Biometrics Are Coming & So Are Security Concerns

Minimalist · Aug 20, 2019

Stolen fingerprints could spell the end of biometric security – here's how to save it

This breach highlights a major problem with biometric security systems that effectively use people's biological measurements as passwords. Unlike usernames and passwords, biometric data can't be changed if it is stolen.
Click to expand...

https://techxplore.com/news/2019-08-stolen-fingerprints-biometric.html

guest · Aug 21, 2019

Biostar 2: Suprema plays down fingerprint leak reports
August 21, 2019
https://www.bbc.co.uk/news/technology-49418931

Suprema's Biostar 2 program was accessed online by cyber-security researchers earlier this month.
Suprema said the access point had now been closed and an investigation had found the scope of the leak to be "significantly less" than reported.
'In-depth investigation'
"Last week, we were made aware that some BioStar 2 customer user data was accessed by third-party security researchers without authorisation for a limited period of time," the company said in a statement.
"Based on their investigation to date, they have confirmed that no further access has occurred and that the scope of potentially affected users is significantly less than recent public speculation."
Suprema added it was in the process of identifying affected parties and engaging with relevant regulators and authorities.
Click to expand...

guest · Sep 4, 2019

Brazil's consumer rights body slams use of biometrics in the social security system
September 3, 2019
https://www.zdnet.com/article/brazi...-of-biometrics-in-the-social-security-system/

The country's Social Security Technology and Information Company (Dataprev) is looking to introduce a mobile platform that integrates features including facial recognition technology in order to reduce fraud and simplify processes.
The technology will be used to replace procedures such as the "proof of life", whereby citizens, often elderly or with reduced mobility, have to physically attend a social security center or a bank branch to prove they are alive.

However, Idec wants Dataprev to address the "systematic data leaks that have been taking place for years" within the social security system. It added that the data belonging to over 34 million Brazilians, often vulnerable citizens, has been often used for fraud purposes and for credit agencies to offer their products illegally.

"It is unreasonable to implement technology that uses sensitive data without citizens being assured that such data will be treated securely and will not be leaked to companies that have abusive or even illegal practices," says Diogo Moyses, coordinator of Idec's Telecommunications and Digital Rights program.
Click to expand...

ronjor · Sep 9, 2019

Swedish GDPR Fine Highlights Legal Challenges in Use of Biometrics

By Kevin Townsend on September 09, 2019
A small fine of $20,000 in Sweden highlights a potential problem for the use of biometrics in security throughout Europe, including American firms with offices in Europe.
Click to expand...

hawki · Sep 17, 2019

"The Intelligence Community is Exploring Long-Range Biometric Identification...

A new Intelligence Advanced Research Projects Activity (IARPA) program aims to build biometric technology that can identify people using cameras stationed on far off rooftops and unmanned aircraft...

...the intelligence community is trying to overcome those limitations [of facial recognition] in two ways: gathering more extensive training data and creating systems that lean on multiple types of data to identify people...

On Friday, IARPA started looking for researchers to participate in Biometric Recognition and Identification at Altitude and Range, or BRIAR program,..

In the request for information, IARPA asked teams for a wide variety of datasets that could help train biometric technology to work in less than ideal conditions...

Specifically, IARPA asked for images of individuals taken from more than 300 meters away or at pitch angles above 20 degrees, as well as biometric research datasets captured by drones and other aircraft...

The program also aims to explore technologies that take in multiple types of biometric identifiers—such as face images, movement patterns, height and gender..."

https://www.nextgov.com/emerging-te...g-long-range-biometric-identification/159907/

guest · Sep 17, 2019

The Trouble With Biometric Authentication
September 16, 2019
https://www.itsecurityguru.org/2019/09/16/the-trouble-with-biometric-authentication/

The biometric market is expected to soar to nearly $33 billion by 2022 as the technology is heralded as a bulletproof solution to thwart hackers.
Unlike passwords and other authentication methods, biometrics are static, are not deterministic, are public-facing and to top it off, not all users have biometric capable devices.

Think about it; you can’t change your fingerprint or your face. If biometric information is exposed, then any account where you use this method of authentication is at risk, and there is no way to reverse the damage.
One recent example of a breach that exposed biometric information is Biostar 2, where the database was found unprotected and unencrypted.

