonstrated success rates indicate that current systems are vulnerable. Future AFIS designs could explore enhancements that make them less susceptible to pattern-specific master prints, perhaps by incorporating more robust anti-spoofing measures or by increasing the entropy required for a successful match when a pattern type is inferred. The greater vulnerability of partial fingerprints also suggests that systems relying heavily on partial prints might need additional scrutiny or different security thresholds.

Finally, the study also points to a limitation regarding screen protectors. While matte films (which were primarily evaluated) are known to prevent fingerprint leakage, the researchers noted that glossy films, initially producing weaker friction sounds, might become more susceptible over time as their surface roughness increases with prolonged use. This suggests that the choice of screen protector could also have implications for acoustic side-channel security, warranting further investigation and potentially informing user accessory choices.

Key Takeaways

• Finger Friction Sounds are a Potent Side-Channel: Seemingly innocuous finger swipes on device screens generate unique acoustic signals that can be exploited to infer Level 1 fingerprint patterns (left loop, right loop, whorl).
• PrintListener Enables Contactless, Targeted Attacks: This novel attack leverages these friction sounds to generate highly effective PatternMasterPrint sequences, enabling powerful dictionary attacks against specific fingerprint patterns without physical contact.
• PatternMasterPrints Dramatically Outperform Generic MasterPrints: By incorporating inferred pattern information, PrintListener's PatternMasterPrints achieve significantly higher attack success rates compared to previous generic MasterPrint and DeepMasterPrint methods.
• High Attack Success Even at Strict Security Levels: PrintListener demonstrates alarming success, achieving up to 27.9% wASR on partial fingerprints and 9.3% wASR on complete fingerprints within five attempts, even at the highest security setting of FAR 0.01%.
• Social Communication Apps are Vulnerable: Mainstream audio and video social networking applications, due to their high audio sampling rates (often 32 kHz or 44.1 kHz), inadvertently facilitate this attack by transmitting the necessary friction sound features.
• Defensive Measures are Crucial: Effective countermeasures include reducing audio sampling rates in social apps, implementing specialized noise reduction for friction sounds, and raising user awareness about microphone activity during screen interaction.

About the Speaker(s)

Man Zhou, the speaker for this presentation, is a researcher who presented this groundbreaking work at the NDSS Symposium. Based on the technical depth and innovative nature of the PrintListener project, their expertise lies in cybersecurity, biometrics, and side-channel attack research.