Flaws in Fingerprint Sensors Undermine Windows Hello Security

In a recent research initiative, Microsoft’s Offensive Research and Security Engineering (MORSE) partnered with security firm Blackwing Intelligence to scrutinize the robustness of fingerprint sensors in popular laptops that are used for Windows Hello authentication. This collaborative effort has unveiled startling vulnerabilities in the biometric security systems of the Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X, raising major concerns.

The researchers focused on the "match on chip" (MoC) sensors, a sophisticated technology where biometric data processing occurs directly on the chip. Despite its advanced design, MoC sensors demonstrated critical security gaps. Blackwing Intelligence researchers Jesse D'Aguanno and Timo Teräs revealed that these sensors could be manipulated to spoof legitimate sensor communications, allowing unauthorized access to the system.

The Secure Device Connection Protocol (SDCP), developed by Microsoft, was intended to safeguard the data exchange between the host and the fingerprint device. However, Blackwing's researchers uncovered novel methods to bypass these protections, raising alarms about potential adversary-in-the-middle (AitM) attacks.

For instance, the ELAN sensor, lacking SDCP support and transmitting security identifiers in plaintext, could be impersonated by any USB device, tricking the system into logging in an unauthorized user. Similarly, the Synaptics sensor's implementation was found deficient, relying on a flawed Transport Layer Security (TLS) mechanism, rendering it susceptible to bypass.

Perhaps the most intriguing was exploiting the Goodix sensor in the Dell Inspiron 15. Researchers exploited the differences in enrollment operations between Windows and Linux systems. They demonstrated that one could gain unauthorized access by booting to Linux, enrolling an attacker's fingerprint with the same ID as a legitimate Windows user, and then using a man-in-the-middle attack to intercept and rewrite the sensor's configuration packet.

These revelations underscore the complex nature of biometric security and the challenges in ensuring its integrity. While Windows Hello's design by Microsoft aimed to offer a secure biometric authentication channel, the implementation by device manufacturers includes critical oversights. The research also highlighted that SDCP, though robust, only covers a narrow operational scope, exposing significant parts of the device's functionality to potential exploits.

This investigation is not the first to question the reliability of Windows Hello biometrics. In July 2021, Microsoft addressed a medium-severity flaw that could permit facial recognition spoofing. Such incidents emphasize the need for ongoing vigilance and comprehensive security testing.

In response to these findings, original equipment manufacturers (OEMs) must prioritize enabling SDCP and undergo thorough audits by independent experts. As biometric technologies become increasingly integral to our digital lives, ensuring their security is not just a technical necessity but a fundamental responsibility.