A new Android vulnerability was just developed by security researchers, which only costs $15 to purchase equipment to hijack fingerprints and access these devices. The attack is called BrutePrint and can easily be executed by anyone in as little time as possible. Here’s what you need to know about this vulnerability.
As reported by ArsTechnica, it only takes as little as 45 minutes to unlock an Android device using BrutePoint. The vulnerability does not affect iPhone devices at this time.
The researchers demonstrated how easy it was to guess fingerprints used on a device. They tested the equipment on 10 different smartphone models including the Samsung Galaxy S10 Plus, Xiaomi Mi 11 Ultra, OnePlus 7 Pro, vivo X60 Pro, OnePlus 5T, OPPO Reno Ace, Huawei P40, Huawei Mate 30 Pro 5G, Apple iPhone 7, and Apple iPhone SE.
As detailed in the report, these devices were connected to a circuit board that cost $15. It also had a database containing fingerprints that would be similar to data collected in a research or leaked via a data breach. Using this available information, BrutePrint attempts to unlock the device several times. Since fingerprint authentication identifies a match with a reference threshold, it makes it more vulnerable compared to password authentication, which simply needs an exact match.
And this allows attackers to access the device since a close enough match is the only thing needed in fingerprint authentication. Once the closest fingerprint match is located, the device can be unlocked.
In its testing, the researchers found that it takes a different amount of time to unlock every device. This is due to different factors, such as the number of fingerprints stored on every device as well as the security framework used. A device can be unlocked in as little as 40 minutes to 14 hours.
Surprisingly, the device that took the least amount of time was the Samsung Galaxy S10 Plus (0.73 to 2.9 hours). The device that took the longest to unlock was the Xiaomi Mi 11 (2.78 to 13.89 hours).
The researchers also found that the vulnerability does not affect iOS devices. This is because Apple devices encrypt its data. Meanwhile, Android does not follow this practice.
It’s important to know that this threat can be mitigated once smartphone and fingerprint sensor manufacturers work together to eradicate it.
You can read the full report here.
Source: AndroidAuthority
