Tech Support
Documentation
Login
Contact Us
Hello Authentication Vulnerabilities Discovered: Stay Safe
Wajahat Raja
December 7, 2023 - TuxCare expert team
In the realm of cybersecurity, a recent study has brought to light a series of Hello Authentication vulnerabilities that could compromise the Windows Hello authentication on popular laptop models, including Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X. Conducted by researchers at Blackwing Intelligence, a firm specializing in hardware and software product security, these findings underscore potential security risks associated with fingerprint sensors from Goodix, Synaptics, and ELAN integrated into these devices. This blog delves into the details of Hello Authentication flaws, as well as the mitigation measures advised.
The Nature of Hello Authentication Vulnerabilities
The fingerprint sensors in question, categorized as “match on chip” (MoC), house both matching and biometric management functions within their integrated circuits. Despite MoC’s ability to prevent the replay of stored fingerprint data, it falls short in preventing a malicious sensor from mimicking a legitimate sensor’s communication with the host. This could lead to false claims of successful user authentication.
Vulnerability Assessment
Researchers Jesse D’Aguanno and Timo Teräs emphasize that while MoC prevents certain exploits, it does not address the possibility of a malicious sensor falsely asserting an authorized user’s successful authentication. Moreover, MoC fails to prevent the replay of previously recorded traffic between the host and sensor, leaving room for exploitation.
The Role of Secure Device Connection Protocol (SDCP)
Microsoft introduced the Secure Device Connection Protocol (SDCP) to establish an end-to-end secure channel, aiming to mitigate vulnerabilities associated with fingerprint sensors. However, researchers uncovered a novel method that could potentially bypass SDCP protections, enabling adversary-in-the-middle (AitM) attacks.
ELAN Sensor Flaw
The ELAN sensor, lacking SDCP support, was identified as vulnerable to a combination of sensor spoofing and the cleartext transmission of security identifiers (SIDs). These cyber threats to authentication allow any USB device to impersonate the fingerprint sensor, falsely indicating that an authorized user is logging in.
Synaptics And TLS
In the case of Synaptics, SDCP was found to be turned off by default. Additionally, the implementation relied on a flawed custom Transport Layer Security (TLS) stack to secure USB communications between the host driver and sensor. This flaw could be exploited to circumvent biometric authentication.
Goodix Sensor Exploitation
Exploiting the Goodix sensor involves taking advantage of a fundamental difference in enrollment operations between Windows and Linux. The attack process includes booting to Linux, enrolling an attacker’s fingerprint, and manipulating the connection between the host and sensor. This manipulation allows the attacker to log in as a legitimate user with their own fingerprint.
Authentication Exploit Prevention
To address these vulnerabilities, it is recommended that original equipment manufacturers (OEMs) enable SDCP and subject fingerprint sensor implementations to audits by independent qualified experts. This proactive approach can significantly reduce the risk of unauthorized access and enhance the overall security posture of laptops. Implementing authentication best practices is paramount to creating a robust defense mechanism against evolving cyber threats
Historical Context
It’s important to note that this isn’t the first instance of Windows Hello biometrics facing security challenges. In July 2021, Microsoft released patches for a medium-severity security flaw (CVE-2021-34466, CVSS score: 6.1) that could potentially allow an adversary to spoof a target’s face and bypass the login screen. The proactive adoption of multi-factor authentication security emerges as a crucial imperative in fortifying digital defenses
Researchers’ Insight
While acknowledging Microsoft’s efforts in designing SDCP to establish a secure channel, the researchers highlight a gap in understanding among device manufacturers regarding its objectives. Furthermore, they underscore that SDCP covers only a narrow scope of a device’s operation, leaving a considerable attack surface exposed. The imperative lies in proactively fortifying security measures to thwart potential breaches by exploiting authentication vulnerabilities, ensuring a resilient defense against evolving cyber threats.
Conclusion
In conclusion, the recent revelations about vulnerabilities in fingerprint authentication security
on popular laptop models underscore the advancements in cybersecurity risks and the critical need for enhanced security measures for authentication. By addressing these vulnerabilities through the implementation of SDCP and rigorous independent audits, OEMs can fortify the integrity of fingerprint sensor systems. As technology evolves, ongoing collaboration between researchers, manufacturers, and cybersecurity experts remains paramount to staying one step ahead of potential threats.
The sources for this piece include articles in The Hacker News and The Verge.
