2y ago

Microsoft’s Windows Hello fingerprint authentication has been bypassed - The Verge

www.theverge.com

Microsoft’s Windows Hello fingerprint authentication has been bypassed

Technology @lemmy.world

misk @sopuli.xyz

2y ago

Microsoft’s Windows Hello fingerprint authentication has been bypassed

www.theverge.com /2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability

18 comments

It’s device manufacturers that are fucking up, not MS.
- Pretty much everybody pushing fingerprints as a sensible thing for accessing a device is fucking up. It is way too easy to obtain a persons fingerprints suitable for device unlocking without them knowing - and that's ignoring that using fingerprints enables device unlocking with a persons finger against their will.
  
  That’s why devices need something like Apple does that disables biometrics with specific button clicks
- It’s device manufacturers that are fucking up, not MS.
  ...
  and Microsoft Surface Pro X all fell victim to fingerprint reader attacks
  So... MS is not MS? Is that the logic we're going for now?
  
  No, as stated in the article, it’s the sensor manufacturers that are not properly implementing the security protocol.
Shocked_pickachu_face.jpg
This is the best summary I could come up with:
Microsoft’s Offensive Research and Security Engineering (MORSE) asked Blackwing Intelligence to evaluate the security of fingerprint sensors, and the researchers provided their findings in a presentation at Microsoft’s BlueHat conference in October.
The team identified popular fingerprint sensors from Goodix, Synaptics, and ELAN as targets for their research, with a newly-published blog post detailing the in-depth process of building a USB device that can perform a man-in-the-middle (MitM) attack.
Blackwing Intelligence researchers reverse engineered both software and hardware, and discovered cryptographic implementation flaws in a custom TLS on the Synaptics sensor.
The complicated process to bypass Windows Hello also involved decoding and reimplementing proprietary protocols.
The researchers found that Microsoft’s SDCP protection wasn’t enabled on two of the three devices they targeted.
Blackwing Intelligence now recommends that OEMs make sure SDCP is enabled and ensure the fingerprint sensor implementation is audited by a qualified expert.
The original article contains 474 words, the summary contains 145 words. Saved 69%. I'm a bot and I'm open source!
This is for your own security!
Because of course it has

18 comments