'investigating' claims of fingerprint hack on Galaxy S5
Samsung is “investigating” claims from security researchers that hackers can steal copies of fingerprints from the company’s 2014 flagship Galaxy S5 smartphone, as well as other Android devices, by exploiting a weakness in the operating system’s handling of biometric data.
According to security firm FireEye, Android fails in its attempts to render fingerprint information inaccessible to most apps by sequestering it in a “secure zone” on the phone. The flaw is simple: rather than trying to break into the secure zone itself, the attackers simply focus on reading the data coming directly from the fingerprint sensor before it reaches the secure zone.
With this information, it’s possible to reconstruct the fingerprint, and potentially use it elsewhere, the researchers told Forbes’ Thomas Fox-Brewster.
“If the attacker can break the kernel, although he cannot access the fingerprint data stored in the trusted zone, he can directly read the fingerprint sensor at any time. Every time you touch the fingerprint sensor, the attacker can steal your fingerprint,” one of the researchers, Yulong Zhang, told Forbes. “You can get the data, and from the data you can generate the image of your fingerprint. After that you can do whatever you want.”
The vulnerability is fixed on the newest version of Android, Lollipop – which runs on newer devices, including the Galaxy S6 – and users who can upgrade should. As well as Samsung, some – but not all – other Android devices running versions earlier than Lollipop are affected, though the Galaxy S5 was the only one named. Samsung says it “takes consumer privacy and data security very seriously” and is investigating FireEye’s claims, which are due to be revealed in more detail at the upcoming RSA security conference.
Apple’s TouchID system, present on the iPhone 5s and iPhones 6, uses a similar trusted zone architecture, but no attacker has yet demonstrated the ability to lift fingerprints off the device using a software hack. The fingerprint sensor has, however, been shown to be vulnerable to spoofed fingerprints: a fake fingerprint, printed onto a laminated sheet and stuck to a real finger, can fool the fingerprint sensor.
Of course, stealing a fingerprint through a software hack may not be the easiest way to bypass biometric security: in December, a hacker demonstrated the ability to spoof a German minister’s fingerprints from just a photograph of her hand.
This can a be reason for fall of s5 sales .but samsung is on working on the solution for this.
TILL THEN STAY TUNED
sourc:the white rabbit
image sourcs;the white rabbit
writter:Ravi Kant Verma,Andy martin(geek.inc)
No comments:
Post a Comment