Organizations should not be afraid to add biometrics to their security arsenal, but they must recognize that it’s not foolproof. To mitigate the risk, companies need to deploy a layered approach and utilize biometrics selectively as part of the overall identity management strategy. This will ensure that other fail-safes make it tough for bad actors to exploit the situation should there be a breach of biometric data.
Click to expand...

guest · Sep 29, 2019

It’s not too late to get biometrics right
September 29, 2019
https://venturebeat.com/2019/09/29/its-not-too-late-to-get-biometrics-right/

Just last month, news broke that biometric data for more than a million people was exposed from a platform called Biostar 2, a tool to control access to buildings and secure areas. This wasn’t the first time a biometric database had been compromised.

“After all,” they said, “you can change your password but you can’t change your fingerprint.”
Biometrics are inherently secure
There’s a give and take in today’s networked economy between privacy and convenience. Want more convenience, be prepared to give up more of your personal data. But in the case of biometric authentication, it’s not just data, it’s our physical attributes at stake.

Biometrics are secure, yes. But store them on a server and we’re back to where we started, but even worse because of that whole “can’t change your fingerprint” fact.
Instead of relying on servers, biometric data can and should only be stored locally on the user’s device. A lot of providers are already taking this approach – including the aforementioned platforms from Microsoft, Apple, and Google.
Click to expand...

Instead of relying on servers, biometric data can and should only be stored locally on the user’s device. A lot of providers are already taking this approach – including the aforementioned platforms from Microsoft, Apple, and Google.
By taking these steps we can embrace the convenience that biometric authentication offers with no tradeoff – and with no worries about losing the only pieces of ourselves that we have left.
Click to expand...

guest · Sep 30, 2019

ICAO denies alleged privacy flaw in biometric passports
September 26, 2019
https://www.biometricupdate.com/201909/icao-denies-alleged-privacy-flaw-in-biometric-passports

A group of researchers from the University of Luxemburg may have detected a critical security flaw in the International Civil Aviation Organization (ICAO) 9303 security standard that identifies travelers by scanning the chip implemented in biometric passports, the team announced at the European Symposium on Research in Computer Security (ESORICS) in Vienna, Austria this week.
The ICAO, however, denies the vulnerability is present in the specification’s current version.

The standard was first integrated in biometric passports in 2004, yet the privacy flaw was recently discovered. Initially, the security standard was meant to safeguard privacy and unlinkability, which means a hacker can not make the connection between two related elements.

“As most passports today use the same standard, this security flaw potentially has global impact,” continues Horne.
This security breach would be in clear violation of EU’s GDPR legislation that compels organizations and governments in Europe to safeguard user data, documents, and online privacy.
A report from Future Market Insights (FMI) predicted earlier this year that the number of ePassports with integrated biometric technology will grow by 18 percent in 2019 from nearly 264,000 last year.
Click to expand...

guest · Oct 14, 2019

Mum 'realises any fingerprint can unlock her Samsung' with eBay screen protector
October 14, 2019
https://www.mirror.co.uk/tech/mum-realises-any-fingerprint-can-20578404

Lisa Neilson, 34, from Castleford, bought the cover from eBay in the hopes of protecting her Galaxy S10 smartphone.
However, once she'd set up her right and left thumb prints to unlock the smartphone, she says she discovered that others could also use their prints to access the device.

Speaking to the Sun, she said: "If anyone got hold of my phone they can access it and within moments could be into the financial apps and be transferring funds.
She added: “We called Samsung because we thought there was a fault with the phone.
"The man in customer services took control of the phone remotely and went into all the settings and finally admitted it looked like a security breach.

Samsung claims that it is ‘investigating this internally.’
Click to expand...

Forbes: New Samsung Warning: Galaxy S10 Fingerprint Reader Hit By ‘Security Breach’

Owners of Samsung’s flagship Galaxy S10 devices are being warned about a serious potential “security breach” with the phone’s innovative in-display fingerprint reader when certain accessories are attached.
The issue is that the reader “uses sound pressure waves to read the 3D surface area of your finger—but those sound waves are a big problem when it comes to tempered glass screen protectors because if there are any gaps between your screen protector and your display, the ultrasonic waves can't get an accurate reading.”

