Pierluigi Paganini April 16, 2014

Principal mobile manufacturers tried to improve user’s security adding biometric authentication system based for example on Fingerprint feature. Months ago Apple proposed its Apple TouchID system that was easily hacked and today’s security experts have found a way to bypass also the Samsung Galaxy S5 Fingerprint feature. The feature implemented in the Samsung Galaxy S5 was also used to facilitate payments through PayPal and theoretically also to make it more secure.

Samsung Galaxy S5 also implemented a smart feature to allow users to easily transfer money via PayPal circuit just by swiping a finger on the fingerprint sensor, but considering the attack presented by the teamSRLabs  could allow bad actors to access to victim’s PayPal account without providing any secret password. A few days after the official commercial launch of the Samsung Galaxy S5 security experts have successfully hacked Fingerprint sensor with a method quite similar to the one adopted to deceive the Touch ID sensor proposed by Apple.

Another concerning issue related to the hack presented by the researchers is that after mobile restart the Samsung Galaxy S5 doesn’t require user to enter a passcode before he can use his fingerprint to unlock the Smartphone, this means that in case of theft attackers could have complete access to the device. Despite attackers need to have physical access to the Samsung Galaxy S5 to exploit the vulnerability, it is clear that Fingerprint feature implemented by the giant lack of a proper security design.  I’m sure Samsung will promptly fix it.

Pierluigi Paganini

(Security Affairs –  Samsung Galaxy S5, mobile)