Skip to main content

New BrutePrint Attack Lets Attackers Unlock Smartphones with Fingerprint Brute-Force.


By THN.

Researchers have discovered an inexpensive attack technique that could be leveraged to brute-force fingerprints on smartphones to bypass user authentication and seize control of the devices.
The approach, dubbed BrutePrint, bypasses limits put in place to counter failed biometric authentication attempts by weaponizing two zero-day vulnerabilities in the smartphone fingerprint authentication (SFA) framework.
The flaws, Cancel-After-Match-Fail (CAMF) and Match-After-Lock (MAL), leverage logical defects in the authentication framework, which arises due to insufficient protection of fingerprint data on the Serial Peripheral Interface (SPI) of fingerprint sensors.
The result is a "hardware approach to do man-in-the-middle (MitM) attacks for fingerprint image hijacking," researchers Yu Chen and Yiling He said in a research paper. "BrutePrint acts as a middleman between fingerprint sensor and TEE [Trusted Execution Environment]."
The goal, at its core, is to be able to perform an unlimited number of fingerprint image submissions until there is a match. It, however, presupposes that a threat actor is already in possession of the target device in question.
Additionally, it requires the adversary to be in possession of a fingerprint database and a setup comprising a microcontroller board and an auto-clicker that can hijack data sent by a fingerprint sensor to pull off the attack for as low as $15.

The first of the two vulnerabilities that render this attack possible is CAMF, which allows for increasing the fault tolerance capabilities of the system by invalidating the checksum of the fingerprint data, thereby giving an attacker unlimited tries.
MAL, on the other hand, exploits a side-channel to infer matches of the fingerprint images on the target devices, even when it enters a lockout mode following too many repeated login attempts.
"Although the lockout mode is further checked in Keyguard to disable unlocking, the authentication result has been made by TEE," the researchers explained.
"As Success authentication result is immediately returned when a matched sample is met, it's possible for side-channel attacks to infer the result from behaviors such as response time and the number of acquired images."
In an experimental setup, BrutePrint was evaluated against 10 different smartphone models from Apple, Huawei, OnePlus, OPPO, Samsung, Xiaomi, and vivo, yielding infinite attempts on Android and HarmonyOS, and 10 additional attempts on iOS devices.
The findings come as a group of academics detailed a hybrid side-channel that takes advantage of the "three-way tradeoff between execution speed (i.e., frequency), power consumption, and temperature" in modern system-on-chips (SoCs) and GPUs to conduct "browser-based pixel stealing and history sniffing attacks" against Chrome 108 and Safari 16.2.
The attack, called Hot Pixels, takes advantage of this behavior to mount website fingerprinting attacks and employ JavaScript code to harvest a user's browsing history.



This is accomplished by designing a computationally heavy SVG filter to leak pixel colors by measuring the rendering times and stealthily harvest the information with an accuracy as high as 94%.
The issues have been acknowledged by Apple, Google, AMD, Intel, Nvidia, Qualcomm. The researchers also recommend "prohibiting SVG filters from being applied to iframes or hyperlinks" and preventing unprivileged access to sensor readings.
BrutePrint and Hot Pixels also follow Google's discovery of 10 security defects in Intel's Trust Domain Extensions (TDX) that could lead to arbitrary code execution, denial-of-service conditions, and loss of integrity.

On a related note, Intel CPUs have also been found susceptible to a side-channel attack that makes use of variations in execution time caused by changing the EFLAGS register during transient execution to decode data without relying on the cache.

Comments

Popular posts from this blog

Escaped Murder Suspect Finally Arrested in Yumbe Regional Referral Hospital, Yumbe District.

Story by Osuta Yusuf. 19-November-2024. 📸: Eyotre Kennedy handcuffed on bed while receiving medication this morning at Yumbe Regional Referral Hospital in Yumbe District. Eyotre Kennedy originating from Etoko village, Nyoroo Parish, Nyadri Sub-county in Maracha District who has for many years been terrorizing residents in his village, has finally been arrested this Monday morning 19-November-2024 while receiving treatment at Yumbe Regional Referral Hospital in Yumbe District following injuries he sustained from Theft mission on Saturday night 16-November-2024 in Owapi village, Azapi parish in Odupi Sub-county, Terego East Constituency in Terego District. Click here on the link  https://informationispowah.blogspot.com/2024/11/fugitive-who-chopped-3-people-killed.html   to read the story on his Theft of Goats in Terego. Upon getting cut on the finger and leg by the Mob as he attempted to fight and overpower owner of the goats he attempted to steal on Saturday night ...

41-Years-Old Man Digs His Own Grave in Maracha District.

Story by Osuta Yusuf.  Maracha District.  📸: The grave been dug by Mr Opiga Michael, a victim of frustration. Photo taken by Osuta Yusuf , on Wednesday 11-September-2024. The residents of Ebapi village, Baria Parish in Nyadri Sub-county, Maracha east constituency, Maracha District are in shock after a 41 year old man started digging his own grave. The man, identified as Mr Opiga Michael, who seems to be frustrated over some challenges in life, started digging his own grave on Tuesday 10-September-2024 until he was stopped by the elders in Nyaria clan. 📸: Opiga Michael, the Victim of Frustration. Photo by Osuta Yusuf , Information is Power. While speaking to our reporter on Wednesday evening 11-September-2024, Mr Opiga Michael, said, his main plan  was to commit suicide after finishing digging the grave for burying himself, explained that, he feels frustrated, abandoned and hated by his own clan people, whom he accused of piling lies against him a...

Wedded Ayivu West MP Lematia John Fights Over Another Woman.

  📸: Hon Lematia John. By URN. Police in Arua district are investigating a case of assault and threatening violence involving the Member of Parliament for Ayivu West Constituency John Lematia and James Ariko, a DSTV technician in Arua city. Drama ensued on Easter Sunday 31-3-2024 at Dream Land Hotel located at Kuluva trading center along Arua-Nebbi highway in Arua district when the legislator and the technician engaged in a fight reportedly over a woman identified as Faith Eyotaru 25, a relationship officer at Victoria University Kampala. The scuffle started after Ayivu West Mp John Lematia went to swim at Dreamland Hotel with Faith Eyotaru only to find Ariko, who had gone to the same hotel earlier. However, upon seeing the duo coming out of the vehicle, Ariko confronted Lematia with both men claiming to be having a relationship with the lady. It took the intervention of the staff at the hotel who intervened and separated the fight between the men. Josephine Angucia, the West Nil...