Contents:
Biometric information helps people access systems and secure devices more easily. However, it might become a target for threat actors. According to a new report, hackers start to become aware of the value of this kind of info like iris scans, fingerprint authentication, or facial recognition and might begin to exploit it.
How Hackers Can Compromise Your Biometric Data
Experts from Intel471 have recently released a report explaining three ways in which hackers could exploit your biometric information. Here are they:
The Risk Posed by Documentation Fraud
Researchers underline that what can threat actors do with the biometric data they steal is to perform documents forging for several purposes like illegal immigration, obtaining a loan, property fraud, or claiming financial benefits.
In this sense, the experts depicted in the report a 2020 incident when two threat actors of Iranian origin intended to sell biometric papers linked to several countries among which they mentioned the United States, South Korea, Sudan, Spain, and Ukraine.
One actor advertised a package of 76,000 national codes and biometric national cards, including but not limited to drivers’ licenses, identification cards, passports, personal badges and student identification cards. The documents had a wide array of origin: Brazil, Egypt, India, Jordan, Saudi Arabia, Senegal, South Korea, Spain, Sudan, Ukraine and the United States were all in the package. The other actor offered to sell 72,400 scanned Iranian identification documents allegedly obtained from Iran’s Ministry of Cooperatives, Labor and Social Welfare.
They Can Bypass Biometric Protection
Hackers can think of exploiting current software vulnerabilities that will allow them to bypass biometric protection. Since this kind of information can be employed for contactless payments or website sign-in purposes this can represent a serious security risk.
For instance, an Apple Pay vulnerability was identified in 2020, which, if successfully exploited by a malicious actor could have led to biometric identification bypassing or even making payments.
The flaw was reported by some U.K. scientists who declared that the so-called “replay and relay” attack was used to perform U.S. $1,350 on Visa credit cards’ unauthorized payments. This was related to Apple Pay accounts.
In 2021, another vulnerability dubbed CVE-2021-3145 was disclosed that would permit hackers to bypass authentication on Android devices.
Several other biometric vulnerabilities were disclosed in 2021, including a vulnerability that allows attackers to bypass biometric authentication on Android devices (CVE-2021-3145) and another in Samsung Note20’s fingerprint scanner permitting fingerprint mirroring, which would contribute to a high false recognition rate for users logging into the devices (CVE-2021-22494). In August 2021, yet another vulnerability in the Windows 10 Hello facial recognition system was discovered that allowed an attacker to bypass biometric authentication with a spoofed image
Hackers May Be Able to Imitate Human Behavioral Patterns
The malicious tactics can extend beyond merely exploiting vulnerabilities, as some hackers could also intend to perform manipulation on biometric security behavioral patterns. As the same researchers emphasize, they noticed threat actors sharing knowledge on how to get against behavior-based anti-fraud systems.
They depicted such a case where a hacker stated that random forest algorithms were used by various institutions to lower the cost of a popular digital identification subscription service. Because of this encryption system that represented not such an efficient protection method, hackers were able to reset some behavioral pattern parameters and thus infiltrate into the network. Reportedly, they copied keystrokes and mouse movements and thus managed to bypass two-factor authentication.
How to Secure Your Biometric Data
The use of biometric data has gained popularity and thus protecting it is an important aspect both at the individual and enterprise level. Here are some tips on what you can implement to efficiently safeguard your data:
- Using anti-spoofing technology will keep unauthorized users away;
- Keep your systems always updated and implement the latest patches regularly or you can choose an automated tool such as Patch & Asset Management that lets you deploy patches in less than 4 hours from the release featuring the shortest vendor to end-user waiting time;
- Use powerful passwords to secure your data;
- Implement a proper cybersecurity strategy supported by efficient tools like Threat Prevention that will keep away DNS level threats or Privileged Access Management that will limit insider threats through timely escalation and de-escalation of privileged permissions.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
Hi! My name is Andra and I am a passionate writer interested in a variety of topics. I am curious about the cybersecurity world and what I want to achieve through what I write is to keep you curious too!
