Zack Whittaker, writing for ZDNet:
The attack, which was confirmed on the HTC One Max and Samsung’s Galaxy S5, allows a hacker to stealthily acquire a fingerprint image from an affected device because device makers don’t fully lock down the sensor.
Making matters worse, the sensor on some devices is only guarded by the “system” privilege instead of root, making it easier to target. (In other words: rooting or jailbreaking your phone can leave you at a greater risk.) Once the attack is in place, the fingerprint sensor can continue to quietly collect fingerprint data on anyone who uses the sensor.
“In this attack, victims’ fingerprint data directly fall into attacker’s hand. For the rest of the victim’s life, the attacker can keep using the fingerprint data to do other malicious things,” Zhang said. And that’s a big problem. Fingerprints might be commonplace in mobile payments and unlocking devices, but they have been used more in the past five years also for identity, immigration, and for criminal records.
Sigh. If this is true, let’s hope the manufacturers are paying attention.
Well, that also stinks for Apple because they will probably also (unfairly) get painted by the same brush. Any impression the public gets that fingerprint security is less than secure is bad news.
Until said public finds out that fingerprints on Apple devices are not retrievable. Then Apple will benefit.
Unlikely the public actually will find that out. All they hear is, “fingerprint security not secure.” They don’t listen to the details. Remember all the hooplah about TouchID when it first launched? A whole lot of paranoia about it, over simple spoofing techniques.
“Affected vendors have since provided patches after being alerted by the researchers.”
From the article.
I love how everybody talked about TouchID (in)security, while I can’t remember ever seeing a post about how fingerprints are stored on Android phones (which lack all that “secure enclave”-stuff).
why did they need to be alerted by the researchers? surely they understood the limitations of their own implementation… Apple does, why don’t they?
The point is they were actually steal-able. THAT’S the issue and why Android is so bad!
Like lacking dual factor authentication on iCloud, despite warnings from researchers, until there was a high profile breach?