4 ms·

Reversing a Fingerprint Reader Protocol (2021)

65 points by thejj100100 1y ago

abstractspoon 1y ago
Excellent
Liftyee 1y ago
Damn, I always thought that the fingerprint data was encoded somehow and never left the sensor hardware itself! OS-level access to the imagery seems like a security risk, but also opens some interesting possibilities for alternative uses.
- jeroenhd 1y ago
  AFAIK it depends per reader. This one seems to be a weird webcam on steroids, but others do the matching locally. IIRC, none of them do it particularly securely.
  - cinntaile 1y ago
    What's the security status of fingerprints on phones? Surely they don't leave the security chip? I hope?
    - maxhille 1y ago
      I don't think fingerprints should be regarded as a secret.
      - ta8645 1y ago
        Can you please post a link to high quality images of your own fingerprints? It should be fine, probably nobody has the technology to make them show up on a threatening letter mailed to the government, or anything like that.
        maxhille 1y ago
        Of course I won't, but then again I would send you pictures of any other body parts the same. If someone gets a hand on anything you touched, they have your fingerprint. Last time you traveled to another country - did you have to give them fingerprints? Is the software running your phone closed source? Could you ambush me at night near my house and forcefully take them? All I am saying is they are so weak as a secret that rhey should not be regarded as one.
    - jeroenhd 1y ago
      AFAIK many phones store the fingerprints on-chip. I haven't looked too deeply into it, though, so it's possible there's a brand out there that streams fingerprint information as a video. On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted. On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.
JJJollyjim 1y ago
As noted in the article I reversed the protocol for a related Goodix device (which was on Intel so used actual SGX instead of the white-box): I used the firmware update system to insert additional vulnerabilities in the sensor firmware and extract the PSK from that side. I did a talk about it here: https://www.youtube.com/watch?v=IyjUY-xvFw4 https://www.youtube.com/watch?v=IyjUY-xvFw4
th0mas 1y ago
Author here, didn't expect to see this on HN today! If you've got any questions, shoot!
- unlucky666 1y ago
  Do you have more posts similar to this one? Noticed your blog was a bit empty...
  - th0mas 1y ago
    Ha yeah I should really get on updating some of the info there. Got derailed with work quite a bit. Most recently did some work on BitLocker: https://news.ycombinator.com/item?id=42747877 https://news.ycombinator.com/item?id=42747877
ge96 1y ago
The real work ha underneath the software eg. I can't write a camera driver but thankfully someone else can That's cool the raw data image GIMP
johnflan 1y ago
I didn't follow the byte ordering of the image format at the end. Anyone have an explanation?
- pastage 1y ago
  You have four 12 bit values, they are packed into 6 bytes. Camera image formats are different but I am guessing this is probably MIPI RAW12? EDIT: You have the code in the repo. https://github.com/tlambertz/goodix-fingerprint-reversing/blob/main/capture.py#L140 https://github.com/tlambertz/goodix-fingerprint-reversing/bl...
mrheosuper 1y ago
> It then proceeds to generate a new, random, PSK and sends it to the device. This represents a trust-on-first-use security model. Wow, i expect them using hardcoded PSK, with PSK is flashed in factory.

65 points by thejj100100 1y ago

Excellent

Damn, I always thought that the fingerprint data was encoded somehow and never left the sensor hardware itself! OS-level access to the imagery seems like a security risk, but also opens some interesting possibilities for alternative uses.

jeroenhd 1y ago
AFAIK it depends per reader. This one seems to be a weird webcam on steroids, but others do the matching locally. IIRC, none of them do it particularly securely.
- cinntaile 1y ago
  What's the security status of fingerprints on phones? Surely they don't leave the security chip? I hope?
  - maxhille 1y ago
    I don't think fingerprints should be regarded as a secret.
    - ta8645 1y ago
      Can you please post a link to high quality images of your own fingerprints? It should be fine, probably nobody has the technology to make them show up on a threatening letter mailed to the government, or anything like that.
      - maxhille 1y ago
        Of course I won't, but then again I would send you pictures of any other body parts the same. If someone gets a hand on anything you touched, they have your fingerprint. Last time you traveled to another country - did you have to give them fingerprints? Is the software running your phone closed source? Could you ambush me at night near my house and forcefully take them? All I am saying is they are so weak as a secret that rhey should not be regarded as one.
  - jeroenhd 1y ago
    AFAIK many phones store the fingerprints on-chip. I haven't looked too deeply into it, though, so it's possible there's a brand out there that streams fingerprint information as a video. On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted. On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.

JJJollyjim 1y ago

As noted in the article I reversed the protocol for a related Goodix device (which was on Intel so used actual SGX instead of the white-box): I used the firmware update system to insert additional vulnerabilities in the sensor firmware and extract the PSK from that side. I did a talk about it here: https://www.youtube.com/watch?v=IyjUY-xvFw4 https://www.youtube.com/watch?v=IyjUY-xvFw4

th0mas 1y ago

Author here, didn't expect to see this on HN today! If you've got any questions, shoot!

unlucky666 1y ago
Do you have more posts similar to this one? Noticed your blog was a bit empty...
- th0mas 1y ago
  Ha yeah I should really get on updating some of the info there. Got derailed with work quite a bit. Most recently did some work on BitLocker: https://news.ycombinator.com/item?id=42747877 https://news.ycombinator.com/item?id=42747877

ge96 1y ago

The real work ha underneath the software eg. I can't write a camera driver but thankfully someone else can That's cool the raw data image GIMP

johnflan 1y ago

I didn't follow the byte ordering of the image format at the end. Anyone have an explanation?

pastage 1y ago
You have four 12 bit values, they are packed into 6 bytes. Camera image formats are different but I am guessing this is probably MIPI RAW12? EDIT: You have the code in the repo. https://github.com/tlambertz/goodix-fingerprint-reversing/blob/main/capture.py#L140 https://github.com/tlambertz/goodix-fingerprint-reversing/bl...

mrheosuper 1y ago

> It then proceeds to generate a new, random, PSK and sends it to the device. This represents a trust-on-first-use security model. Wow, i expect them using hardcoded PSK, with PSK is flashed in factory.