Slashdot Mirror
HTC Doesn't Protect Fingerprint Data
An anonymous reader writes: Biometric authentication is becoming commonplace — fingerprint scanners have been used on laptops for years, and now they're becoming commonplace on phones, as well. As more devices require your fingerprint to unlock, it becomes more important for each of them to guard that data. It's significant, then, that researchers from FireEye were able to easily grab fingerprint data off several recent phones. The most egregious offender is the HTC One Max, which stores the fingerprint comparison image as a simple .BMP file in a folder that's open to access. "Any unprivileged processes or apps can steal user's fingerprints by reading this file." According to the research they presented at Black Hat (PDF), it would also be simple for hackers who have remotely compromised the device to upload their own fingerprints to grant themselves physical access.
What a bunch of amateurs. Everyone who's learned a thing or two about graphic file formats knows that PNG is much superior.
In a horrifying security alert, researchers have revealed that your fingerprints are stored in unprotected memory on ANYTHING YOU TOUCH! Until a fix for this flaw can be found, it is suggested that all people immediately start wearing blue nitrile gloves at all time to mitigate this vulnerability.
Even if we trusted that vendors weren't lazy, incompetent, and indifferent to security (and that is a big if) ... why should we be entrusting them with our biometric data in the first place?
Corporations want to sell a product, sell advertising, and don't give a damn about your security or privacy. You should also assume they'll hand any of this crap over to governments if they demand it.
Sorry, but until such time we get to use the CEO as a pinata for bad security, assume there simply is none. Because that's where we're at right now.
With no penalties for crap security, they're not going to implement good security. Stop treating them as if they have.
I'd wager that if you bought 20 products which claim to have security features, likely all 20 of them are easily defeated or bordering on non-existent in terms of actual security.
Lost at C:>. Found at C.
I know that finger prints on phones is convenient but it still seems to odd to me to "secure" something with a pattern that you leave everywhere you go, on everything you touch. If you used a thumb print to secure your bank account it would be like writing your bank details on everything single surface you came into contact with. Sure you'd be writing them very small, and it'd take some effect to make them useful, and you couldn't just use them anywhere, "Excuse me while I pay for my groceries with this rubber glove I found that I've affixed some one else's prints to." isn't exactly subtle.
It still seems like a bad plan though.
If you have your fingers on a device, you ALREADY have physical access.
Being able to spoof a fingerprint reader on a device you can stick in your pocket seems to have limited utility.
All the affected people have to do is change their fingerprints.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
In related news, a burglar was arrested because he left an ID card in the house...
Fingerprints are Usernames, not Passwords. Using them as passwords is bad practice anyway .
I know that it's all the rage to crap on Apple, but compare this "approach" to security vs Apple's approach ...
https://www.apple.com/business...
Apple isn't perfect by any means but at least they put the time and energy into actually trying to do the right things. They make mistakes - like everyone else - but at least there's some forethought.
2 HTC has patched this vulnerability per our notification
So Apple introduces fingerprint sensors and the world is abuzz and Congress sends nasty letters demanding information about how they will protect the fingerprint information.
Now somebody else does it and they don't even make a rudimentary effort to protect the information. Where's the congressional indignation now?
Fingerprints are Usernames, not Passwords. Using them as passwords is bad practice anyway .
Fingerprints are not usernames nor are they passwords. Security comes from having Things-You-Are, Things-You-Have, and Things-You-Know. Good security typically involves at least two of those Things if not all three. No security is unbreakable. Both usernames and passwords fall into the Things-You-Know which is why they are relatively easy to crack. This is why two factor authentication is a good idea because it generally relies on both a Thing-You-Know and a Thing-You-Have. Fingerprints are a Thing-You-Are though if not secured can become a Thing-You-Know/Have. At times they can be used like a username or a password but they are not the same thing and assuming they are the same thing is generally a mistake.
The biggest problem with Things-You-Are is also the biggest strength. Things-You-Are are generally the hardest to forge or circumvent but when they are they cannot be changed unlike Things-You-Have or Things-You-Know. So you don't want to use Things-You-Are too much.
to laugh at android shitting its pants once more
they allow this, but in the name of se
remind me, why is android popular, again? because it has ads? a free sdk? cheap devices?
does android have any redeeming qualities, or is it a case of windows 3.1 all over again? "it's popular because it's popular"?
I think there's a fundamental misunderstanding of biometrics and biometric security that is prevalent throughout much of the industry, and it's often expressed as "biometrics are identifiers, not passwords!", though usually with more exclamation points, or the verbal equivalent, except when the even more foolish version "biometrics are passwords" is used.
These statements are wrong. Biometrics are not identifiers. They're lousy identifiers, actually, since identifiers need to be unique and consistent, while biometrics aren't either. Biometrics are also not passwords. Passwords rely on secrecy and need to be rotated. Biometrics are not secret and cannot be rotated.
But, if biometrics don't fit into either of these buckets we're accustomed to, if they're not usernames and not passwords doesn't that mean they're useless? No, it does not.