Now it seems that one supplier of cheap after-market accessories has come up with a solution—and a very dangerous one at that. The manufacturer has developed a cheap gel protector that seems to record user fingerprints to ensure the device unlocks each time. The only challenge—this means anyone can access an S10 device with the protector attached.
Click to expand...

guest · Oct 17, 2019

Major Galaxy S10/Note 10 fingerprint flaw will be fixed with software update
October 17, 2019
https://www.sammobile.com/news/majo...print-flaw-will-be-fixed-with-software-update

For those who missed it, it was recently reported that certain silicone gel cases, when installed on a Galaxy S10, can allow anyone to access the phone using the fingerprint scanner even when their fingerprints aren’t registered on the device. Some silicone cases cover the entire phone, and the issue stems from the dotted pattern on some of those cases.

Exactly how the software update will fix this problem is unclear, but until the update comes out, Samsung suggests that everyone use the company’s official screen protectors.
Plastic screen protectors work best with the ultrasonic fingerprint sensor on Samsung’s flagship phones, as thicker screen protectors make it harder for the sensor to detect fingerprints because of the gap they create between the display and the user’s finger.
Click to expand...

guest · Oct 17, 2019

Google Pixel 4 Face Unlock works if eyes are shut
October 17, 2019
https://www.bbc.com/news/technology-50085630

One security expert said it was a significant problem that could allow unauthorised access to the device.
The test was repeated on several people, with the same result.

Google's Pixel 4 support website tells customers: "Your phone can also be unlocked by someone else if it's held up to your face, even if your eyes are closed."
It says concerned customers can switch on "lockdown" mode - which deactivates facial recognition - when they want enhanced security.
Google told BBC News Face Unlock could not be fooled by photos or masks, however.
Click to expand...

guest · Oct 20, 2019

Friendly reminder: Biometrics are not the best way to secure your phone
October 19, 2019
https://www.androidauthority.com/fingerprints-insecure-phone-1043477/

Samsung has spent millions on making its phones more secure, and on making sure customers know about it. You’d think all that money would be enough to fend off the threat of a $2 silicone case. Apparently not.
$2 phone case vs tech mega-corporation
In a terse statement released yesterday, Samsung acknowledged some clear cases and screen protectors can be used to bypass the fingerprint sensors on the Galaxy S10, Galaxy 10 Plus, Galaxy S10 5G, Galaxy Note 10, and Galaxy Note 10 Plus.
Biometrics make for poor security anyway
The truth is, fingerprints and other biometric authentication methods are flawed. You shouldn’t rely on them if you actually care about mobile security. PINs and passwords are much more secure — if less convenient — methods of authentication.

There are several reasons why an old-fashioned password is preferable to fingerprint readers, facial scanners, or retina/iris scanners.
For one, it’s easier to force someone to unlock their device with their fingerprint or face than it typically is to force them to reveal a password or PIN. It’s much easier to trick people into unlocking their device too — sometimes all it takes is to place the device in front of them while they’re sleeping (just ask Google Pixel 4 reviewers).
Click to expand...

guest · Oct 21, 2019

Bank apps start blacklisting Galaxy S10 phones after discovery of fingerprint vulnerability
October 21, 2019
https://www.androidpolice.com/2019/...after-discovery-of-fingerprint-vulnerability/

Just a few days ago, reports began circulating about how easily the security of the ultrasonic fingerprint sensor on the Samsung Galaxy S10 series could be bypassed to unlock the device.
Samsung has promised to address the issue in an upcoming software update, but in the meantime, some banks have taken matters into their own hands by either preventing Galaxy S10 owners from downloading and using their apps from the Play Store or disabling the fingerprint log-in option.

In the case of NatWest, its banking app was removed from the Play Store for Galaxy S10 owners until Samsung fixes the security issue.
Nationwide Building Society is taking a less drastic approach and simply disabling the fingerprint log-in option from inside the app. In the same Reddit thread, a user from Israel also reported having the fingerprint log-in option removed from his or her banking app, as well.
Click to expand...

hawki · Nov 8, 2019

"DHS expected to have biometrics on 260 million people by 2022

The US Department of Homeland Security (DHS) expects to have face, fingerprint, and iris scans of at least 259 million people in its biometrics database by 2022, according to a recent presentation from the agency’s Office of Procurement Operations...

