Security researchers in Blackwing Intelligencea provider of security research and engineering services, and Offensive research and security engineering (Morse), from Microsoft,test Fingerprint sensors used in Windows Hello On three popular laptops, and on each device they managed to find a way to do this Bypass authentication.
The three laptops used in the investigation were the same Dale INespiron 15 With Goodix fingerprint sensor, a Lenovo ThinkPad T14s With Synaptics sensor, and Microsoft Surface Pro With ELAN sensor.
Both embedded and host fingerprint sensors have been targeted by software and hardware attacks. All of the sensors tested are Match-on-Chip, meaning the chip contains a microprocessor and memory, and the fingerprint data never leaves the sensor. In this way, the chip itself must be attacked to bypass authentication.
Furthermore, the attack requires physical access to the target device, which means the attacker would need to steal equipment or resort to the “evil maid” method.
The attacks tested by security researchers were carried out by connecting the hacking device to laptops, via USB or by connecting the fingerprint sensor to specially created equipment.
In testing on Dell and Lenovo laptops, Windows Hello fingerprint authentication was bypassed by enumerating valid IDs associated with the user’s fingerprint and recording the attacker’s fingerprint, legally impersonating the user.
In the case of the Surface, the attacker needed to detach the Type Cover — which is essentially the keyboard and which includes the fingerprint sensor — and plug in a USB device that could mimic the fingerprint sensor, instructing the system that an authorized user was signing up. in.
“Friendly zombie fanatic. Analyst. Coffee buff. Professional music specialist. Communicator.”
