Fingerprint Keylogger
A British researcher has developed a biometric keylogger of sorts that can capture fingerprints required to unlock building doors or gain access to computer networks or other restricted systems.
For now, the Biologger is a proof-of-concept aimed at showing the insecurity of many biometric systems, according to Matthew Lewis, who demonstrated the tool at last month’s Black Hat Amsterdam conference. But the researcher, who works for Information Risk Management, warns the attack could become commonplace if current practices don’t change and could be used to log images of retinas, facial features and any other physical characteristics used by biometric systems.
“Biometric device manufacturers and system integrators cannot rely on security through obscurity alone for the overall security of their devices and systems,” he writes in this white paper (PDF). “Without adequate protection of the confidentiality, integrity and availability of biometric access control devices and their data, the threat of “Biologging” activities within those enterprises employing such access controls is real.”
The unspecified access control device used in Lewis’s demonstration didn’t bother to encrypt data before sending it to back-end servers, making it ripe for interception by a man-in-the-middle laptop that logged all traffic passing between the two devices. The researcher was able to construct an image of a fingerprint by subjecting portions of the captured data to an algorithm designed to graphically identify image data and resolution.
“The result of such a finding to attackers could be significant,” Lewis wrote. “If a good quality image can be reconstructed, then it is conceivable that techniques described … could again be used to generate a 3D spoof finger of users that have obviously been registered with the system at some point.”
The research is the latest cautionary reminder that biometrics are by no means a panacea to the difficulty of verifying a person’s identity. Last week, a hacker club published what it said was the fingerprint of Wolfgang Schauble, Germany’s interior minister and an ardent supporter of storing a digital representation of citizen’s fingerprints in their passports. Schauble’s print was embossed on a sticky piece of plastic that can leave the print on coffee cups, telephones and biometric readers.
Lewis was also able to issue commands to the access control device that enabled him to unlock doors and add new users with full administrative rights without presenting a fingerprint. That’s because the device needed a single 8-byte message that passed over the network in plaintext. Although he was never able to crack a 2-byte checksum used for issuance of each message, he was able to overcome this limitation by taking a brute-force approach, in which every possible combination of checksums was used.
There are other limitations to Lewis’s attack. For one, it requires attackers to have privileged access to the network connecting the access point to the server. Another is that the traffic was transmitted using the user datagram protocol, which rendered the brute-force attempts “not 100% reliable.”
But his point seems to be that, just as best practices require that passwords are never stored in the clear, fingerprints and other biometric data should likewise be encrypted. Architects designing the next generation of biometric systems
source: http://dailyscooponline.blogspot.com/2008/04/coming-up-fingerprint-grabbing.html
Apr 3, 2008 at 5:17 PM /
[…] Last week, a hacker club published what it said was the fingerprint of Wolfgang Schauble, … MORE >>Creadit By weight […]