FB pixel

Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable

Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable
 

Apps with exposed AWS access tokens are exposing biometric data, according to a new blog post from cybersecurity software provider Symantec. Hundreds of thousands of fingerprint records have been found unsecured online.

The supply chain for mobile apps turns out to be vulnerable to the lowest level of diligence a software or technology provider in the chain demonstrates.

Symantec found a vulnerable third-party SDK using AI for digital identity verification which is used by several popular banking apps on iOS.

“Embedded in the SDK were cloud credentials that could place entire infrastructures at risk,” writes Symantec Security Researcher Kevin Watkins. “The credentials could expose private authentication data and keys belonging to every (emphasis Symantec’s) banking and financial app using the SDK. Furthermore, users’ biometric digital fingerprints used for authentication, along with users’ personal data (names, dates of birth, etc.), were exposed in the cloud.”

The access key exposed the infrastructure server, API source code and AI models, along with more than 300,000 fingerprint templates across five mobile banking apps that use the SDK.

This particular SDK is far from alone. Symantec found that more than three-quarters of the apps it examined contain valid AWS access tokens that can be used to get into private clouds running on AWS.

Issues identified by Symantec also include mobile apps outsourced to developers who are unable to properly secure them, and larger companies developing multiple apps across teams and winding up using cross-team vulnerable libraries.

Ultimately, Symantec recommends adding security scanning to the app development lifecycle and requiring outside developers to use mobile app report cards that scan both SDKs and frameworks for vulnerabilities and insecure behavior.

The app vulnerability discovery follows an even larger biometric data breach suffered by a Chinese access control provider and revealed this week.

Article Topics

 |   |   |   |   |   |   |   | 

Latest Biometrics News

 

As retailers turn to biometrics to reduce theft, costs of poor implementation loom

Demand for biometrics to reduce retail crime continues to rise, but the risk of flawed deployments of the technology are…

 

Socure announces faster biometric IDV, deepfake and synthetic identity fraud detection

Identity verification provider Socure has announced the launch of its next generation DocV, now including enhanced deepfake selfie biometrics detection…

 

Rights group criticize EU AI Act for inadequate protections against potential abuse

The EU’s AI Act is done, and no one is happy. Having been adopted by the European Parliament in March…

 

Kids Code bills prompt epic showdown between regulators, activists and big tech firms

The latest craze sweeping the United States – legislation to protect kids’ data and overall online safety – has its…

 

UK’s £54M welfare fraud case illustrates need for biometric identity verification

A team of fraudsters has been convicted for what was described as “the largest case of benefit fraud in England…

 

Intellicheck, OneID tout banks’ unique position to cut fraud as digital ID enablers

Banks could play a significantly larger role in protecting consumers, businesses and payment systems from fraud, Intellicheck CEO Bryan Lewis…

Comments

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read From This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events