Slashdot Mirror

← Back to Stories (view on slashdot.org)

UPEK Fingerprint Reader Software Puts Windows Passwords At Risk

Posted by timothy on from the does-that-not-fit-in-with-your-plans? dept.

colinneagle writes with this excerpt from Network World: "If your password management system is to use your 'fingerprint as your master password,' and if your laptop uses UPEK software, then you'll not be happy to know your Windows password is not secure and instead is easily crackable. In fact, 'UPEK's implementation is nothing but a big, glowing security hole compromising (and effectively destroying) the entire security model of Windows accounts.' On the Elcomsoft blog about 'advanced password cracking insight,' Olga Koksharova had bad news for people who thought they were more secure by using biometrics, a UPEK fingerprint reader, instead of relying on a password. UPEK stores Windows account passwords in the registry 'almost in plain text, barely scrambled but not encrypted.' It's not just a few that are susceptible to hacking. 'All laptops equipped with UPEK fingerprint readers and running UPEK Protector Suite are susceptible. If you ever registered your fingerprints with UPEK Protector Suite for accelerated Windows login and typed your account password there, you are at risk.'"

34 of 122 comments (clear)

  1. How is this a surprise... by schaiba · · Score: 3, Insightful

    ...I don't really know.

    1. Re:How is this a surprise... by flaming+error · · Score: 2

      Exactly. Even if they had implemented it well, within the security community, the concept is thoroughly discredited.

      The primary attribute of a user id is that it be unique.

      The primary attribute of a password is that it be secret.

      Biometrics are (theoretically) unique, but not secret. They make brilliant uids, lousy passwords.

      Re-using uids as passwords is lazy/criminal.

  2. No surprise by Anonymous Coward · · Score: 5, Interesting

    Using fingerprint data as an decryption key is very hard as the information is quite noisy. However, an decryption key is still needed to fetch the password (which, in turn, is needed for example to access encrypted files). Without a secure boot infrastructure a TPM doesn't help, so that leaves only the possibility of storing the key on-disk. Once the key is located, obtaining the password is trival so it doesn't really matter whether strong encryption is used.

    This means that probably all fingerprint scanner software suffers from this flaw.

    1. Re:No surprise by bluefoxlucid · · Score: 4, Interesting

      Basically if the fingerprint scanner integrated with Windows Login the same way as third party login systems like Novel Networks et al, it wouldn't need your password until you tried to access an encrypted file. The flaw here is they hack it out by sending your password to Windows; fingerprint data is too noisy, you compare it as "sufficiently similar" but it's going to be too unique to generate a key from with any repeatability and high entropy. Thus they store the key UUENCODED or BASE64 or MIME to obscure it, which doesn't work on hackers. Instead, they should hook the login process and directly complete user authentication without a password, and let windows ask for a password if it tries to touch an EFS file.

      --
      Support my political activism on Patreon.
    2. Re:No surprise by TemporalBeing · · Score: 2

      Basically if the fingerprint scanner integrated with Windows Login the same way as third party login systems like Novel Networks et al, it wouldn't need your password until you tried to access an encrypted file. The flaw here is they hack it out by sending your password to Windows; fingerprint data is too noisy, you compare it as "sufficiently similar" but it's going to be too unique to generate a key from with any repeatability and high entropy. Thus they store the key UUENCODED or BASE64 or MIME to obscure it, which doesn't work on hackers. Instead, they should hook the login process and directly complete user authentication without a password, and let windows ask for a password if it tries to touch an EFS file.

      That wouldn't really work either. What they need to do is store the password in a system encrypted file using the Windows encryption and a per-system negotiated key to access it - perhaps one that uses TPM. Or better yet, assign a specific user (configurable which) that is created for the sole purpose of managing the keys and passwords. The software gets your fingerprint, and then logs in as that user in the background (perhaps using a service) to retrieve the relevant data.

      And, of course, if the wrote their own GINA plug-in or login system then they could manage it completely and then a simple authentication token for the user would be passed back so it could be used for the login.

      Regardless, it wouldn't really work best unless Microsoft provided some kind of API to really support it cleanly instead of relying on each individual manufacturer. That is - have an API whereby they could store some kind of data (perhaps even with some vendor/app specific encryption) - be it biometrics, passwords, etc - that could be stored locally or in the domain; it then returns a valid authentication token that could be used to complete the login process.

      --
      Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
    3. Re:No surprise by KGIII · · Score: 2

      If I had initiative I'd start a company having to do with GINA in Virginia and make a unique business name. Yes, yes I am three and have no real point other than that.

