FB pixel

Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable

Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable
 

Apps with exposed AWS access tokens are exposing biometric data, according to a new blog post from cybersecurity software provider Symantec. Hundreds of thousands of fingerprint records have been found unsecured online.

The supply chain for mobile apps turns out to be vulnerable to the lowest level of diligence a software or technology provider in the chain demonstrates.

Symantec found a vulnerable third-party SDK using AI for digital identity verification which is used by several popular banking apps on iOS.

“Embedded in the SDK were cloud credentials that could place entire infrastructures at risk,” writes Symantec Security Researcher Kevin Watkins. “The credentials could expose private authentication data and keys belonging to every (emphasis Symantec’s) banking and financial app using the SDK. Furthermore, users’ biometric digital fingerprints used for authentication, along with users’ personal data (names, dates of birth, etc.), were exposed in the cloud.”

The access key exposed the infrastructure server, API source code and AI models, along with more than 300,000 fingerprint templates across five mobile banking apps that use the SDK.

This particular SDK is far from alone. Symantec found that more than three-quarters of the apps it examined contain valid AWS access tokens that can be used to get into private clouds running on AWS.

Issues identified by Symantec also include mobile apps outsourced to developers who are unable to properly secure them, and larger companies developing multiple apps across teams and winding up using cross-team vulnerable libraries.

Ultimately, Symantec recommends adding security scanning to the app development lifecycle and requiring outside developers to use mobile app report cards that scan both SDKs and frameworks for vulnerabilities and insecure behavior.

The app vulnerability discovery follows an even larger biometric data breach suffered by a Chinese access control provider and revealed this week.

Article Topics

 |   |   |   |   |   |   |   | 

Latest Biometrics News

 

St. Kitts and Nevis chooses Cybernetica as strategic adviser for digital ID system

St. Kitts and Nevis has chosen Cybernetica as strategic adviser as it implements a national digital identity system. Cybernetica is…

 

UK needs unified regulation for facial recognition: Biometrics Institute

The UK needs a clearer and consistent framework for governing facial recognition in public spaces as missteps in deploying the…

 

Growth of digital wallet use shaking up payment regulations and benefits delivery

Digital wallets are transforming online, offline and cross-border payments around the world, prompting calls for regulatory change in Australis and…

 

Sardine nets $70M in Series C funding for automated fraud prevention platform

Sardine, a startup that employs machine learning for fraud prevention, compliance and credit underwriting, has announced a $70 million Series…

 

Indonesia aims to boost digital ID uptake in bid for greater efficiency

Indonesia is digitizing its civil registration services in a bid for greater efficiency as the country’s citizens enjoy improved convenience…

 

Ondato’s biometric age verification joins NIST leaderboard

Ondato has joined the U.S. National Institute of Standards and Technology evaluation of age assurance algorithms in the latest update…

Comments

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Viewed This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events