Android biometric safeguards fail to withstand brute-force attack

A team of Chinese scientists has bullied its way past fingerprint authentication protections on smartphones, exposing significant vulnerabilities, reports TechXplore.

The operation, conducted by researchers at Zhejiang University and Tencent Labs, was codenamed “Bruteprint: Expose Smartphone Fingerprint Authentication to Brute-force attack.” The attack exposed a weakness in the phones’ lockout features (Match After Lock, or MAL), gained the team easy access to biometric fingerprint data stored on the devices or acquired through online databases, and circumvented Cancel-After-Match-Fail (CAMF), a feature designed to limit the number of unsuccessful fingerprint matches.

Of ten tested phones, models from Android and Huawei were found to be vulnerable, whereas Apple’s iOS devices were able to withstand the brute-force attack. For vulnerable devices, says a report detailing the attack, “the shortest time to unlock the smartphone without prior knowledge about the victim is estimated at 40 minutes.”

The report says that the more familiar presentation attack, which “impersonates a target victim by presenting artefacts (e.g. silica gel fingers) to the fingerprint sensor,” has “long been identified as a severe threat to the security of fingerprint authentication systems.” Manufacturers rely on tools such as liveness detection and attempt limits to combat presentation attacks. But, with attacks like BrutePrint, there are new risks to consider when assessing fingerprint authentication on smartphones.

Global biometric data marketplaces, such as the recently shut down Genesis market, provide low-barrier access to millions of credentials mined from data breaches. Moreover, the Chinese team discovered “insufficient protection of fingerprint data on the Serial Peripheral Interface (SPI) of fingerprint sensors,” which enabled “a hardware approach to man-in-the-middle (MITM) attacks for fingerprint image hijacking.”

This is not the first time that Tencent Labs has taken a jab at smartphone fingerprint scanners. At a conference in 2019, a Tencent team claimed it could easily hack its way into almost any Android or iOS device in 20 minutes, through a presentation attack using a 3D-printed finger based on photographs. The fake finger worked on devices with capacitive, optical and ultrasonic sensors.

Article Topics

Android  |  biometric authentication  |  fingerprint biometrics  |  pen testing  |  smartphones  |  Tencent