Biometric hack tool released

Biometric hack tool released
Biometric hack tool released 

By Matthew Broersma
02 April 2008

A British security researcher has demonstrated a "biologging" system for 
intercepting biometric authentication data, warning that attacks on 
biometric systems could become relatively straightforward if current 
practices don't change.

Matthew Lewis, of London-based Information Risk Management, demonstrated 
a proof-of-concept biologger last week at Black Hat Amsterdam and 
released the tool's source code.

Biologger is designed to highlight what Lewis considers a defect in the 
design of many current biometric systems: the biometric data isn't 
encrypted between the biometric scanner and the processing server.

The tool identifies and captures such data, opening the way to exploits 
such as man-in-the-middle attacks, Lewis said.

A number of difficulties remain in carrying out an attack, not the least 
of which would be inserting the biologger into the network, Lewis said. 
However, Lewis' point was to highlight that such dangers exist.

"Organisations across a number of different sectors are beginning to 
implement biometric systems as part of their physical and logical access 
controls, while a number of these systems and devices are configured to 
integrate with existing infrastructures for ease of deployment, such as 
through the use of IP protocols," Lewis said in a recent white paper on 
biologging. "It is properties such as this that we seek to explore and 
exploit as part of a proof of concept construction of a biologger."

The tool can be configured for sniffing biometric devices in a domain, 
as an inline wire tap or proxy device, for ARP poisoning, or as a 
memory-resident keylogger on a host, according to Lewis' presentation.

While Lewis' current research focuses on fingerprint systems, he said 
the same techniques could be carried out against biometric modes such as 
face and iris recognition access control systems.

Lewis said his aim was not to discourage the use of biometric access 
control systems, but to encourage their secure design.

"Biometric device manufacturers and system integrators cannot rely on 
security through obscurity alone for the overall security of their 
devices and systems," he said in the white paper.

He said that where IP networks are involved, particularly, those 
deploying biometric systems should identify network traffic routing and 
the accessibility of biometric-related data on those networks.

Encryption of all biometric, user and control data between devices and 
management servers could mitigate most of the issues identified in the 
presentation, Lewis said.

Robust authenticated sessions between devices and servers would also 
improve the systems, he said.

Subscribe to InfoSec News 

Site design & layout copyright © 1986-2015 CodeGods