Fingerprint Bypass using Frida and Objection techniques

[jesuscc1993]

(Copy-pasted from a third party report; probably can't clarify or provide more details. See "context" at the bottom for more info).

Description

The target android application does not implement secure local authentication thus allowing an attacker to bypass fingerprint authentication. The target app's biometric authentication implementations rely on the onAuthenticationSucceeded method being called, without interaction with the CryptoObject. This approach can be trivially exploited by hooking into the application process and directly calling onAuthenticationSucceeded method, as a result the application should be unlocked without providing valid biometrics.

Specifications

OS: Android 9

Device: Rooted Samsung Galaxy S8+

Recommendations

1. Create the Android keystore key with setUserAuthenticationRequired and setInvalidatedByBiometricEnrollment set to true. Additionally, setUserAuthenticationValidityDurationSeconds should be set to -1.
2. Initialize cipher object with keystore key created above.
3. Create BiometricPrompt.CryptoObject using cipher object from previous step.
4. Implement BiometricPrompt.AuthenticationCallback.onAuthenticationSucceeded callback which will retrieve cipher object from the parameter and use this cipher object to decrypt some other crucial data such as session key, or a secondary symmetric key which will be used to decrypt application data.
5. Call BiometricPrompt.authenticate function with crypto object and callbacks created in steps 3 and 4.

Reference

• https://developer.android.com/reference/android/hardware/biometrics/BiometricPrompt.CryptoObject.html#BiometricPrompt.CryptoObject(javax.crypto.Cipher)
• https://labs.f-secure.com/blog/how-secure-is-your-android-keystore-authentication
• https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication#testing-biometric-authentication-mstg-auth-8

Context on this issue

We've been reported this vulnerability on our RN app, but the issue is on this library. All the devs on the project are web devs (most just frontend, me included) and we have no native background, so it's been hard to address the issue. I tried applying the suggested steps (or as much as I could understand from them, rather), following this comment, but I get a javax.crypto.IllegalBlockSizeException and I have not been able to figure out how to get past that. I found some matches looking up the exception but I lack the basic knowledge required to even begin to understand them. I'll keep looking into this because we have to fix it, but I'm anything but hopeful.

[jesuscc1993]

It looks like the IllegalBlockSizeException might be a separate issue rising from setting

{
  accessControl: ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
  accessible: ACCESSIBLE.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY,
}

as keychain options when setting/getting the password, which was a change done to prevent a similar issue on iOS so you can ignore that bit for this ticket since it's not strictly related

[aaron23v]

Any update on this vulnerability?

[DorianMazur]

Hey @jesuscc1993

I believe this reported security issue is not valid for the current implementation. Here's why:

1. Proper CryptoObject Usage: This library uses KeygenParameterSpec.Builder with proper biometric authentication settings in CipherStorageKeystores:

if(requiresBiometricAuth) {
    keyGenParameterSpecBuilder.setUserAuthenticationRequired(true)
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
        keyGenParameterSpecBuilder.setUserAuthenticationParameters(
            validityDuration, KeyProperties.AUTH_BIOMETRIC_STRONG
        )
    } else {
        keyGenParameterSpecBuilder.setUserAuthenticationValidityDurationSeconds(
            validityDuration
        )
    }
}

2. Security Against the Reported Attack Vector: The library doesn't just rely on onAuthenticationSucceeded callback - it properly ties the biometric authentication to cryptographic operations using the Keystore. Even if an attacker hooks into the process and calls onAuthenticationSucceeded directly, they wouldn't be able to decrypt the data without proper cryptographic operations that require valid biometric authentication.

3. Strong Security Requirements: The code enforces strong biometric authentication:

promptInfoBuilder.setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)

[smjkrk]

Hey @DorianMazur, awesome work with the recent refactors 🙌 🚀

Just following on from this - With Android using BIOMETRIC_STRONG authenticators under the hood, is accessControl redundant on Android?

I've tried setting accessControl to both of the following with storage: AES_GCM:

accessControl: BIOMETRY_CURRENT_SET_OR_DEVICE_PASSCODE
accessControl: DEVICE_PASSCODE

But both times it only allows me to access the keystore with biometrics (there is no option to use the device pin).

[DorianMazur]

@smjkrk Thanks!

Yes. Currently it's not needed for Android when using cipherStorage, but it helps choose the best available cipherStorage on the device. I will soon add device passcode support and I will also create a documentation page explaining how this prop works.