Found storing user fingerprints as raw image files

Bug #1818938 reported by Seong-Joong Kim on 2019-03-07
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libfprint
New
Unknown
libfprint (Ubuntu)
High
Unassigned

Bug Description

Dear all,

Currently, libfprint saves a fingerprint image (FP1 or 2?) to a file on the host without any encryption.

Once fingerprint has been leaked, victims are leaked for the rest of life since it lasts for a life.

It is necessary to prepare for the problem.

Especially, when I use `fp_print_data_save()` using libfprint library for enrolling my fingerprints, the image is saved in user’s home directory without any protection scheme.

Though `fprintd` generates fingerprint image with root permission for protecting the file from attackers, it is not of itself sufficient.

FYI, similar issues on Android have been reported and cryptographic operations are introduced to encrypt fingerprint (see [1-2]).

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Fingerprints-On-Mobile-Devices-Abusing-And-Leaking-wp.pdf
[2] https://www.zdnet.com/article/hackers-can-remotely-steal-fingerprints-from-android-phones/

Lastly, is it a kind of `CWE-311: Missing Encryption of Sensitive Data`? (see https://cwe.mitre.org/data/definitions/311.html)

Many thanks!!

information type: Public → Public Security
Sebastien Bacher (seb128) wrote :

Thank you for your bug report, could you maybe report that upstream? We don't have any active maintainer for that stack in Ubuntu and upstream is better placed to respond to the issues you are raising

Changed in libfprint (Ubuntu):
importance: Undecided → High
Seong-Joong Kim (sungjungk) wrote :

Okay! I just reported it to upstream.

Changed in libfprint (Ubuntu):
status: New → Triaged
Changed in libfprint:
status: Unknown → New
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.