Your Laptop’s Fingerprint Lock Can Be Hacked. How Hackers Exploit Fingerprint Sensors Flaws

Multiple vulnerabilities have been found in the fingerprint sensors of Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops, which can be exploited to bypass Windows Hello authentication. These vulnerabilities were identified by researchers at Blackwing Intelligence in the sensors from Goodix, Synaptics, and ELAN. The key findings include:

1. Match on Chip Sensors: These sensors, which integrate matching and biometric management functions, do not prevent a malicious sensor from spoofing a legitimate sensor’s communication, falsely claiming an authorized user has authenticated​​​​. Example: Imagine a scenario where an attacker has physical access to a laptop with a MoC sensor. The attacker connects a malicious device that mimics the communication pattern of a legitimate fingerprint sensor. The laptop, unable to distinguish between the malicious and legitimate sensor, accepts the spoofed communication. This results in the laptop being unlocked even though no authorized fingerprint was actually provided
2. ELAN Sensor Exploit: This sensor is vulnerable due to a lack of Secure Device Connection Protocol (SDCP) support and cleartext transmission of security identifiers. This allows any USB device to impersonate the fingerprint sensor​​.Example: In this case, an attacker targets a laptop with an ELAN sensor that doesn’t support the Secure Device Connection Protocol (SDCP) and transmits data in cleartext. The attacker can use a custom USB device to act as a fake fingerprint sensor. When the user tries to log in, this fake sensor sends a signal that an authorized fingerprint has been recognized, tricking the system into granting access.
3. Synaptics Sensor Exploit: The vulnerability here arises from SDCP being turned off by default and a flawed custom Transport Layer Security stack used for USB communications, which can be manipulated to bypass biometric authentication​​. Example: Consider a situation where a laptop with a Synaptics sensor has its SDCP feature turned off by default. The attacker discovers this and decides to exploit the flawed custom TLS stack that secures the USB communication between the sensor and the host. By intercepting and manipulating this communication, the attacker can bypass the fingerprint authentication, allowing unauthorized access to the laptop.
4. Goodix Sensor Exploit: This involves exploiting differences in enrollment operations on systems with both Windows and Linux. It includes booting to Linux, enumerating valid IDs, enrolling an attacker’s fingerprint, and then using a man-in-the-middle attack to log in to Windows with the attacker’s print​​.Example: An attacker finds a laptop that dual-boots Windows and Linux and uses a Goodix sensor. The attacker boots into Linux, where SDCP is not supported, and then enrolls their own fingerprint under the same ID as a legitimate Windows user. Next, they perform a man-in-the-middle (MitM) attack on the USB communication between the host and sensor. When booting back into Windows, the attacker uses their own fingerprint to log in, exploiting the fact that the system points to the Linux database where the attacker’s fingerprint is registered as a valid user.

To mitigate these vulnerabilities, it is recommended that original equipment manufacturers enable SDCP and have the fingerprint sensor implementation audited by independent experts.

Secure Device Connection Protocol (SDCP) is a security feature designed by Microsoft to enhance the security of peripheral devices, like fingerprint sensors, that connect to a computer system. The primary purpose of SDCP is to establish a secure, authenticated channel between the device (such as a fingerprint sensor) and the host system (like a laptop or a PC). This protocol is particularly relevant in the context of biometric authentication systems, such as Windows Hello.

Here are key aspects of SDCP:

1. End-to-End Encryption: SDCP ensures that the data transmitted between the sensor and the host system is encrypted. This encryption prevents attackers from intercepting and reading the data, which could include sensitive biometric information.
2. Authentication: It authenticates the peripheral device to the host system, confirming that the device is legitimate and hasn’t been tampered with. This is crucial in preventing scenarios where a malicious device could pose as a legitimate biometric sensor.
3. Integrity Checks: SDCP likely includes mechanisms to ensure the integrity of the data being transmitted. This means that any tampering or alteration of the data during transmission can be detected.
4. Protection Against Replay Attacks: By ensuring that each communication session is unique and authenticated, SDCP helps protect against replay attacks, where an attacker tries to reuse valid data transmission to gain unauthorized access.

In the context of the vulnerabilities found in the fingerprint sensors of certain laptops, the lack of SDCP support or improper implementation of SDCP could allow attackers to exploit these weaknesses. For example, without SDCP, an attacker could potentially intercept the communication between the fingerprint sensor and the host system, manipulate it, and gain unauthorized access. Enabling and correctly implementing SDCP is thus a critical recommendation for mitigating such vulnerabilities.