Presentation on theme: "Penetration Testing Biometric System"— Presentation transcript:
1Penetration Testing Biometric System ByFB1H2S aka Rahul Sasi
2Who am I ? What is this paper about ? I am an Info Security EnthusiastRahul Sasi aka FB1H2S working as a consultant .Active participant of Null and other computing groups.A member of Garage4Hackers.What this paper contains ?
3Explaining the Risk?Finger print deployed every where, attendance and door management.Advantages and Disadvantages of Bio-systems.The devices hold critical information.EmployeeAttendanceEmployee DetailsEmployee Salary
4Why to audit them ?I am marked 10 days absent , what the |-|3ll is happening!I just Hacked into Biometric Attendance Register and Changed attendance and salary :D of mine andProfessor / Not so good co-workerStudent / Employee
5Classifying the Attacks Local Attacks:Finger Print SensorUSB Data ManagerRemote Attacks:Remote IP ManagementBack End DatabaseFinger Print Manager (Admin Interface)
9Local Attack: Finger print sensor Finger print scanners read input using two methodologies:1) Optical scanner2) Capacitance scannerFinger print recognition systems are image matching algorithmsCloning a duplicate finger print and cheating the image recognition algorithms
10Steeling a Finger Print Your finger impressions falls any were you touch. Ex: on glass
11My Approach: Finger Print Logger Biometric sensor looks like this.Placing a thin less refractive index transparent object in front of the sensor and logging finger prints.
12Building Finger print logger Refraction:Use Less refractive index thin transparent sheetLog the victims fingerprint using the finger print logger
16Local Attack: USB Data Manager. Biometrics devices have inbuilt data storage, were it stores the Finger print and user information.USB support in order to download and upload finger prints and other log detail to and from the device.Most of the devices do not have any sort of protection mechanism employed to prevent data theft, and those which uses password protection often is deployed with default password.
21Remote Administration Implementation IssuesThe remote administration capability of this device lets biometric servers to authenticate to it and manage remotely.We are completely unaware of the management protocol used as the program is embedded in the Biometric MIPS device.SolutionsThe admin application knows everything about the remote device so if we could get a copy of that application it will tell us everything we want.
22Example Attack Attacking the remote management protocol Example. Situation: The remote administration implementation is unknown.Foot printing: The label on the Biometric device will reveal which company has marketed or build that product.Download a copy of remote management software from vendor site
23Example Attack Reverse Engineering the Application Reflector used to disassemble the .Net applicationDetected TCP/IP setting of device used to communication, It uses port 4370 to communicate
24Application uses COM objects which interacts with Device IDA used for dissembling the COM objectsDisassembling Import function shows the communication details
25Example Device Command extracted Commands to set the device time remotely
26Auditing Back End Database From disassembling we were able to find local database password file and encryption key hardcoded in the application.
27Biometric Admin/Interface (Web Based and Desktop based ) Another possible point of attacks are on the admin interface, these are either desktop based or Web based.Desktop based applications are common and the possible chances to interact with them require local privileges on the Biometric server.But web based admin panels could be attacked form outside.So an application check on those modules for application vulnerabilities could also help.
28Nmap Script: Detecting Biometric Devices on Network: How to detect these device on network for attacking? Nmap Script Output.