ClickCease Hello Authentication Vulnerabilities Discovered: Stay Safe

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Hello Authentication Vulnerabilities Discovered: Stay Safe

by Wajahat Raja

December 7, 2023 - TuxCare expert team

In the realm of cybersecurity, a recent study has brought to light a series of Hello Authentication vulnerabilities that could compromise the Windows Hello authentication on popular laptop models, including Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X. Conducted by researchers at Blackwing Intelligence, a firm specializing in hardware and software product security, these findings underscore potential security risks associated with fingerprint sensors from Goodix, Synaptics, and ELAN integrated into these devices. This blog delves into the details of Hello Authentication flaws, as well as the mitigation measures advised.

 

The Nature of Hello Authentication Vulnerabilities


The fingerprint sensors in question, categorized as
“match on chip” (MoC), house both matching and biometric management functions within their integrated circuits. Despite MoC’s ability to prevent the replay of stored fingerprint data, it falls short in preventing a malicious sensor from mimicking a legitimate sensor’s communication with the host. This could lead to false claims of successful user authentication.


Vulnerability Assessment


Researchers Jesse D’Aguanno and Timo Teräs emphasize that while MoC prevents certain exploits, it does not address the possibility of a malicious sensor falsely asserting an authorized user’s successful authentication. Moreover, MoC fails to prevent the replay of previously recorded traffic between the host and sensor, leaving room for exploitation.


The Role of Secure Device Connection Protocol (SDCP)


Microsoft introduced the Secure Device Connection Protocol (SDCP) to establish an end-to-end secure channel, aiming to mitigate vulnerabilities associated with fingerprint sensors. However, researchers uncovered a novel method that could potentially bypass SDCP protections, enabling
adversary-in-the-middle (AitM) attacks.


ELAN Sensor Flaw

 

The ELAN sensor, lacking SDCP support, was identified as vulnerable to a combination of sensor spoofing and the cleartext transmission of security identifiers (SIDs). These cyber threats to authentication allow any USB device to impersonate the fingerprint sensor, falsely indicating that an authorized user is logging in.


Synaptics And TLS


In the case of Synaptics, SDCP was found to be turned off by default. Additionally, the implementation relied on a flawed custom Transport Layer Security (TLS) stack to secure USB communications between the host driver and sensor. This flaw could be exploited to circumvent biometric authentication.


Goodix Sensor Exploitation


Exploiting the
Goodix sensor involves taking advantage of a fundamental difference in enrollment operations between Windows and Linux. The attack process includes booting to Linux, enrolling an attacker’s fingerprint, and manipulating the connection between the host and sensor. This manipulation allows the attacker to log in as a legitimate user with their own fingerprint.


Authentication Exploit Prevention


To address these vulnerabilities, it is recommended that original equipment manufacturers (OEMs) enable SDCP and subject fingerprint sensor implementations to audits by independent qualified experts. This proactive approach can significantly reduce the risk of unauthorized access and enhance the overall security posture of laptops. Implementing
authentication best practices is paramount to creating a robust defense mechanism against evolving cyber threats


Historical Context


It’s important to note that this isn’t the first instance of Windows Hello biometrics facing security challenges. In
July 2021, Microsoft released patches for a medium-severity security flaw (CVE-2021-34466, CVSS score: 6.1) that could potentially allow an adversary to spoof a target’s face and bypass the login screen. The proactive adoption of multi-factor authentication security emerges as a crucial imperative in fortifying digital defenses


Researchers’ Insight


While acknowledging Microsoft’s efforts in designing SDCP to establish a secure channel, the researchers highlight a gap in understanding among device manufacturers regarding its objectives. Furthermore, they underscore that SDCP covers only a narrow scope of a device’s operation, leaving a considerable attack surface exposed. The imperative lies in proactively fortifying
security measures to thwart potential breaches by exploiting authentication vulnerabilities, ensuring a resilient defense against evolving cyber threats.


Conclusion


In conclusion, the recent revelations about vulnerabilities in fingerprint
authentication security

on popular laptop models underscore the advancements in cybersecurity risks and the critical need for enhanced security measures for authentication. By addressing these vulnerabilities through the implementation of SDCP and rigorous independent audits, OEMs can fortify the integrity of fingerprint sensor systems. As technology evolves, ongoing collaboration between researchers, manufacturers, and cybersecurity experts remains paramount to staying one step ahead of potential threats.

The sources for this piece include articles in The Hacker News and The Verge

Summary
 Hello Authentication Vulnerabilities Discovered: Stay Safe
Article Name
Hello Authentication Vulnerabilities Discovered: Stay Safe
Description
Explore effective strategies to safeguard against Hello Authentication vulnerabilities. Learn how to protect your systems. Stay secure!
Author
Publisher Name
TuxCare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Become a TuxCare Guest Writer

Mail

Help Us Understand
the Linux Landscape!

Complete our survey on the state of Open Source and you could win one of several prizes, with the top prize valued at $500!

Your expertise is needed to shape the future of Enterprise Linux!