Subj : Fingerprint authentication is surprisingly easy to bypass - resea
To   : All
From : TechnologyDaily
Date : Thu Nov 23 2023 20:30:05

Fingerprint authentication is surprisingly easy to bypass - researchers find 
critical vulnerabilities in Windows Hello

Date:
Thu, 23 Nov 2023 20:19:54 +0000

Description:
Your fingerprint may be secure, but the Windows device storing it might not 
be...

FULL STORY
======================================================================

The fingerprint-enabled security systems on many top business laptops around 
today may not be as ironclad as first thought, new research has claimed. 

The Microsoft Offensive Research and Security Engineering (MORSE) recently 
handed over a set research targets to Blackwing Intelligence , tasking it to 
crack their security. 

The research targets were three Windows laptops with the top three 
fingerprint sensors on the market, used to identify and grant access to users 
through Windows Hello. Not only did the firm manage to crack all three 
laptops, they did so in some surprising and intuitive ways. Windows Hello 
flaws 

Blackwing Intelligence was given three laptops; a Dell Inspiron 15; a Lenovo 
ThinkPad T14; and a Microsoft Surface Pro Type Cover with Fingerprint ID. 

In the three months Blackwing had, the firm managed to crack all three 
laptops using a variety of increasingly inventive methods, before reporting 
the vulnerabilities back to MORSE. 

The Inspiron 15 was identified as the particularly vulnerable target due to a 
number of factors including poor coding quality, clear text communication, 
and good USB and Linux support. 

By using a Raspberry Pi 4 (RP4) as a man-in-the-middle (MitM) device, they 
found they were able to disconnect the fingerprint sensor and then use the 
RP4 to enumerate fingerprints in the Windows database, enrol their own 
fingerprints into a Linux database (listing them as a valid Windows user in 
the process), and then divert the fingerprint sensor to the Linux database 
which then pulled the authenticated fingerprint and granted access. 

In its blog, BlackWing concluded that, "Biometric authentication can be super 
useful to allow users to conveniently log in. 

"Microsoft did a good job designing Secure Device Connection Protocol (SDCP) 
to provide a secure channel between the host and biometric devices, but 
unfortunately device manufacturers seem to misunderstand some of the 
objectives," it noted. 

"Additionally, SDCP only covers a very narrow scope of a typical devices 
operation, while most devices have a sizable attack surface exposed that is 
not covered by SDCP at all. 

"Finally, we found that SDCP wasnt even enabled on two out of three of the 
devices we targeted." More from TechRadar Pro We've rounded up some of the 
best identity theft protection tools around Here is a list of the best 
endpoint protection software Everyone's most hated Windows software might 
actually be better to use now 




======================================================================
Link to news story:
https://www.techradar.com/pro/fingerprint-authentication-is-surprisingly-easy-
to-bypass-researchers-find-critical-vulnerabilities-in-windows-hello


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.