Fingerprint authentication has been widely adopted on smartphones to complement traditional password authentication, making it a tempting target for attackers. The smartphone industry is fully aware of existing threats, and especially for the presentation attack studied by most prior works, the threats are nearly eliminated by liveness detection and attempt limit. In this paper, we study the seemingly impossible fingerprint brute-force attack on off-the-shelf smartphones and propose a generic attack framework. We implement BrutePrint to automate the attack, that acts as a middleman to bypass attempt limit and hijack fingerprint images. Specifically, the bypassing exploits two zero-day vulnerabilities in smartphone fingerprint authentication (SFA) framework, and the hijacking leverages the simplicity of SPI protocol. Moreover, we consider a practical cross-device attack scenario and tackle the liveness and matching problems with neural style transfer (NST). We also propose a method based on neural style transfer to generate valid brute-forcing inputs from arbitrary fingerprint images. A case study shows that we always bypasses liveness detection and attempt limit while 71% spoofs are accepted. We evaluate BrutePrint on 10 representative smartphones from top-5 vendors and 3 typical types of applications involving screen lock, payment, and privacy. As all of them are vulnerable to some extent, fingerprint brute-force attack is validated on on all devices except iPhone, where the shortest time to unlock the smartphone without prior knowledge about the victim is estimated at 40 minutes. Furthermore, we suggest software and hardware mitigation measures.

翻译：指纹认证已广泛应用于智能手机，以补充传统的密码认证，使其成为攻击者眼中诱人的目标。智能手机行业充分认识到现有威胁，尤其是先前研究主要关注的表现攻击，此类威胁已通过活体检测和尝试次数限制得到近乎消除。本文研究了针对现有智能手机看似不可能的指纹暴力破解攻击，并提出了一种通用攻击框架。我们实现了BrutePrint以自动化攻击过程，它作为中间人绕过尝试次数限制并劫持指纹图像。具体而言，绕过利用了智能手机指纹认证（SFA）框架中的两个零日漏洞，而劫持则利用了SPI协议的简单性。此外，我们考虑了一种实用的跨设备攻击场景，并利用神经风格迁移（NST）解决活体检测和匹配问题。我们还提出了一种基于神经风格迁移的方法，从任意指纹图像生成有效的暴力破解输入。案例研究表明，我们始终能绕过活体检测和尝试次数限制，同时71%的欺骗被接受。我们在来自前五大厂商的10款代表性智能手机以及涉及屏幕锁定、支付和隐私的三种典型应用类型上评估了BrutePrint。由于所有设备均存在不同程度的脆弱性，指纹暴力破解攻击在所有非iPhone设备上得到验证，其中在无先验知识的情况下解锁智能手机的最短时间估计为40分钟。此外，我们提出了软件和硬件方面的缓解措施。