Slashdot Mirror
UPEK Fingerprint Reader Software Puts Windows Passwords At Risk
colinneagle writes with this excerpt from Network World: "If your password management system is to use your 'fingerprint as your master password,' and if your laptop uses UPEK software, then you'll not be happy to know your Windows password is not secure and instead is easily crackable. In fact, 'UPEK's implementation is nothing but a big, glowing security hole compromising (and effectively destroying) the entire security model of Windows accounts.' On the Elcomsoft blog about 'advanced password cracking insight,' Olga Koksharova had bad news for people who thought they were more secure by using biometrics, a UPEK fingerprint reader, instead of relying on a password. UPEK stores Windows account passwords in the registry 'almost in plain text, barely scrambled but not encrypted.' It's not just a few that are susceptible to hacking. 'All laptops equipped with UPEK fingerprint readers and running UPEK Protector Suite are susceptible. If you ever registered your fingerprints with UPEK Protector Suite for accelerated Windows login and typed your account password there, you are at risk.'"
...I don't really know.
It's even more trivial to access the files from another Windows or Linux installation (say a USB drive) than it is to login. Unless you're encrypting your hard drive above the operating system level, it's just as insecure anyway.
Windows has security????
Oh, you were serious...
Ha Ha HA!!!
Criminals have stopped chopping off right index fingers. More news at 11
sudo make me a sandwich
Or are they the same hardware/software rebranded?
Using fingerprint data as an decryption key is very hard as the information is quite noisy. However, an decryption key is still needed to fetch the password (which, in turn, is needed for example to access encrypted files). Without a secure boot infrastructure a TPM doesn't help, so that leaves only the possibility of storing the key on-disk. Once the key is located, obtaining the password is trival so it doesn't really matter whether strong encryption is used.
This means that probably all fingerprint scanner software suffers from this flaw.
so how long has this been in use before somebody noticed the passwords were effectively PLAIN TEXT??
folks this is about as smart as swimming near Amnity Island with an open wound on your ankle.
I propose any kind of Silver Bullet be subjected to the Mitnick Test (throw it at a group of blackhats and then see how long it takes them to break it fix what you find and then pay them enough to keep quiet)
Any person using FTFY or editing my postings agrees to a US$50.00 charge
How hard would it seriously have been to use the fingerprint uniqueness points to generate some sort of 256-bit value to use as an AES key?
We were issued laptops with fingerprint biometrics in a science class a couple years ago. I swiped my finger on my friends laptop and it logged into his account for me. Hopefully, despite this new found security hole, they have come a long way since then. I haven't seen these used anywhere. Does anyone find fingerprint biometrics to be useful? Secure? Maybe it's really just to keep the honest people honest.
Not a surprise that it's vulnerable, but it is surprising how badly they stored the passwords.
Remember that Simpsons ep where Smithers and Burns have to enter their top secret command post? They pass through a dozen high-tech security portals worthy of a James Bond movie to get there. Unexplained is why they didn't just use the other entrance, which consists of a broken screen door.
Then there's the ISP I used to work for that advertises "Biometric security access". What is means is that a server room in an office building has a lock that can be opened by employee fingerprint. Of course, it can also be opened by an ordinary key, which is what building security uses.
People buy security tech, and they think they've solved a security problem. Once again I quote Bruce Schneier: security is a process, not a product.
The best authentication has three components:
1. Something you know (such as a passphrase), plus...
2. Something you own (such as the ID number from a FOB which rotates IDs every minute), plus...
3. Something you are (biometrics).
You don't use biometrics *instead* of the passphrase or FOB; you use it to augment the effectiveness of those techniques.
Koans and fables for the software engineer
Secure boot has no relevance at all.
This situation is the same for ANY biometric login method. The actual password has to be stored for decryption.
But it doesn't work.
Biometric measures are always noisy. Each scan is different, and reduction of that noise always reduces to a simple statistical measure. The result must therefore be weaker than a true cryptographic hash.
All consumer biometric devices should not be considered "security" devices, but rather "convenience" devices. It makes it easier to log in than typinig a password, and it's more convenient than using an OTP on the desktop. But it's not secure as a password because the password store is on the computer.
As far as password lockers go, I'm inclined to trust a password store encrypted by a passphrase (like lastpass) rather than a biometric. That's because with a passphrase, you can have a very precise method of unlocking the password store. The passphrase itself vouches for you and is repeatable. A biometric scan may vouch for you, but the values it returns are not a key. Some other key is used to decrypt the password store. And that "some other key" is open to the whims of how it's implemented by the device maker.
One caveat, on the security scale, commercial biometric devices are a different animal altogether
What i don't understand is why in Avengers Loki used a device to actually break skin/eyeball to relay an eye scan remotely. it seems needlessly cruel. The little device could have easily taken a scan and sent the information instead of cutting into the guy's face. Was the guy going to have to give up an eye if he himself ever needed to get at the iridium?
No one will ever figure out how to "decrypt" it.
Psssshaw. My voice is my password.
I always figured that the digital representation of your fingerprint would be extracted and copied. With that copy a number of options could be possible. Perhaps the scan can be bypassed entirely and the biometric computer fed the digital copy. Or perhaps the copy can be used with the reverse-algorithm from the reverse-engineered reader to produce a fingerprint that will have the same "hash value" even if it is not exactly like the owner's. Any one of these "solution" fingerprints could be printed onto paper or some material that would allow proper scanning as a normal finger.
,far easier to just read the users password out of the registry from where the biometric system wrote it.
