Researchers used 2D photos to reconstruct fingerprints, successfully unlock Samsung Galaxy S6 for police
Kashmir Hill / Fusion :
Context & Ripple Effects
This is the second documented route by which researchers have opened a Samsung Galaxy S6 for investigators: in March, [[a:866162|Michigan State researchers unlocked the same phone and a Huawei Honor 7 using inkjet-printed copies]] of enrolled fingerprints. The new twist is that no physical print is needed as source material — ordinary 2D photographs suffice to reconstruct working fingerprints.
It also extends a pattern Fusion itself has been tracking on the law-enforcement side: police previously turned to a 3D printing lab to recreate a dead man's fingers to get past his lock screen (the 3D-printed-fingers case). Together these show biometric spoofing moving from academic proof-of-concept to an actual tool in criminal investigations.
First-order effects
- Police investigating a locked Galaxy S6-class device now have a demonstrated method to bypass its fingerprint lock without the owner's cooperation or passcode, sidestepping the legal fights over compelled unlocking.
- Samsung's fingerprint sensor design of that era is shown to lack effective liveness detection against photographic reconstruction, a direct credibility hit to the 'fingerprint = secure' pitch.
Second-order effects
- Rival biometric methods come under the same scrutiny: Samsung had already seen [[a:919210|the Chaos Computer Club defeat the Galaxy S8's iris scanner with a photograph of a victim's eye]], so each modality is being tested and broken in public sequence.
- Vendors face pressure to add liveness and anti-spoofing layers to sensors, since the attack requires only photos and printing equipment rather than exotic hardware.
Third-order effects
- If both criminals and police can reconstruct biometrics from images, the deeper problem emerges: unlike a password, a fingerprint cannot be reissued once a photo of it leaks — pushing the industry toward treating biometrics as a convenience layer over something revocable.
- Photographs themselves become dual-use forensic material: just as partial fingerprints visible in a WhatsApp photo helped convict a UK drug dealer, the same images that serve as evidence can also serve as attack input.
The trend: Biometric phone locks are being systematically defeated by photo-based spoofing across vendors and modalities, forcing manufacturers toward liveness detection and making biometric data effectively non-revocable.