Vulmon
<!--X-Body-Begin-->
<!--X-User-Header-->
oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->
By Date
By Thread
</form>
<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: Re: fprintd: found storing user fingerprints without encryption
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->
From: Noel Kuntze <noel.kuntze+oss-security@thermi.consulting>
Date: Wed, 8 May 2019 12:24:56 +0200
<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Am 08.05.19 um 12:04 schrieb Seong-Joong Kim:
2019년 5월 8일 (수) 오후 6:29, Noel Kuntze <noel.kuntze+oss-security@thermi.consulting>님이 작성:
Hello List,
Am 08.05.19 um 11:19 schrieb Roman Drahtmueller:
>>> Dear all,
>>>
>>> I would like to report a vulnerability of 'fprintd'.
>>>
>>> 'fprintd' does not encrypt sensitive information before storage.
>>> *CWE-311: Missing Encryption of Sensitive Data*
>
> [...]
>
> This misses the point.
>
> * Encryption shifts the problem to protecting the symmetric key, which
> is the very same problem. => Encryption solves other problems, but not
> this one.
> * If you have sufficient privileges to access the fingerprint data,
> then you no longer need the data.
> * You can't "safeguard" the fingerprint data by applying additional O/S
> controls such as SELinux, AppArmor, etc, you can only add more useful
> privilege transitions and protect against attacks that exploit
> implementation errors. Google "store fingerprint data ios android",
> there are suitable solutions.
>
> Mostly: Your fingerprint is not a secret like a password, it is a username.
>
> Since you can't change the fingerprint (biometrics problem), it is not very useful as a single authentication
factor. Either you live with this, or you combine the fingerprint with a different authentication factor type.
>
> Roman.
Another argument: You leave your fingerprint on everything you touch. The glass you drank from at the bar on
Saturday evening? That has your fingerprints. Your front door? It has those, too.
Fingerprints aren't sensitive information. The only entities attributing any sensitivity to them are the
following: Court systems where fingerprints are allowed as evidence (although it's stupid because you can easily
duplicate fingerprints) and companies/persons using fingerprints for authentication (which for the same reason as
previously mentioned is not a good idea).
And as Roman mentioned already, you can't change your fingerprints easily (Sand paper and acids are your friends,
but that's not comfortable at all and compromises your ability to hold things in your hands. So don't to that.).
If, for some reason, you still want to "securely" (at least with a higher level of security than plain text)
store your fingerprint, you need to use a hardware backed kernel keyring that stores the encryption keys or use a
hardware based security solution for storing the fingerprints in the first case. You likely won't find any such
solution though that isn't broken already in some regard.
Kind regards
Noel
--
Noel Kuntze
IT security consultant
GPG Key ID: 0x0739AD6C
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C
In Microsoft's Windows Hello, fingerprint data is kept locally on user's PC in an encrypted way while Linux does not,
even though they are based on same fingerprint reader hardware.
Windows Hello may use Next Generation Cryptography (called CNG) to protect and store user private data and encryption
keys.
(see https://support.microsoft.com/en-au/help/4468253/windows-hello-and-privacy-microsoft-privacy)
Lenovo's Fingerprint Manager Pro also stores user's fingerprints encrypted in its local environment.
In this regard, a flaw was discovered in Lenovo Fingerprint Manager Pro (see CVE-2017-3762).
(see https://thenextweb.com/security/2018/01/26/lenovo-fingerprint-manager-flaw-windows/)
Moreover, FireEye researchers Tao Wei and Yulong Zhang outlined new ways to attack Android devices to extract user
fingerprints at Black Hat USA 2015 (see Fingerprints On Mobile Devices: Abusing and Leaking?).
(see https://www.zdnet.com/article/hackers-can-remotely-steal-fingerprints-from-android-phones/)
This vulnerability could allow a process to access the stored fingerprint and then it can be reverted to
natural-looking original fingerprint image.
It allows the attacker to impersonate a legitimate authentication/identification by using stolen fingerprints.
Once fingerprint has been leaked, victims are leaked for the rest of life since it lasts for a life.
Moreover, fingerprints are usually associated with every citizen’s identity and immigration record.
It would be a hazard if the attacker can remotely harvest fingerprints in a large scale.
What do you think of it?
(I moved your message down because evidently people bottom post here. Don't top post.)
Hello,
You do realize that every secret that is stored in a way that is readable by software without authentication that is
independent of any software running on the host is in fact readable, right?
It is irrelevant if you encrypt your "secret" storage with a key that is on the disk or is encrypted with a static key
that is embedded in the binary. It's on the same level of security as storing it in plain text regarding attackers that
have access to the host on a software level. What Windows Hello does is only any more secure if the key storage is
backed by, for example, a TPM that needs to be unlocked first using attestation. The whole problem reverts to securing
a host against intrusion via software in this scenario.
This vulnerability could allow a process to access the stored fingerprint and then it can be reverted to
natural-looking original fingerprint image.
That is only the case if an actual picture is stored. If you only store any detected minutiae, you can't revert to an
image. That's because the detection of the minutiae is fuzzy and every measurement is different.
Once fingerprint has been leaked, victims are leaked for the rest of life since it lasts for a life.
Moreover, fingerprints are usually associated with every citizen’s identity and immigration record.
It would be a hazard if the attacker can remotely harvest fingerprints in a large scale.
Yes, exactly like I mentioned. It's a stupid idea to use it for any type of authentication, verification or evidence.
Kind regards
Noel
--
Noel Kuntze
IT security consultant
GPG Key ID: 0x0739AD6C
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
By Date
By Thread
Current thread:
fprintd: found storing user fingerprints without encryption Seong-Joong Kim (Apr 23)
Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 07)
Re: Re: fprintd: found storing user fingerprints without encryption Roman Drahtmueller (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption Noel Kuntze (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption Noel Kuntze (May 08)
Message not availableRe: Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption Roman Drahtmueller (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 08)
Re: Re: fprintd: found storing user fingerprints without encryption halfdog (May 10)
Re: Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 10)
Re: Re: fprintd: found storing user fingerprints without encryption Seong-Joong Kim (May 11)
Re: fprintd: found storing user fingerprints without encryption halfdog (May 14)
Re: fprintd: found storing user fingerprints without encryption halfdog (May 14)
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->