Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Hello bypassed using infrared image

therecord.media

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Windows Hello bypassed using infrared image

#11

Post by gruez »

tyingq wrote: post #10
gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.

Re: Windows Hello bypassed using infrared image

#12

Post by cwyptocuwency »

Out of curiosity, why would showing a printed image of the user's face not have worked as well? Or, say, playing a video of the user's face from another device in front of the webcam? Does the biometric software look for glint or other characteristics of a replicating medium?

Re: Windows Hello bypassed using infrared image

#14

Post by dchest »

chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

Facial and fingerprint authentication is the most successful and practical security feature protecting billions of computers which would have been unprotected otherwise. It should not be dismissed like that, and I’m glad the work is being done to find and fix vulnerabilities.

Re: Windows Hello bypassed using infrared image

#16

Post by code_duck »

cwyptocuwency wrote: post #12

Out of curiosity, why would showing a printed image of the user's face not have worked as well? Or, say, playing a video of the user's face from another device in front of the webcam? Does the biometric software look for glint or other characteristics of a replicating medium?

From what I read the infrared version was defeated because it accepted a static image while the other requires video. It sounds to me like either one could be fooled by an appropriate video?

Re: Windows Hello bypassed using infrared image

#17

Post by baybal2 »

dchest wrote: post #14
chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

Facial and fingerprint authentication is the most successful and practical security feature protecting billions of computers which would have been unprotected otherwise. It should not be dismissed like that, and I’m glad the work is being done to find and fix vulnerabilities.

And it compromises equally as much by providing a false sense of security

Re: Windows Hello bypassed using infrared image

#18

Post by wonnage »

chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

I can think of many major security breaches related to poor or leaked passwords and honestly none come to mind with faked biometrics. Not to say that there aren't any, but passwords have a terrible security history and everyone should be glad that they're slowly becoming just another factor rather than the sole gatekeeper.

Re: Windows Hello bypassed using infrared image

#19

Post by ohazi »

gruez wrote: post #11
tyingq wrote: post #10

Earlier quoted context omitted.

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.

The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does.

It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator.

i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows Hello, then Windows does a challenge/response to make sure it's getting an image from the authentic camera during login attempts.

Apple did something like this with the fingerprint reader home buttons on iPhones, which is why you had to replace the motherboard + home button as a single unit on damaged devices. They could have provided a reprovisioning tool, but it's Apple, so they didn't.

Re: Windows Hello bypassed using infrared image

#20

Post by gregmac »

tyingq wrote: post #10
gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

My point was if the class, VID or PID changes then treat it like a "new" device. If it presents subdevices or is suddenly a hub, those are new devices.

You'd have to also detect PID/VID brute force attacks. Short of a cryptographic key (as gruez talked about), a device being able to guess a valid class+PID+VID combo would be bad, so this would have to be treated similar to a password brute-force attack: too many "new" devices in a short time (especially unplugged without clicking the authorization UI) would cause the system to stop accepting new devices for a time.

Ideally you can also detect something else -- eg: serial number -- but I think that starts getting into manufacturer/device-specific implementations. (If only there was a company with billions of dollars and huge facilities and relationships with USB vendors and the capability to test tons of devices..)

Post reply on HN