Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Biometric hack tool released

Current implementations not secure enough, says Brit expert.

Article comments

A British security researcher has demonstrated a "biologging" system for intercepting biometric authentication data, warning that attacks on biometric systems could become relatively straightforward if current practices don't change.

Matthew Lewis, of London-based Information Risk Management, demonstrated a proof-of-concept biologger last week at Black Hat Amsterdam and released the tool's source code.

Biologger is designed to highlight what Lewis considers a defect in the design of many current biometric systems: the biometric data isn't encrypted between the biometric scanner and the processing server.

The tool identifies and captures such data, opening the way to exploits such as man-in-the-middle attacks, Lewis said.

A number of difficulties remain in carrying out an attack, not the least of which would be inserting the biologger into the network, Lewis said. However, Lewis' point was to highlight that such dangers exist.

"Organisations across a number of different sectors are beginning to implement biometric systems as part of their physical and logical access controls, while a number of these systems and devices are configured to integrate with existing infrastructures for ease of deployment, such as through the use of IP protocols," Lewis said in a recent white paper on biologging. "It is properties such as this that we seek to explore and exploit as part of a proof of concept construction of a biologger."

The tool can be configured for sniffing biometric devices in a domain, as an inline wire tap or proxy device, for ARP poisoning, or as a memory-resident keylogger on a host, according to Lewis' presentation.

While Lewis' current research focuses on fingerprint systems, he said the same techniques could be carried out against biometric modes such as face and iris recognition access control systems.

Lewis said his aim was not to discourage the use of biometric access control systems, but to encourage their secure design.

"Biometric device manufacturers and system integrators cannot rely on security through obscurity alone for the overall security of their devices and systems," he said in the white paper.

He said that where IP networks are involved, particularly, those deploying biometric systems should identify network traffic routing and the accessibility of biometric-related data on those networks.

Encryption of all biometric, user and control data between devices and management servers could mitigate most of the issues identified in the presentation, Lewis said.

Robust authenticated sessions between devices and servers would also improve the systems, he said.


More from Techworld

More relevant IT news


Phil Griffin said: The X984 and ISO 19092 standards define digital signature encryption and other safeguards for the protection of biometric information These have been available to vendors for years

Phil Griffin said: The X984 and ISO 19092 standards define digital signature encryption and other safeguards for the protection of biometric information These have been available to vendors for years

Jeff Stapleton said: As the chair of the X9F4 working group wwwx9org who developed the American National Standard X984 Biometric Information Management and Security for the Financial Services Industry originally published in 2001 and revised in 2003 and coordinated the development of ISO 19092 Financial Services Biometrics Security framework published in 2008 wwwisoorg I applaud the efforts at Black Hat but also advise that these standards and the working group participatns have advocated digital si

Mohammed Thiab - InfoSec Exper said: I was involved in biometrics since 2001 and since that time it was a requirement to have encryption capability as the requesterinitiator side where the scanning device is A digital file is usually produced by the client station which has the biometric device and this digital file is encrypted before it is sent over the Internet to the authentication server and on to the transaction processing server

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *