Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable

Apps with exposed AWS access tokens are exposing biometric data, according to a new blog post from cybersecurity software provider Symantec. Hundreds of thousands of fingerprint records have been found unsecured online.

The supply chain for mobile apps turns out to be vulnerable to the lowest level of diligence a software or technology provider in the chain demonstrates.

Symantec found a vulnerable third-party SDK using AI for digital identity verification which is used by several popular banking apps on iOS.

“Embedded in the SDK were cloud credentials that could place entire infrastructures at risk,” writes Symantec Security Researcher Kevin Watkins. “The credentials could expose private authentication data and keys belonging to every (emphasis Symantec’s) banking and financial app using the SDK. Furthermore, users’ biometric digital fingerprints used for authentication, along with users’ personal data (names, dates of birth, etc.), were exposed in the cloud.”

The access key exposed the infrastructure server, API source code and AI models, along with more than 300,000 fingerprint templates across five mobile banking apps that use the SDK.

This particular SDK is far from alone. Symantec found that more than three-quarters of the apps it examined contain valid AWS access tokens that can be used to get into private clouds running on AWS.

Issues identified by Symantec also include mobile apps outsourced to developers who are unable to properly secure them, and larger companies developing multiple apps across teams and winding up using cross-team vulnerable libraries.

Ultimately, Symantec recommends adding security scanning to the app development lifecycle and requiring outside developers to use mobile app report cards that scan both SDKs and frameworks for vulnerabilities and insecure behavior.

The app vulnerability discovery follows an even larger biometric data breach suffered by a Chinese access control provider and revealed this week.

Article Topics

banking  |  biometric template  |  biometrics  |  cybersecurity  |  fingerprint biometrics  |  identity verification  |  mobile app  |  SDK  |  Symantec