From: InfoSec News (alertsinfosecnews.org)
Date: Wed Apr 02 2008 - 04:22:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.techworld.com/security/news/index.cfm?newsID=11863

By Matthew Broersma
Techworld
02 April 2008

A British security researcher has demonstrated a "biologging" system for
intercepting biometric authentication data, warning that attacks on
biometric systems could become relatively straightforward if current
practices don't change.

Matthew Lewis, of London-based Information Risk Management, demonstrated
a proof-of-concept biologger last week at Black Hat Amsterdam and
released the tool's source code.

Biologger is designed to highlight what Lewis considers a defect in the
design of many current biometric systems: the biometric data isn't
encrypted between the biometric scanner and the processing server.

The tool identifies and captures such data, opening the way to exploits
such as man-in-the-middle attacks, Lewis said.

A number of difficulties remain in carrying out an attack, not the least
of which would be inserting the biologger into the network, Lewis said.
However, Lewis' point was to highlight that such dangers exist.

"Organisations across a number of different sectors are beginning to
implement biometric systems as part of their physical and logical access
controls, while a number of these systems and devices are configured to
integrate with existing infrastructures for ease of deployment, such as
through the use of IP protocols," Lewis said in a recent white paper on
biologging. "It is properties such as this that we seek to explore and
exploit as part of a proof of concept construction of a biologger."

The tool can be configured for sniffing biometric devices in a domain,
as an inline wire tap or proxy device, for ARP poisoning, or as a
memory-resident keylogger on a host, according to Lewis' presentation.

While Lewis' current research focuses on fingerprint systems, he said
the same techniques could be carried out against biometric modes such as
face and iris recognition access control systems.

Lewis said his aim was not to discourage the use of biometric access
control systems, but to encourage their secure design.

"Biometric device manufacturers and system integrators cannot rely on
security through obscurity alone for the overall security of their
devices and systems," he said in the white paper.

He said that where IP networks are involved, particularly, those
deploying biometric systems should identify network traffic routing and
the accessibility of biometric-related data on those networks.

Encryption of all biometric, user and control data between devices and
management servers could mitigate most of the issues identified in the
presentation, Lewis said.

Robust authenticated sessions between devices and servers would also
improve the systems, he said.

___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]