Biometrics are authenticators. Passwords are also authenticators, but they operate on different principles, validating information that is expected to be a secret. Biometrics attempt to validate the presence of a physical body that is the one expected. What's funny about this to me is that humans, in general, are extremely comfortable with biometric identification and authentication because it's the way we identify and authenticate everyone around us all the time. But we've trained ourselves to think differently about these issues in the context of computer security. (Note that personal identification is considered the best form of authentication in physical security systems as well... the biometric auth systems built into our heads are extremely hard to fool at close range with more than a few seconds' interaction).
Biometric authentication provides security without relying on the secrecy of your fingerprints, because they aren't. You leave them everywhere you go all over everything you touch. Including, by the way, your phone. They provide security because it is supposed to be hard for anyone else to use your fingerprints, even if they know exactly what they look like, to unlock your phone. That is, the security comes from the meat/sensor interface, not from the content of the data delivered via that interface.
This fact points out some rather obvious potential exploits. Since making gummy fingers isn't particularly hard, and since phone sensors aren't very good at distinguishing between real fingers and fake fingers, the security level isn't very high against an attacker who is willing to go to the effort of lifting a print and making a fake finger. It's also not good against an attacker willing to crack the phone open and replay image data directly to the system, bypassing the sensor.
Fingerprints provide a very different security model than passwords. They're stronger against casual attackers (can't be shoulder surfed; often hard to phish), but potentially weaker against more sophisticated attackers, and don't rely on secrecy.
With this proper contextualization, it's clear that the "attacks" referenced in the article are non-issues. Leaking your fingerprints isn't a security problem, it's a privacy problem. Fingerprints are like any other PII (personally-identifiable information) on your phone. The device should secure PII against remote extraction, and should make it reasonably hard for local attackers to get. But when the attack begins with, step 1, "root the device", I just tune out, because of all of the PII on my phone, my fingerprints are among the least important.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Biometric data is *NOT SECRET* and never has been. The idea isn't "nobody has access to your fingerprints", it's "if you control the device, and can monitor the person attempting to access the device, you can easily detect attempts to use someone else's data"
eg: Yes, your fingerprint reader can be defeated by the person holding a photocopy of someone else's hand. If you leave them alone with the device, they can also defeat it by pulling the back cover off, so that's not particularly an issue.
-- 'The' Lord and Master Bitman On High, Master Of All
Honestly, given the dollar amount that one can spend in big-box retailers that happen to have grocery store departments, if one could pay with a fingerprint it wouldn't be unreasonable to make a practical special effects finger with a fingerprint on it that would pass under normal scrutiny. If such were to develop I could see someone going in and buying the high-end television, the home theatre receiver, the speakers, the tablet computer, and some bread, milk, cereal, fresh fruit, and beer in one trip...
Normally one needs to use a two-fold method. Think username and password. Think ATM card and PIN. Something you have, and something you know.
Do not look into laser with remaining eye.
... is that you don't generally have any real ability to limit anyone else from collecting your fingerprints without wearing gloves everywhere... and if you are even *suspected* of a crime, you have no legal right at all to refuse to be fingerprinted by law enforcement (if you are acquitted, you can usually request that the information be destroyed, however, YMMV on this, depending on the jurisdiction). At least with passwords, you can simply refuse to divulge them. Some jurisdictions may throw a person in prison for not divulging a password, but of course, they still don't get the password by doing so, and are ultimately just keeping someone in prison at the taxpayer's expense that they won't necessarily get anything out of. While you won't necessarily be thrown in prison for refusing to give your fingerprints, that's only because law enforcement is authorized to use reasonable force to take fingerprints without your consent anyways.
File under 'M' for 'Manic ranting'
Wasn't this already patched for the "MAX" offender?
The Sprint HTC One Max is receiving an OTA update with software version 3.02.651.8, and as per the official changelog the only thing that is set to shift with this update is “Fingerprint security enhancement”.
HTC One Max software update - version 3.02.651.8
Enhancements/Fixes:
Fingerprint security issue
Fix for persistent "Smith" expiration notification
Important Info:
Deployment to all devices starts on 7/29/15. All devices should receive update on 7/29/15
For additional info, check out the software update article in Sprint Device Support
http://support.sprint.com/support/article/Find-and-update-the-software-version-on-your-HTC-One-max/WServiceAdvisory_542_GKB61419-dvc7830006prd?INTNAV=SU:DP:OV:UG:HtcOneMax:FindAndUpdateTheSoftwareVersionOnYourHtcOneMax#!/
Well now that's a conundrum. If your fingerprint get's lifted, what is the difference between this and an ill conceived password?
I've repeatedly showed Dana links to his incredibly ironic accusations of dishonest lying fraud. Here are just a few:
It's especially ironic that Rep. Dana Rohrabacher (R-CA) has spent years accusing scientists of lying dishonest fraud when scientists tell him what scientists think.
Does Rep. Rohrabacher also accuse surgeons of lying dishonest fraud when surgeons tell him what surgeons think? Or does Rep. Rohrabacher realize that surgeons probably know what surgeons think better than he does?