Windows Hello is designed to enhance the security of Windows PCs with fingerprint or facial recognition authentication. However, security researchers have managed to bypass the former on computers from Dell, Lenovo, and Microsoft.
A flaw to bypass Windows Hello with the fingerprint
Security researchers at Blackwing Intelligence have discovered multiple vulnerabilities in the three main fingerprint sensors built into laptops, widely used by businesses to secure PCs with Windows Hello’s fingerprint authentication.
Microsoft’s Offensive Research and Security Engineering (MORSE) service requested Blackwing Intelligence to assess the security of fingerprint sensors. The researchers presented their findings at Microsoft’s BlueHat conference. The team identified popular fingerprint sensors from Goodix, Synaptics, and ELAN as targets for their research. The process involves using a USB device capable of performing a man-in-the-middle (MitM) attack. Such an attack provides access to a stolen laptop or even an “evil maid” attack on an unmonitored device.
Blackwing Intelligence’s security researchers were able to understand how Windows Hello works, both at the software and hardware levels. They discovered flaws in the cryptographic implementation of custom TLS on the Synaptics sensor. The complex process of bypassing Windows Hello also involves decoding, and a fix is not certain.
Can we expect a fix from Microsoft? It’s uncertain.
The researchers point out, however, that Microsoft has done a good job with the Secure Device Connection Protocol (SDCP) “to provide a secure channel between the host and biometric devices, but unfortunately, device manufacturers seem to misunderstand some of the goals.”
The researchers found that Microsoft’s SDCP protection was not enabled on two of the three devices they targeted (Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X). Blackwing Intelligence, therefore, recommends that manufacturers ensure that SDCP protection is enabled and that the implementation of the fingerprint sensor is verified by a qualified expert.
This isn’t the first time Windows Hello has been bypassed. It had already happened in 2021, involving an infrared image of a victim to spoof Windows Hello’s facial recognition feature, reimplementing proprietary protocols.
We do not support or promote any form of piracy, copyright infringement, or illegal use of software, video content, or digital resources.
Any mention of third-party sites, tools, or platforms is purely for informational purposes. It is the responsibility of each reader to comply with the laws in their country, as well as the terms of use of the services mentioned.
We strongly encourage the use of legal, open-source, or official solutions in a responsible manner.
Comments