IT Jobs
Biometric hack tool released
Current implementations not secure enough, says Brit expert.
By Matthew Broersma | Techworld
Published: 06:04 GMT, 02 April 08
A British security researcher has demonstrated a "biologging" system for intercepting biometric authentication data, warning that attacks on biometric systems could become relatively straightforward if current practices don't change.
Matthew Lewis, of London-based Information Risk Management, demonstrated a proof-of-concept biologger last week at Black Hat Amsterdam and released the tool's source code.
Biologger is designed to highlight what Lewis considers a defect in the design of many current biometric systems: the biometric data isn't encrypted between the biometric scanner and the processing server.
The tool identifies and captures such data, opening the way to exploits such as man-in-the-middle attacks, Lewis said.
A number of difficulties remain in carrying out an attack, not the least of which would be inserting the biologger into the network, Lewis said. However, Lewis' point was to highlight that such dangers exist.
"Organisations across a number of different sectors are beginning to implement biometric systems as part of their physical and logical access controls, while a number of these systems and devices are configured to integrate with existing infrastructures for ease of deployment, such as through the use of IP protocols," Lewis said in a recent white paper on biologging. "It is properties such as this that we seek to explore and exploit as part of a proof of concept construction of a biologger."
The tool can be configured for sniffing biometric devices in a domain, as an inline wire tap or proxy device, for ARP poisoning, or as a memory-resident keylogger on a host, according to Lewis' presentation.
While Lewis' current research focuses on fingerprint systems, he said the same techniques could be carried out against biometric modes such as face and iris recognition access control systems.
Lewis said his aim was not to discourage the use of biometric access control systems, but to encourage their secure design.
"Biometric device manufacturers and system integrators cannot rely on security through obscurity alone for the overall security of their devices and systems," he said in the white paper.
He said that where IP networks are involved, particularly, those deploying biometric systems should identify network traffic routing and the accessibility of biometric-related data on those networks.
Encryption of all biometric, user and control data between devices and management servers could mitigate most of the issues identified in the presentation, Lewis said.
Robust authenticated sessions between devices and servers would also improve the systems, he said.
Add your commentComments
Phil Griffin | Published: 12:56 GMT, 04 April 2008
The X9.84 and ISO 19092 standards define digital signature, encryption and other safeguards for the protection of biometric information. These have been available to vendors for years.
Phil Griffin | Published: 12:55 GMT, 04 April 2008
The X9.84 and ISO 19092 standards define digital signature, encryption and other safeguards for the protection of biometric information. These have been available to vendors for years.
Jeff Stapleton | Published: 15:19 GMT, 03 April 2008
As the chair of the X9F4 working group (www.x9.org) who developed the American National Standard X9.84 Biometric Information Management and Security for the Financial Services Industry, originally published in 2001 and revised in 2003, and coordinated the development of ISO 19092 Financial Services — Biometrics — Security framework published in 2008 (www.iso.org), I applaud the efforts at Black Hat, but also advise that these standards and the working group participatns have advocated digital si
Mohammed Thiab - InfoSec Expert | Published: 15:37 GMT, 02 April 2008
I was involved in biometrics since 2001 and since that time it was a requirement to have encryption capability as the requester/initiator side where the scanning device is. A digital file is usually produced by the client station which has the biometric device and this digital file is encrypted before it is sent over the Internet to the authentication server and on to the transaction processing server.