Biometric hack tool released

**Glaswegian** · 04-02-2008, 03:10 PM

A British security researcher has demonstrated a "biologging" system for intercepting biometric authentication data, warning that attacks on biometric systems could become relatively straightforward if current practices don't change.

Matthew Lewis, of London-based Information Risk Management, demonstrated a proof-of-concept biologger last week at Black Hat Amsterdam and released the tool's source code.

Biologger is designed to highlight what Lewis considers a defect in the design of many current biometric systems: the biometric data isn't encrypted between the biometric scanner and the processing server.

The tool identifies and captures such data, opening the way to exploits such as man-in-the-middle attacks, Lewis said.

http://www.techworld.com/security/ne...S&NewsID=11863

**Cellus** · 04-05-2008, 12:19 PM

As a side note, problems like this have been known in quieter circles for some time. It should also be noted that integrated scanning systems, such as USB keys and hard drives with fingerprint scanners commonly do not encrypt or even properly authenticate biometric data transmitted inside the devices themselves.

04-02-2008, 03:10 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 21,678 OS: Win XP Pro SP3 My System Blog Entries: 10	Biometric hack tool released A British security researcher has demonstrated a "biologging" system for intercepting biometric authentication data, warning that attacks on biometric systems could become relatively straightforward if current practices don't change. Matthew Lewis, of London-based Information Risk Management, demonstrated a proof-of-concept biologger last week at Black Hat Amsterdam and released the tool's source code. Biologger is designed to highlight what Lewis considers a defect in the design of many current biometric systems: the biometric data isn't encrypted between the biometric scanner and the processing server. The tool identifies and captures such data, opening the way to exploits such as man-in-the-middle attacks, Lewis said. http://www.techworld.com/security/ne...S&NewsID=11863 __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs

04-05-2008, 12:19 PM	#2 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,633 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	Re: Biometric hack tool released As a side note, problems like this have been known in quieter circles for some time. It should also be noted that integrated scanning systems, such as USB keys and hard drives with fingerprint scanners commonly do not encrypt or even properly authenticate biometric data transmitted inside the devices themselves. __________________ TSF Networking Team HijackThis 5 Step Process Donate!