      --
      "So long and thanks for all the fish."
    4. Re:No surprise by cryptizard · · Score: 3, Informative

      There is actually some new research into exactly this problem. Using what they call "fuzzy extractors" you can derive a secure key from noisy information. Really cool, check it out http://www.cs.bu.edu/~reyzin/fuzzy.html

  3. Security Theature NOW ON BROADWAY by RobertLTux · · Score: 3, Interesting

    so how long has this been in use before somebody noticed the passwords were effectively PLAIN TEXT??

    folks this is about as smart as swimming near Amnity Island with an open wound on your ankle.

    I propose any kind of Silver Bullet be subjected to the Mitnick Test (throw it at a group of blackhats and then see how long it takes them to break it fix what you find and then pay them enough to keep quiet)

    --
    Any person using FTFY or editing my postings agrees to a US$50.00 charge
    1. Re:Security Theature NOW ON BROADWAY by gstoddart · · Score: 3, Interesting

      so how long has this been in use before somebody noticed the passwords were effectively PLAIN TEXT??

      You know, this kind of stuff happens all of the time -- because people are lazy, under pressure from the boss, or just plain stupid.

      Several years ago, I was helping to install some software which was supposed to go onto the machine in the DMZ and reach back into the firewall to access a database.

      It turns out the software stored the admin password in cleartext in a registry key (zero attempts to obfuscate, let alone encrypt). I started shouting this quite loudly to anybody who would listen, and tried to explain why this was ludicrous.

      Eventually I got told it was a low risk, and that I should shut up. Sometimes, management overrules you on these things.

      Sadly, I'm betting someone brought this to someone's attention, and got told to STFU.

      --
      Lost at C:>. Found at C.
    2. Re:Security Theature NOW ON BROADWAY by viperidaenz · · Score: 2

      They're blackhats. They're not good honest citizens. They'll tell you some of the flaws they find so you give them money. They'll keep the others to extort more money out of you in the future. You know, like an investment.

  4. Is it really secure anyways? by biochozo · · Score: 2

    We were issued laptops with fingerprint biometrics in a science class a couple years ago. I swiped my finger on my friends laptop and it logged into his account for me. Hopefully, despite this new found security hole, they have come a long way since then. I haven't seen these used anywhere. Does anyone find fingerprint biometrics to be useful? Secure? Maybe it's really just to keep the honest people honest.

    1. Re:Is it really secure anyways? by Anonymous Coward · · Score: 2, Interesting

      I haven't seen these used anywhere. Does anyone find fingerprint biometrics to be useful?

      It is very useful to laptop salesmen and computer manufacturers as a selling point/gimmick for the clueless masses.

    2. Re:Is it really secure anyways? by Mister+Whirly · · Score: 2

      Where I work everyone wanted to use fingerprint scanners as the sole method of authentication. I argued for two factor if using fingerprints - either a password or smart card. They argued up and down how fingerprints were unique, and then I logged into 2 out of the 6 laptops in the meeting room using my unregistered fingerprints. The idea was quickly abandoned thereafter. I have since tried this on a number of the Dell laptops with fingerprint scanners here and have a roughly 15-20% chance one of my fingers will log me into an account. Fingerprint scanning is like putting a 3 inch fence around something you want to protect. Yeah there is something there, but it doesn't take much to defeat it.

      --
      "But this one goes to 11!"
    3. Re:Is it really secure anyways? by jedwidz · · Score: 3, Insightful

      That's about the same as my success rate after I registered my fingerprints.

      It was faster to just put my gloves on and then type my password.

  5. Re:This is a non-issue. by The+MAZZTer · · Score: 4, Interesting

    As the article states, individually encrypted files using EFS would normally be secure even with the method you mention since that method does not obtain the Windows password, You can only access machine unencrypted files, or reset a password. Windows itself is as secure as you could expect. As you said the same can be done to Linux.

    Still I can imagine some people think Windows machines are "secure" somehow if they just have a password on their account. These people would likely assume their system would be more secure with the UPEK reader.

    Also it sounds like this UPEK software has more features, probably browser passwords and such, so there may be more problems using the UPEK software. This article doesn't state it though.

    Interestingly the manufacturer is claiming passwords are stored using AES. It would be interesting to see someone else follow up and see who is telling the truth.

  6. More Checklist Security by fm6 · · Score: 3, Insightful

    Remember that Simpsons ep where Smithers and Burns have to enter their top secret command post? They pass through a dozen high-tech security portals worthy of a James Bond movie to get there. Unexplained is why they didn't just use the other entrance, which consists of a broken screen door.

    Then there's the ISP I used to work for that advertises "Biometric security access". What is means is that a server room in an office building has a lock that can be opened by employee fingerprint. Of course, it can also be opened by an ordinary key, which is what building security uses.

    People buy security tech, and they think they've solved a security problem. Once again I quote Bruce Schneier: security is a process, not a product.

