The ability of BrutePrint to successfully hijack fingerprints stored on Android devices but not iPhones is the result of one simple design difference: iOS encrypts the data, and Android does not.
The researchers wrote:
We capture SPI signals through a logic analyzer and locate those dense signals on MISO to identify FDA. As the data is not encrypted, we could try out the encoding method within several inference attempts. For example, the image shape can be guessed through factoring the total number of pixels, and adaption can be made according to the periodic offset of outlier values (i.e., values such as checksum other than image pixels). For the victim device, the first sample is transmitted in 4 frames while the last three use the same format with 13 frames. Each last frame is short since it transmits the remained fingerprint data. The FDA commands are identified before every frame. Taking the first sample for example, the FDA commands are always 0xF08800, and we show the structure (frame separator omitted) of fingerprint data in Figure 6. The structure is not complicated that the gray-scale image is stored in 16 bpp, and for each line, a serial number and a CRC16 checksum are attached at both ends. last frame is short since it transmits the remained fingerprint data. The FDA commands are identified before every frame. Taking the first sample for example, the FDA commands are always 0xF08800, and we show the structure (frame separator omitted) of fingerprint data in Figure 6. The structure is not complicated that the gray-scale image is stored in 16 bpp, and for each line, a serial number and a CRC16 checksum are attached at both ends.
BrutePrint is the work of Yu Chen of Tencent and Yiling He of Zhejiang University. They have proposed several software or hardware changes designed to mitigate the attacks. One change is to prevent attempt-limiting bypasses by checking for CAMF exploits. The check works by setting an additional limit for the error-cancels. Another suggested fix is preventing adversary-in-the-middle attacks by encrypting data passing between the fingerprint sensor and the device processor. Last, the researchers recommend changes that cause fingerprint acquisition to behave consistently whether or not matching results are inferred.
“The unprecedented threat needs to be settled in cooperation of both smartphone and fingerprint sensor manufacturers, while the problems can also be mitigated in OSs,” the rese
Post too long. Click here to view the full text.