HTC and Samsung have patched serious vulnerabilities in some of their Android phones that made it possible for malicious hackers to steal user fingerprints. The researchers who discovered the flaws said that many more phones from all manufacturers may be susceptible to other types of fingerprint-theft attacks.
The most serious of the flaws was found on HTC’s One Max handset. According to researchers at security firm FireEye, the device saved user fingerprints as an unencrypted file. Almost as bad, the BMP image was readable by any other running application or process. As a result, any unprivileged process or app could obtain a user’s fingerprints by reading the file. Attackers could capitalize on the weakness by exploiting one of the many serious vulnerabilities that regularly crop up in Android or by tricking a target into installing a malicious app. HTC fixed the issue after FireEye privately reported it, according to this summary, which didn’t provide a date or other details of the update.
A separate flaw found in both the HTC One Max and Samsung Galaxy S5 phones also put user fingerprints at risk by exposing the sensor to attackers. Consensus among security professionals is that the sensor should invoke the TrustZone protections provided by ARM chips the phones run. TrustZone allows sensitive operations to be isolated from the rest of the operating system in much the way that classified information belonging to governments isn’t stored or transmitted over unclassified systems. FireEye researchers said most manufacturers fail to use the feature to protect the sensor operations.
“Without the proper lock-down, the attacker from the normal world can directly read the fingerprint sensor,” they wrote. “Note that attackers can do this stealthily in the background and they can keep reading the fingerprints on every touch of the victim’s fingers. This also indicates that attackers with remote code execution exploits can remotely harvest everyone’s fingerprints in a large scale, without being noticed.”
Once the sensor is active, malware could continuously siphon fingerprints in the background. On some phones, the sensor is integrated into the home button, potentially making it possible to obtain prints each time someone touches the button. HTC, Samsung, and other unnamed manufacturers have provided patches for the issue.
Fingerprint readers came to Apple’s iPhone in 2013 and to Android handsets in 2014. Not only do they allow users to access their data and apps without having to enter a PIN or password, they also make it possible to make electronic purchases, potentially worth large sums of money. Almost immediately, hackers demonstrated ways to bypass the fingerprint locks on both platforms with only moderate skill and effort.
The threat of fingerprint theft raises even more unsettling possibilities than fingerprint lock bypasses. Not only could attackers use theft attacks to compromise victims’ phones and credit cards, but in the event that the unencrypted—or cryptographically unhashed—prints can be obtained, attackers would have the ability to collect large numbers of people’s biometric data. The best way that end users can protect themselves is to run a newer phone and choose a manufacturer or carrier that provides timely updates. Then users should diligently keep the handset updated. Handset developers, in turn, should work harder to make sure fingerprint sensors and storage take advantage of protections provided by TrustZone.