"Researcher Unveils Smart Lock Hack for Fingerprint Theft"

A paper recently published by James Cook University Singapore describes how an attacker could covertly harvest fingerprints using off-the-shelf hardware through a smart lock hack technique called droplock. According to author and senior cybersecurity lecturer Steven Kerrison, the vulnerability stems from the limitations of the hardware used by Internet of Things (IoT) smart locks. Low-end IoT devices, such as commercial smart locks, lack dedicated secure storage, in contrast to smartphones and tablets, which store fingerprint details and other biometric data inside encrypted hardware enclaves. In addition, these devices typically have less powerful processors and less expensive sensors, and do not offer the same level of security as a smartphone. Kerrison built a proof-of-concept device that could connect to a smart lock via Wi-Fi and modify the lock's firmware with instructions to collect and upload fingerprint data using either an exploit or an exposed debug interface. The lock could also be disassembled and wired directly to the controller using on-board debugging pads. In either case, the result is a lock that, when activated within range of the attacker's controller, can provide data on the target's fingerprint, which can then be used against other biometric hardware. Kerrison noted that any real-world attack would most likely be directed at a specific target over a set period of time, rather than a random mass harvesting of credentials. In that case, the attacker would need to be relatively close to the lock, such as within standard Bluetooth range, to collect the fingerprints when the lock is activated. Once the print data has been collected, it could be used to gain access to other devices with stronger security measures in the future. This article continues to discuss the demonstrated smart lock hack for stealing fingerprints.

SearchSecurity reports "Researcher Unveils Smart Lock Hack for Fingerprint Theft"