  7. Never rely on a single authentication method. by QilessQi · · Score: 4, Insightful

    The best authentication has three components:

    1. Something you know (such as a passphrase), plus...
    2. Something you own (such as the ID number from a FOB which rotates IDs every minute), plus...
    3. Something you are (biometrics).

    You don't use biometrics *instead* of the passphrase or FOB; you use it to augment the effectiveness of those techniques.

    --
    Koans and fables for the software engineer
    1. Re:Never rely on a single authentication method. by tringstad · · Score: 4, Insightful

      Biometrics are not and should not be used for authentication at all, they fall under the category of identification.

      Good article on the differences between Identification, Authentication, and Authorization here:

      http://technet.microsoft.com/en-us/library/cc512578.aspx

      There is even a section which addresses biometrics specifically.

      --
      "I got a half gallon of Jack, and 2 dozen Ant Traps. I'm about to get wild." -me
    2. Re:Never rely on a single authentication method. by QilessQi · · Score: 2

      I think we're on the same page, but talking about two entirely different things. I agree that in James Bond scenarios, biometrics might pose a risk to the owner, but I'm talking about why you don't use biometrics by themselves. The article starts with this:

      If your password management system is to use your "fingerprint as your master password," and if your laptop uses UPEK software, then you'll not be happy to know your Windows password is not secure and instead is easily crackable.

      Absolutely. Using biometrics as a funny sort of password -- without any other authentication methods to supplement it -- is a bad idea, even if no one is lurking behind the bushes of your house waiting to brain you with a crescent wrench and steal your index fingers.

         

      --
      Koans and fables for the software engineer
    3. Re:Never rely on a single authentication method. by QilessQi · · Score: 2

      Wow, that's an interesting perspective. For any tl;dr folks out there, the summary boils it down nicely:

      * Identification: who are you?
      * Authentication: how can you prove it?
      * Authorization: what can you do?

      However, if biometrics are used to back up the assertion of the username in a supplied username/password combo (in 2-factor authentication), they feel a little more like authentication than identification to me. But I see your point, and mod you Informative with my imaginary mod points.

      --
      Koans and fables for the software engineer
    4. Re:Never rely on a single authentication method. by tringstad · · Score: 2

      if biometrics are used to back up the assertion of the username ...

      Biometrics is intended to replace the username, not "back it up".

      ... in a supplied username/password combo (in 2-factor authentication) ...

      Username/password combinations are NOT 2-factor authentication. 2-factor authentication is more along the line of the OP's first two examples of something you have plus something you know. For instance, my gmail account is secured using Google's 2-factor implementation and my smartphone:

      http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html

      ... they feel a little more like authentication than identification to me.

      Hopefully this is no longer the case.

      --
      "I got a half gallon of Jack, and 2 dozen Ant Traps. I'm about to get wild." -me
  8. Re:Is the Dell or Lenovo model reader? by ThatsMyNick · · Score: 2

    It is the same software. It usually says "Powered by Blah Blah". My HP software uses a newer version of the same software (branded as HP Simple Pass 2010 Identity Protection powered by AuthenTech), which supposedly is not vulnerable.

  9. Re:how hard would it have been by bluefoxlucid · · Score: 3, Informative

    Ridiculously hard. Fingerprints are biometric, they change. You have a rough model that's similar to a rough model snapshot of your fingerprint pressed, squished, scanned, etc. Your print may possibly be rotated--orientation is random, but comparable to a known snapshot. Basically every time you image the fingerprint you get a slightly different result, and you apply fuzzy logic to work out if it matches prior data.

    This also means that using fingerprint uniqueness points to generate some sort of AES key would store your password in plain text: the finger print is stored somewhere for verification, and therefor the finger print model can be used to derive the encryption key, and thus the key is stored with the ciphertext, thus plain text. (By this logic, if you attach your front door key to your front door with a magnet and then lock your front door and leave, your house is unlocked--any moron can pluck the key dangling by the door knob and open your door, you've simply altered the interface a bit. Key under the doormat is the same, takes a little more time examining it to figure out how you're supposed to open the door but you can, it's not really locked.)

    --
    Support my political activism on Patreon.
  10. It's not a security device by joeflies · · Score: 4, Insightful

    All consumer biometric devices should not be considered "security" devices, but rather "convenience" devices. It makes it easier to log in than typinig a password, and it's more convenient than using an OTP on the desktop. But it's not secure as a password because the password store is on the computer.

    As far as password lockers go, I'm inclined to trust a password store encrypted by a passphrase (like lastpass) rather than a biometric. That's because with a passphrase, you can have a very precise method of unlocking the password store. The passphrase itself vouches for you and is repeatable. A biometric scan may vouch for you, but the values it returns are not a key. Some other key is used to decrypt the password store. And that "some other key" is open to the whims of how it's implemented by the device maker.