The agency is transitioning from a legacy system called IDENT to a cloud-based system (hosted by Amazon Web Services) known as Homeland Advanced Recognition Technology, or HART. The biometrics collection maintained by DHS is the world’s second-largest, behind only India’s countrywide biometric ID network in size. The traveler data kept by DHS is shared with other US agencies, state and local law enforcement, as well as foreign governments...

The EFF said it believes CBP could be tracking travelers 'from the moment they begin their internet travel research.' As the group has noted, DHS says 'the only way for an individual to ensure he or she is not subject to collection of biometric information when traveling internationally is to refrain from traveling.'..."
Click to expand...

https://www.msn.com/en-us/news/us/dhs-expected-to-have-biometrics-on-260-million-people-by-2022/ar-BBWqxBl

ronjor · Dec 4, 2019

Artificial Fingerprint Ring Could Combat Biometric Data Theft

Sarah Coble 4 DEC 2019
A cybersecurity company has teamed up with a 3D accessory designer to produce a ring that could tackle the issue of what to do if your biometric data is stolen.
Click to expand...

ronjor · Dec 11, 2019

Sea-Tac is first airport to resist federal push for facial recognition and other biometric technologies

by Katherine Khashimova Long, The Seattle Times December 11, 2019
At least for now, controversial facial-recognition technology won't be installed at boarding gates at Seattle-Tacoma International Airport, making the airport the first in the country to resist the rollout of a federal biometric identification program.
Click to expand...

ronjor · Dec 20, 2019

Biometric Authentication Is Not a Security Panacea

Craig Lurey December 20, 2019
Biometric authentication systems are very convenient, but they’re not a substitute for strong password management and multi-factor authentication that generates one-time passcodes.
Click to expand...

guest · Jan 6, 2020

Who will give birth to your biometrics?
When registering biometric information, can fraudsters get in there first?
January 3, 2020
https://www.itproportal.com/features/who-will-give-birth-to-your-biometrics/

Biometrics are increasingly being used as a convenient and secure way for customers to authenticate themselves to online and remote services.

Of course, the first step for a consumer or employee to use biometrics to identify themselves is for them to register their information - iris, fingerprint, voice, etc. but what happens when the fraudster beats them to it and gets there first? What is stopping them from impersonating an individual and registering their own biometrics fraudulently?
[...] this creates an opportunity for fraudsters who have phished or otherwise managed to get hold of those credentials.

As a result, they have the ability to register their own biometrics and pretend to be you. This takes the whole concept of “identity theft” to a new level, where fraudsters could for all intents and purposes hijack a person’s physical characteristics!
Click to expand...

Last but not least, businesses must not rely solely on overt forms of authentication such as face, fingerprint or voice. It is crucial to augment these with other behavioural and contextual intelligence, as well as other authentication factors appropriate to the level of risk, to ensure a reliable authentication outcome.
Click to expand...

ronjor · Jan 9, 2020

Consumers Prefer Biometric Authentication to Passwords

January 9, 2020
According to Visa, more than half of credit cardholders who responded to the survey (53%) say they would switch banks if their current doesn’t offer biometric authentication options.
Click to expand...

deBoetie · Jan 9, 2020

Spooky how Visa are so gung ho - without once mentioning 2FA alternatives which are better. But that's because they will be looking to shuffle some of the fraud risk they currently bear onto consumers: the line being, now you've proved it's you via biometrics, any fraud is your problem.....

Plus, it's disreputable to claim that 53% is "consumers".

guest · Feb 9, 2020

mood said: ↑

Google wins dismissal of facial recognition lawsuit over biometric privacy act
December 29, 2018
https://www.theverge.com/2018/12/29...missal-illinois-privacy-act-snapchat-facebook
Click to expand...

Google Hit With New Lawsuit Over Faceprints
February 7, 2020
https://www.mediapost.com/publicati...gle-hit-with-new-lawsuit-over-faceprints.html

Google has been hit with a new lawsuit accusing the company of violating an Illinois biometric privacy law by compiling faceprints.

