Well this is quite scary as biometrics are touted as the ultimate in security and two factor authentication with biometrics is about as ‘heavy’ as most places get.
The fact that the biometric data can be ‘sniffed’ reconstructed and re-used…is worrying to say the least. Do any of you have biometric measures in your workplace?
A British researcher has developed a biometric keylogger of sorts that can capture fingerprints required to unlock building doors or gain access to computer networks or other restricted systems.
For now, the Biologger is a proof-of-concept aimed at showing the insecurity of many biometric systems, according to Matthew Lewis, who demonstrated the tool at last month’s Black Hat Amsterdam conference. But the researcher, who works for Information Risk Management, warns the attack could become commonplace if current practices don’t change and could be used to log images of retinas, facial features and any other physical characteristics used by biometric systems.
“Biometric device manufacturers and system integrators cannot rely on security through obscurity alone for the overall security of their devices and systems,” he writes in this white paper (PDF). “Without adequate protection of the confidentiality, integrity and availability of biometric access control devices and their data, the threat of “Biologging” activities within those enterprises employing such access controls is real.”
An interesting read, and yes it seems ‘biologging’ is a real threat. A lot of these system designers and integrators/implementers don’t really have a grip on architecture security.
They just assume biometrics = safe and disregard how it’s implement, how safe the data is, how it’s stored and what state it’s in during transit (unencrypted?).
Lewis was also able to issue commands to the access control device that enabled him to unlock doors and add new users with full administrative rights without presenting a fingerprint. That’s because the device needed a single 8-byte message that passed over the network in plaintext. Although he was never able to crack a 2-byte checksum used for issuance of each message, he was able to overcome this limitation by taking a brute-force approach, in which every possible combination of checksums was used.
There are other limitations to Lewis’s attack. For one, it requires attackers to have privileged access to the network connecting the access point to the server. Another is that the traffic was transmitted using the user datagram protocol, which rendered the brute-force attempts “not 100% reliable.”
But his point seems to be that, just as best practices require that passwords are never stored in the clear, fingerprints and other biometric data should likewise be encrypted. Architects designing the next generation of biometric systems, are you listening?
I hope they are listening, and they sort it out!
Source: The Register