Found broken a feature for fingerprint image obfuscation

[Seong-Joong Kim]

Dear all,

In this package, a random seed is used for generation key for obfuscating a fingerprint image in uru4000 driver.
Unfortunately, it seems that the seed always exhibits the same sequence of numbers each time since it is generated from rand() in libc by default.
Then I reported this issue to the upstream with the patch.

However, the maintainer insists that the obfuscation-feature can be broken since the key for encryption is composed of just 4-bytes length.
Thus, there is no need to patch about random seed anyway.
It's pretty weird to say that.

Would it be all right if I leave this as it is?

Many thanks!!

[Sebastien Bacher (seb128)]

Thank you for your bug report, do you have any pointer to the discuss with the upstream maintainer?

[Sebastien Bacher (seb128)]

Thanks, it's https://gitlab.freedesktop.org/libfprint/fprintd/issues/16

[Sebastien Bacher (seb128)]

sorry, commented on the wrong bug

[Seong-Joong Kim (sungjungk)]

Could you check the following link?

https://gitlab.freedesktop.org/libfprint/libfprint/merge_requests/47

[Seong-Joong Kim (sungjungk)]

What do you think of this issue?

[Seong-Joong Kim (sungjungk)]

It seems that the uru4000 driver is affected by a weak? or broken? obfuscation feature, allowing MITM attackers to discover user's precious fingerprint images.

[Seong-Joong Kim (sungjungk)]

Please check the following PoC.

https://github.com/sungjungk/fp-img-deobfuscator

[Seong-Joong Kim (sungjungk)]

It is demo video: https://www.youtube.com/watch?v=Grirez2xeas

[Seong-Joong Kim (sungjungk)]

CVE-2019-13604 and CVE-2019-13621 have been assigned.
Please check the following PoC:
https://github.com/sungjungk/fp-scanner-hacking
https://github.com/sungjungk/fp-img-key-crack

[Marco Trevisan (Treviño) (3v1n0)]

As per upstream decision...