Let us not forget the rumored "gummy bear" attack on biometric readers in the past.
But no, I guess it is far
Under recent versions of Windows, services can be configured to "log on" as a particular user in order to run. This requires the password to be entered.
If the user's password is later changed, the services will not run, because the "log on" fails. This implies that the password is being stored (perhaps encrypted) somewhere in a fashion that the password can be recovered (in order to be used by the service to "log on").
If the OS can recover the user's password to log on a service, then other programs should also be able to recover the password.
Have I misunderstood what is happening to the user login, or is it another hole?
The real "Libtards" are the Libertarians!
The summary states that the passwords are scrambled but not encrypted. I fail to see the distinction. If I take a word and reverse it, that is a form of encryption. Sure, it is a very weak form, but it is.
And if you're going to just store the session key in the registry then it doesn't matter if they're using AES with a 5000-bit key.
If they used strong encryption on the password database, and then used TPM to store the session key, with a full trusted boot chain to the software needed to obtain the keys, then that would be pretty strong. However, I don't know that enough of Palladium was ever implemented to make this practical. Full-disk encryption software tends to work this way, but that runs before the bootloader, so it only needs the boot chain to be secure up to that point.
Fingerprints are a stupid way of authenticating. It's a password which you automatically leave on everything you touch!
Can anyone tell me which registry entries I should check for? I'd like to verify that uninstalling the software has removed my "barely scrambled" password from the registry.
Insert self-referential sig here.
While my notebook has a different fingerprint scanner, this story does not surprise me. Fingerprint scanners can not be trusted. Me and my fellow students received ours on enrollment and it took only a few days before I witnessed a few friends swiping across each others scanners and logging in by accident. The only might be as an additional authentication factor, but then you still need a password, and you're screwed if the thing ever breaks or you burn your finger. So everyone I know basically did the same thing, we disabled it.
I don't see on a modern laptop why UPEK would even be installed in the first place. If a laptop has a fingerprint scanner, Windows 7 or even Vista will find it and have a native process in place to enroll fingerprints and attach that as a credential to logging in.
I don't know how secure W7 stores that info, but I'm pretty sure it wouldn't be something trivial to decode. Add a TPM chip and BitLocker [1] to the mix, and the fingerprint database is definitely well protected against intrusion.
[1]: If you are leery like me, you use a TPM + PIN + a nonce on a USB flash drive. This way, if the laptop is off or hibernated and it gets stolen, if the USB drive is still in the pocket, then there is assurance that the laptop's OS is well locked down. Even then, I like working completely from remote via GoToMyPC, or some other protocol so the laptop essentially is a glorified terminal. That way, if something does happen and the laptop is happily running and unattended, the damage is still minimal. If I have to store stuff locally, I use a TrueCrypt volume with keyfiles stored on a hardware-secured USB flash drive [2].
[2]: Only one I've really seen that is well engineered are the old IronKeys, now made by Imation. The advantage of these is brute force resistance. 10 wrong password guesses, the key either fries itself or erases itself depending on type.
Rather than store the user's password encrypted under a master key, why isn't the password encrypted by the digitized version of the fingerprint? (Yes I'm aware that every scan will be somewhat different from the original.)
Follow me here: Take the original fingerprint, reduce it to its digital essence by whatever means. Then combine a unique random password with a recognizable salt, and encrypt their concatenation using the digitized fingerprint. When someone later scans their finger, take the digital essence of that scan plus several hundred variants (to compensate for the natural scanning differences), and try decrypting every password with each of those values. When you recover the recognizable salt, you know you've found the matching user. Feasible?
Go to the mall or open your mail box or get gas or anything until you scan your finger print.
I remember thinking at one time that fingerprint readers were cool. Your fingerprint is exclusively yours. Noone can forge your fingerprint. Whoops! I remember reading about a group of Australian junior high school kids who had computers in the classroom. The computers had fingerprint readers, and the kids placed their fingerprint on the reader to log in. But the teachers were dumbfounded when they noted that the entire class had logged in (everything was local to the classroom), even though clearly 2/3 of the class skipped the class. They couldn't figure out how the kids were defeating the readers so they set up cameras. The culprit they discovered would be very subtly eaten after use: Gummy Bears (and other Gummy treats like gummy worms, etc) would be pressed against freshly washed fingers, and then would be wrapped around others fingers with the imprint on the reverse. The fingerprint reader read the gummy print perfectly, and then the bear would be consumed, logging the student in and leaving no evidence trail. Super duper high technology, defeated by grade school snacks.
How can alternative ways of authentication require their service application know your password in plaintext?!
This is so pathetic architecture.
Windows is literally decades behind Linux/Unix operating systems when it comes to technology.
Didn't Microsoft hear about the PAM authentication system? It's highest time to copy it just like all the others innovations.
Would that work for Network logins?
If you've got mapped drives, I'd imagine that the server is going to need more than a "yup, this is Bob all-right" from the client machine. If the user hasn't typed his/her password in at login, then how would it get to the remote server without being stored somewhere?
And without an authenticating master password, I don't see a way to safely store secure data. There may be an obscure alghorythm or something of the sort to mash it up, but eventually it needs to be decryptable, which - without human intervention - means hard-coded methods of doing so which are subject to discovery and abuse.
Similar issues arise in Linux-land if you have an encrypted password keystore and auto-login. You need to either login to the keystore, or re-enter your wifi password to connect to an AP, or have the AP password saved in a way that is plaintext or encrypted in a way that could be duplicated.