Developing a Secure Fingerprint Authentication Bypass for Microsoft Windows Hello – Research

Findings Presented at Microsoft’s BlueHat Conference Reveal Vulnerabilities in Windows Hello Authentication

Security researchers from Blackwing Intelligence have identified potential exploits that could allow attackers to bypass Windows Hello authentication. The vulnerabilities were uncovered in popular laptop models such as Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X. The research specifically highlights flaws in the fingerprint sensors manufactured by Goodix, Synaptics, and ELAN. These vulnerabilities could be exploited by attackers to circumvent the Windows Hello login process, posing potential security risks for users of affected devices.

Significant Security Flaws Discovered in Windows Hello Fingerprint Verification

Cybersecurity firm Blackwing Intelligence has unveiled critical security vulnerabilities affecting the Windows Hello fingerprint identity verification feature on laptops from Dell, Lenovo, and Microsoft. Commissioned by Microsoft’s Offensive Research and Security Engineering (MORSE) to assess the security of fingerprint sensors, Blackwing Intelligence presented its findings at Microsoft’s BlueHat conference. The vulnerabilities pertain to fingerprint sensors sourced from Goodix, Synaptics, and ELAN.

Exposing the Vulnerabilities Blackwing Intelligence researchers delved into both software and hardware aspects, discovering crucial flaws in Synaptics’ cryptographic implementation of a custom TLS protocol. They devised a USB device capable of executing a man-in-the-middle (MitM) attack, potentially providing unauthorized access to a stolen laptop or enabling an attack on an unguarded device. Windows Hello protection could be bypassed on devices like Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X, provided the fingerprint reader had been previously used for user authentication.

A History of Security Challenges This isn’t the first time Windows Hello biometric verification has faced compromise. In 2021, Microsoft grappled with a vulnerability allowing authentication bypass via a recorded infrared image of a victim’s face. Despite such concerns, Microsoft reported three years ago that nearly 85% of consumers were using Windows Hello instead of passwords, underlining the widespread reliance on this technology.

Issues with Secure Device Connection Protocol (SDCP) While Microsoft’s Secure Device Connection Protocol (SDCP) aims to secure fingerprint sensors, researchers noted that device manufacturers often misinterpret its goals. Additionally, SDCP covers only a limited part of a device’s functionality, creating a substantial potential attack surface. In the attack test, researchers found that SDCP protection was not enabled in two out of the three devices, heightening the exposure to vulnerabilities.

Guidance for OEM Manufacturers Blackwing Intelligence recommends that Original Equipment Manufacturers (OEMs) ensure SDCP is enabled and have the fingerprint sensor application reviewed by a specialized expert. The cybersecurity firm is also exploring potential memory corruption attacks in sensor firmware and evaluating the security of fingerprint sensors on Linux, Android, and Apple devices. This research underscores the ongoing imperative for stringent security testing and enhancements in the realm of biometric authentication.