Reversing a Fingerprint Reader Protocol (2021)

(blog.th0m.as)

65 points | by thejj100100 5 days ago

7 comments

  • JJJollyjim 2 days ago
    As noted in the article I reversed the protocol for a related Goodix device (which was on Intel so used actual SGX instead of the white-box): I used the firmware update system to insert additional vulnerabilities in the sensor firmware and extract the PSK from that side.

    I did a talk about it here: https://www.youtube.com/watch?v=IyjUY-xvFw4

  • Liftyee 2 days ago
    Damn, I always thought that the fingerprint data was encoded somehow and never left the sensor hardware itself! OS-level access to the imagery seems like a security risk, but also opens some interesting possibilities for alternative uses.
    • jeroenhd 1 day ago
      AFAIK it depends per reader. This one seems to be a weird webcam on steroids, but others do the matching locally.

      IIRC, none of them do it particularly securely.

      • cinntaile 1 day ago
        What's the security status of fingerprints on phones? Surely they don't leave the security chip? I hope?
        • jeroenhd 1 hour ago
          AFAIK many phones store the fingerprints on-chip. I haven't looked too deeply into it, though, so it's possible there's a brand out there that streams fingerprint information as a video.

          On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted.

          On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.

        • maxhille 1 day ago
          I don't think fingerprints should be regarded as a secret.
          • ta8645 1 day ago
            Can you please post a link to high quality images of your own fingerprints? It should be fine, probably nobody has the technology to make them show up on a threatening letter mailed to the government, or anything like that.
            • maxhille 1 day ago
              Of course I won't, but then again I would send you pictures of any other body parts the same.

              If someone gets a hand on anything you touched, they have your fingerprint. Last time you traveled to another country - did you have to give them fingerprints? Is the software running your phone closed source? Could you ambush me at night near my house and forcefully take them?

              All I am saying is they are so weak as a secret that rhey should not be regarded as one.

  • th0mas 1 day ago
    Author here, didn't expect to see this on HN today! If you've got any questions, shoot!
  • mrheosuper 1 day ago
    > It then proceeds to generate a new, random, PSK and sends it to the device. This represents a trust-on-first-use security model.

    Wow, i expect them using hardcoded PSK, with PSK is flashed in factory.

  • ge96 1 day ago
    The real work ha underneath the software eg. I can't write a camera driver but thankfully someone else can

    That's cool the raw data image GIMP

  • johnflan 1 day ago
    I didn't follow the byte ordering of the image format at the end. Anyone have an explanation?
  • abstractspoon 5 days ago
    Excellent