Fingerprint Bypass using Frida and Objection techniques

[jesuscc1993]

(Copy-pasted from a third party report; probably can't clarify or provide more details. See "context" at the bottom for more info).

Description

The target android application does not implement secure local authentication thus allowing an attacker to bypass fingerprint authentication. The target app's biometric authentication implementations rely on the onAuthenticationSucceeded method being called, without interaction with the CryptoObject. This approach can be trivially exploited by hooking into the application process and directly calling onAuthenticationSucceeded method, as a result the application should be unlocked without providing valid biometrics.

Specifications

OS: Android 9

Device: Rooted Samsung Galaxy S8+

Recommendations

1. Create the Android keystore key with setUserAuthenticationRequired and setInvalidatedByBiometricEnrollment set to true. Additionally, setUserAuthenticationValidityDurationSeconds should be set to -1.
2. Initialize cipher object with keystore key created above.
3. Create BiometricPrompt.CryptoObject using cipher object from previous step.
4. Implement BiometricPrompt.AuthenticationCallback.onAuthenticationSucceeded callback which will retrieve cipher object from the parameter and use this cipher object to decrypt some other crucial data such as session key, or a secondary symmetric key which will be used to decrypt application data.
5. Call BiometricPrompt.authenticate function with crypto object and callbacks created in steps 3 and 4.

Reference

• https://developer.android.com/reference/android/hardware/biometrics/BiometricPrompt.CryptoObject.html#BiometricPrompt.CryptoObject(javax.crypto.Cipher)
• https://labs.f-secure.com/blog/how-secure-is-your-android-keystore-authentication
• https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication#testing-biometric-authentication-mstg-auth-8

Context on this issue

We've been reported this vulnerability on our RN app, but the issue is on this library. All the devs on the project are web devs (most just frontend, me included) and we have no native background, so it's been hard to address the issue. I tried applying the suggested steps (or as much as I could understand from them, rather), following [this comment](https://github.com/oblador/react-native-keychain/issues/336#issuecomment-1192633216), but I get a `javax.crypto.IllegalBlockSizeException` and I have not been able to figure out how to get past that. I found some matches looking up the exception but I lack the basic knowledge required to even begin to understand them. I'll keep looking into this because we have to fix it, but I'm anything but hopeful.

[jesuscc1993]

It looks like the IllegalBlockSizeException might be a separate issue rising from setting

{
  accessControl: ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
  accessible: ACCESSIBLE.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY,
}

as keychain options when setting/getting the password, which was a change done to prevent a similar issue on iOS so you can ignore that bit for this ticket since it's not strictly related