First, it was Apple's iPhone 5S. Now, it's Samsung's new Galaxy S5. What do the world's top smartphones have in common?

It's an embarrassing flaw, one that allows anyone using a fake fingerprint of the smartphone's owner to trick the fingerprint lock into opening the phone. It's called "fingerprint spoofing."

Like Us on Facebook

Just create a fake rubber finger and then swipe the finger print off of the fingerprint sensor. Voila! You've got an open iPhone 5S and Galaxy S5.

The vulnerability of the Galaxy smartphone was demonstrated in a dramatic fashion on a video produced by SR Security Research Labs GmbH, a German security research firm based in Berlin, and uploaded on YouTube.

Security Research Labs penetrated the Galaxy S5's fingerprint sensor only four days after the smartphone hit worldwide markets. The same laboratory last September used the same fingerprint spoofing ploy to deceive Apple's iPhone 5S into opening.

The company said it used a photo of a fingerprint taken by a camera phone to create a "fake finger" from a mold. Using the fake finger, the company was able to access Samsung S5's home screen and then send money via a PayPal app, which also requires fingerprint authentication.

Security Research Labs said that Samsung seemed to not have learned from the mistakes of other manufacturers. It added that fingerprint authentication is very vulnerable to unauthorized access, and with PayPal apps and other financial applications employing fingerprint access, hackers are now more encouraged to develop their fingerprint spoofing skills.

Security Research Labs said other devices with touch and swipe sensors are equally vulnerable to fingerprint spoofing. The firm also showed a video of how it successfully unlocked a laptop, a Fujitsu smartphone, and an iPhone 5S using the fingerprint photo it took with an iPhone 4S.

SR Security Research Labs concludes that fingerprints are not fit for secure device locking. It noted that using fingerprints for local user authentication has two shortcomings when compared to passwords: once a fingerprint is stolen, there is no way to change it and users leave copies of their fingerprints everywhere.

"Fingerprints are not fit for secure local user authentication as long as spoofs ("fake fingers") can be produced from these pervasive copies," said the lab.