“Unbeknownst to the average consumer ... Google’s proprietary facial recognition technology scans each and every photo uploaded to the cloud-based Google Photos for faces, extracts geometric data relating to the unique points and contour [...]” Illinois resident Brandon Molander alleges in a class-action complaint filed Thursday in U.S. District Court for the Northern District of California.
Molander, who says he has had a Google Photos account for five years, claims the company is violating the Illinois Biometric Privacy Act. That law requires companies to obtain consumers' written consent before collecting or storing scans of their facial geometry.
Click to expand...

Minimalist · Mar 7, 2020

Biometrics are becoming popular alternatives to passwords, but will they keep us safer online?

When Aaron Doody had his legal self stolen it was through the old fashioned way: thieves broke into his Wellington flat and pinched his passport.

It was 2015 and Doody, now an accountant in Auckland, immediately cancelled his passport and called the police.

But a week or two later, a man strolled into a Waikato ANZ and withdrew $2000 cash from Doody's account, using his passport as identification. Then came bills from Spark and Vodafone, for accounts he didn't recognise and products he hadn't ordered.
Click to expand...

https://www.stuff.co.nz/technology/...-passwords-but-will-they-keep-us-safer-online

guest · Mar 11, 2020

Thousands of fingerprint files exposed in unsecured database, research finds
March 11, 2020
https://www.cnet.com/news/thousands...exposed-in-unsecured-database-research-finds/

A web server containing records of about 76,000 unique fingerprints was left exposed on the internet, researchers said Wednesday. The unsecured fingerprint data, as well as employee email addresses and telephone numbers, had been collected by Brazilian company Antheus Tecnologia.

The fingerprint data was stored as a binary data stream, which is a string of ones and zeroes. Sen said bad actors may be able to turn that data back into a biometric image of a fingerprint.
And even if they can't find a way to use the data for bad purposes at the moment, that will change as technology advances, Sen said.

"It might be that in the future they'll find a way to exploit it," Sen said. "Fingerprints are permanent throughout life."
The fingerprint data included ridge bifurcation and ridge ending data, both of which describe characteristics used to tell fingerprints apart. Logs in the exposed cache also let researchers see which records were associated with a specific fingerprint scan.
Click to expand...

Safety Detectives: Brazil: Millions of Records Leaked, Including Biometric Data

Approximately 16 gigabytes of data were found on the Elasticsearch server including highly sensitive information related to identification and biometric details.
The Antheus server investigated by our security team is an identity server, which means it gives users access to the system or the ability to register as a new user.
What has been leaked?
The Antheus server stored server and API access logs but also contained fingerprint data comprising of Ridge Bifurcation and Ridge ending – essential components for identifying and verifying fingerprints.
Click to expand...

The growing importance of fingerprint data
Data breaches relating to fingerprint data is particularly concerning because of the inherent inability for users to refresh their security information.
Given current consumer and professional trends, fingerprints are replacing typed passwords in many consumer goods such as phones and laptops.
Click to expand...

Minimalist · Mar 14, 2020

Biometrics investments and a security fail top stories this week in digital ID

The discovery of a major biometric data security vulnerability at a Brazilian biometrics company and a handful of multi million-dollar deals and investments contrast starkly and also make up the biggest stories of the week in biometrics. Investments in facial recognition vending machines and camera manufacturing and a fingerprint authentication system for SIM subscribers in Nigeria, as well as technology developed in response to the pandemic show an industry reaching global maturity.
Click to expand...

https://www.biometricupdate.com/202...rity-fail-top-stories-this-week-in-digital-id

Minimalist · Mar 27, 2020

Biometrics discussed for account security, health risk identification and enterprise apps during pandemic

A trio of blog posts have been published by biometrics providers discussing technologies for identifying people and fraud attacks remotely to maintain continuity during the global COVID-19 pandemic.
Click to expand...

https://www.biometricupdate.com/202...ification-and-enterprise-apps-during-pandemic

Log in or Sign up

Biometrics Are Coming & So Are Security Concerns

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

deBoetie Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Biometrics Are Coming & So Are Security Concerns

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

deBoetie Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches