If you think that the fingerprint security feature on your Android smartphone is reliable enough as a security method, this news might change your opinion about it.
Fingerprint security methods have been used for several years to secure phones, such as fingerprint screen unlocking and verification for payments and banking. Apart from being more secure, fingerprint usage is also more convenient as users no longer need to enter verification codes or patterns.
Android Fingerprint Verification Can Be Forcefully Bypassed
However, the latest news reveals that there are vulnerabilities that have existed since the day the feature was introduced. Cybersecurity research organizations at Zhejiang University and Tencent Labs claim to have discovered two security vulnerabilities.
These vulnerabilities are called CAMF (Cancel-After-Match-Fail) and MAL (Match-After-Lock). By exploiting these vulnerabilities, researchers were able to perform various actions, including allowing Android devices to attempt an unlimited number of fingerprint unlocking trials. They could also match fingerprints with those available in academic assets, biometric data leaks, or similar sources.
Android Fingerprint Lock Can Be Bypassed in a Matter of Hours
To execute this method, researchers needed three things: physical access to the target phone, a relatively inexpensive device costing around $15, and sufficient time. The brute-force method takes between 2.9 hours and 13.9 hours to fully unlock the device.
Moreover, this time frame applies if the user has only registered one fingerprint. As the number of registered fingerprints increases, the required time decreases. The researchers named this attack “BrutePrint,” which takes between 0.66 hours and 2.78 hours for smartphones with multiple registered fingerprints.
The researchers tested this brute-force method on ten popular smartphones, including some iOS devices. Based on their findings, they concluded that Android and HarmonyOS devices are easier to bypass, while iOS devices required an additional 10 attempts to bypass iPhone SE and iPhone 7. However, the success rate of bypassing iOS devices using this method is still relatively low.
