Biometric authentication has seen rapid adoption by users all across the globe due to fewer security risks and faster response. A password less approach alleviates a diverse number of security risks. One of the most embraced password less authentication approaches is Windows Hello, which lets the user log in password less through pin code, fingerprint, or facial recognition. According to Microsoft around 84.7 percent of Windows 10 users use Hello to login into their systems. Each person has a unique biometric so without plastic surgery, it would be impossible to use someone else’s system with a biometric authentication enabled thus, making it one of the best security options or so was thought until recently.
CyberArk Labs research team has been exploring potential vulnerabilities in systems using Windows Hello to strengthen the future of biometric security. The result was the discovery of a security flaw with a CVE of 5.7 which allows a cyber attacker to bypass Windows Hello’s facial recognition using a simple USB camera. The attack’s approach is similar to what is shown in Tom Cruise’s famous Sci-fi movie Minority Report, where the criminal uses a USB device to clone an infrared image of the target’s face.
Windows Hello facial recognition only works on webcams with both RGB and infrared sensors, but the system does not read the actual RGB data. The reason facial recognition is considered more secure is it doesn’t require a password making it immune to brute force and phishing attacks. However, that is not entirely true in the background the password hash is used to unlock the device once the face in front of the camera matches that in the system’s database. The researcher’s at CyberArk said that on studying the working principle of Windows Hello facial recognition they concluded that the easiest possible way for an attacker to get access to the system is to impersonate the camera because the whole process is dependent on this input. An attacker having physical access can easily bypass Windows Hello by programming a USB webcam to deliver a pre-chosen image by the attacker to manipulate the system into thinking that the owner is present in front of the camera and authorizes unlocking. The attacker might capture or recreate an image of the victim’s face and injects the spoofed picture into the custom-made USB device. The attacker then connects the USB device to the victim’s system which transmits the spoofed infrared image to the system as authentication proof. Thus the attacker gains access to the victim’s system impersonated as the victim.
Although this was found in the research phase and there is no news of this attack being used to steal data this was a huge step forward in the security domain. Windows has already patched this vulnerability and released an update on July 13th.
By: Mayukh Paul
(Tech Intern, WCSF)
To stay updated about our blogs & news, please don't forget to "SUBSCRIBE" us.
To know more about us, please visit: https://www.worldcybersecurities.com/
Comments
Post a Comment