Your Palm Is in My Hand: Palm-Vein Biometric Spoofing via Electromagnetic Side Channel

Abstract

As a biometric modality, palm-vein authentication has seen growing adoption in recent years and is becoming prevalent in wallet-free payments and critical access-control applications. Although palm-vein patterns are widely regarded as nearly impossible to forge or steal, our study reveals that electromagnetic emanations induced during sensor operation can leak information correlated with a user's palm-vein characteristics, enabling attackers to reconstruct palm-vein images and spoof authentication systems. In this paper, we present PVSpy, a novel attack framework that demonstrates the feasibility of this attack. Specifically, PVSpy passively captures electromagnetic emanations radiated from palm-vein sensors, extracts features that map the captured signals to palm-vein images, and exploits diffusion models for biometric reconstructions to spoof palm-vein authentication devices. We extensively evaluate PVSpy on five commercial devices, and the recovered vein patterns exhibit a promising level of similarity. In addition, we conduct 30 end-to-end spoofing attacks against these commercial-off-the-shelf devices with different types of palm-vein sensors, and PVSpy achieves 26.7% (top-1) and 63.3% (top-3) success rates.