The Samsung Galaxy S5’s fingerprint sensor hacked
 |
| English: Samsung Logo Suomi: Samsungin logo (Photo credit: Wikipedia) |
THE Samsung Galaxy S5’s fingerprint sensor has a loophole that can leave a user’s phone -- and the PayPal money app -- vulnerable to hackers, researchers say.
The exploit, demonstrated in a YouTube video , bypasses the Galaxy S5’s fingerprint lock using a fake fingerprint made from wood glue.
In an interview with the Journal, PayPal’s head of ecosystem security, Brett McDowell, said that the hack is real, and known, but it’s nothing that should alarm the public.
“We don’t have any reason to question the authenticity of the demonstration,” Mr McDowell said. “This is a known challenge to fingerprint-sensing technology, and these are some of the top researchers in the world. But this is not a scalable exploit. It’s not something most people should worry about.”
The video by Berlin, Germany-based Security Research Labs shows the mould of a fingerprint being used to trick a Galaxy S5’s fingerprint sensor into unlocking the phone. SRLabs says in the video that it made its fake fingerprint (or “wood glue spoof”) by taking a camera phone photo of a fingerprint left on the phone’s display. The video was reported earlier by Ars Technica.
 |
| Samsung Galaxy S5 (Photo credit: Janitors) |
“Not only is it possible to spoof the fingerprint authentication, even after the device has been turned off, but the implementation also allows for seemingly unlimited authentication attempts without ever requiring a password,” says the narrator in the SRLabs video.
PayPal is among the apps that can make use of Samsung’s fingerprint sensor in place of a password, and in the video researchers use the fingerprint spoof to log into PayPal and transfer money to an outside account.
Mr McDowell said that PayPal believes the security and convenience of using a fingerprint sensor outweighs the possibility that a hacker steals both a person’s phone and a pristine fingerprint, and also have the time and resources to make a copy of a fingerprint before that user calls PayPal customer service to disconnect their account from the lost or stolen phone.
“This is not something you can do on any number of devices,” Mr McDowell said. “This is not like a massive phishing scam where you can get millions of passwords quickly. This is limited to one device, one victim at a time.”
Apple’s iPhone 5S also has a fingerprint reader, one that has been hacked in a similar fashion, but it is not used to authenticate third-party financial transactions, only Apple’s own iTunes store.
Samsung and SRLabs have not yet replied to requests for comment.
Comments
Post a Comment