    One caveat, on the security scale, commercial biometric devices are a different animal altogether

  11. Re:Is the Dell or Lenovo model reader? by pixelpusher220 · · Score: 2

    A search of Dell shows a number of machines that use it linky

    --
    People in cars cause accidents....accidents in cars cause people :-D
  12. Well that is much simpler than I thought by AlienSexist · · Score: 4, Insightful

    I always figured that the digital representation of your fingerprint would be extracted and copied. With that copy a number of options could be possible. Perhaps the scan can be bypassed entirely and the biometric computer fed the digital copy. Or perhaps the copy can be used with the reverse-algorithm from the reverse-engineered reader to produce a fingerprint that will have the same "hash value" even if it is not exactly like the owner's. Any one of these "solution" fingerprints could be printed onto paper or some material that would allow proper scanning as a normal finger.

    Let us not forget the rumored "gummy bear" attack on biometric readers in the past.

    But no, I guess it is far ,far easier to just read the users password out of the registry from where the biometric system wrote it.

  13. Windows services "log on" by whoever57 · · Score: 2

    Under recent versions of Windows, services can be configured to "log on" as a particular user in order to run. This requires the password to be entered.

    If the user's password is later changed, the services will not run, because the "log on" fails. This implies that the password is being stored (perhaps encrypted) somewhere in a fashion that the password can be recovered (in order to be used by the service to "log on").

    If the OS can recover the user's password to log on a service, then other programs should also be able to recover the password.

    Have I misunderstood what is happening to the user login, or is it another hole?

    --
    The real "Libtards" are the Libertarians!
  14. Missing the point by Rich0 · · Score: 3, Insightful

    The summary states that the passwords are scrambled but not encrypted. I fail to see the distinction. If I take a word and reverse it, that is a form of encryption. Sure, it is a very weak form, but it is.

    And if you're going to just store the session key in the registry then it doesn't matter if they're using AES with a 5000-bit key.

    If they used strong encryption on the password database, and then used TPM to store the session key, with a full trusted boot chain to the software needed to obtain the keys, then that would be pretty strong. However, I don't know that enough of Palladium was ever implemented to make this practical. Full-disk encryption software tends to work this way, but that runs before the bootloader, so it only needs the boot chain to be secure up to that point.

  15. Re:Is the Dell or Lenovo model reader? by viperidaenz · · Score: 2

    Yes, social engineer a finger print.

  16. Re:This is a non-issue. by anomaly256 · · Score: 3, Informative

    What I don't get is why it needs to store the windows account password at all. If they wrote a proper authentication plugin for the windows security model, they would just need to know the user's SID and have permission to go 'Yep, the person at the console is in fact this SID' without needed to provide the password at all. I've done this before, it's really not all that hard either, day or 2 of digging through docs and actual coding. *confused*

  17. Doesn't W7 do this by itself? by mlts · · Score: 2

    I don't see on a modern laptop why UPEK would even be installed in the first place. If a laptop has a fingerprint scanner, Windows 7 or even Vista will find it and have a native process in place to enroll fingerprints and attach that as a credential to logging in.

    I don't know how secure W7 stores that info, but I'm pretty sure it wouldn't be something trivial to decode. Add a TPM chip and BitLocker [1] to the mix, and the fingerprint database is definitely well protected against intrusion.

    [1]: If you are leery like me, you use a TPM + PIN + a nonce on a USB flash drive. This way, if the laptop is off or hibernated and it gets stolen, if the USB drive is still in the pocket, then there is assurance that the laptop's OS is well locked down. Even then, I like working completely from remote via GoToMyPC, or some other protocol so the laptop essentially is a glorified terminal. That way, if something does happen and the laptop is happily running and unattended, the damage is still minimal. If I have to store stuff locally, I use a TrueCrypt volume with keyfiles stored on a hardware-secured USB flash drive [2].

    [2]: Only one I've really seen that is well engineered are the old IronKeys, now made by Imation. The advantage of these is brute force resistance. 10 wrong password guesses, the key either fries itself or erases itself depending on type.

  18. Re:This is a non-issue. by cryptizard · · Score: 2

    Right, but then what if you have your home directory encrypted? Usually this key is not stored but derived from your password at login time. You can't do that with fingerprints.

  19. Re:Ha Ha HA!!! by jedwidz · · Score: 2

    The master key is in a lockbox at the bottom of the Atlantic, encrypted with a Caesar cipher, written backwards in runic with lemon juice.

  20. Re:This is a non-issue. by cryptizard · · Score: 3, Interesting

    Right, but they don't require a 100% match on the extracted features. Also, if the key is derived from the fingerprint, and the fingerprint template is stored on the disk, then really the key is just being stored on the disk in a roundabout way and you don't have any better security anyway.