Passwordless Future Under Threat? Researchers Hack Fingerprint Security

Researchers from two research labs have found a way to brute-force fingerprints, exploiting two zero-day vulnerabilities and hijacking fingerprint images on the sensor’s Serial Peripheral Interface to infer matching results. The attack achieved both fingerprint-image eavesdropping and replacement, and the shortest time to unlock a smartphone without prior knowledge about the victim is estimated at 40 minutes. While concerns about password security and password-related data breaches drive the adoption of passwordless technology such as biometrics and security keys, this proof-of-concept throws some cold water on the popular smartphone security method as organizations begin passwordless implementations.

According to a new report from the Cybersecurity and Infrastructure Security Agency (CISA), more than half of all cyberattacks on government agencies, critical infrastructure organizations, and state-level government bodies involved using valid accounts. The report also noted that threat actors completed their most successful attacks via common methods, such as phishing and using default credentials.

The passwordless future was never going to come without issues.      I’m encouraged to see researchers continuing their efforts and note that this attack requires physical access.    Physical access should always be viewed as a compromise.     It’s why I coupled the two data points – a reminder that the common way is phishing and default credentials.    No reason to panic here.