A Touch of Pwn
Attacking Windows Hello Fingerprint Authentication
Jesse D’Aguanno@0x30nTimo Teräs@TerasTimo

BackgroundWho are we?

Introduction

Timo Teräs
Security Researcher – Blackwing Intelligence
Alpine Linux Core
Likes: Reverse Engineering, Applied Cryptography, Low Level Development, CTFs, Sauna,
Cooking

Jesse D’Aguanno
Director of Research – Blackwing Intelligence
Likes: Reverse Engineering, Vulnerability Research, Applied Cryptography, Program Analysis,Long Walks on the Beachblackwinghq.com

Mission
Mission: Windows Hello Fingerprint Authentication Vulnerability
ResearchTargets: Top 3 Embedded Devices
Selected by Windows Hello TeamGoal: Bypass Windows Hello Authentication

blackwinghq.com

Mission
Approach: Physical “presentation” attacks
Cloning fingerprints, etc.
🚫 Not our focus today (but fun!)blackwinghq.com

Mission
Approach: Software / Hardware Attacks
Black box
No source code
Just three brand new laptops
Reverse Engineering, vulnerability research, exploit dev (potentially)✅ Today’s focus

blackwinghq.com

Physical Access to Target

Threat Model

Stolen / Confiscated Device
Evil MaidEtc.

Bypass Windows Hello Authentication

Not in Threat Model: Local Privilege Escalation

blackwinghq.com

Targets

Targets
blackwinghq.com

Dell Inspiron 15

Targets

Sensor: Goodix

blackwinghq.com

Lenovo ThinkPad T14s

Targets

Sensor: Synaptics

blackwinghq.com

Microsoft Surface Pro X

Targets

Sensor: ELAN

blackwinghq.com

Match on Chip (aka “Match on Sensor”)

Match on Chip

Biometric data never leaves the sensor
Sensor includes a microprocessor and memory
Storage & matching performed within sensor hardware
Can’t just replay a captured image to the host
Windows Hello Enhanced Sign-in Security only supports match on chip

blackwinghq.com

Windows Hello Enhanced Sign-in Security

Enhanced Sign-in Security

Goals:
Protect biometric data storage
Secure communication channel

Hardware / Software Components
Virtualization Based Security (VBS)
Trusted Platform Module 2.0 (TPM)
Secure Device Connection Protocol (SDCP)

blackwinghq.com

Secure Device Connection Protocol (SDCP)

Secure Device Connection
ProtocolGoal: End-to-End Secure Channel Between Host and Sensor
Attempts to ensure host is communicating with trusted / healthy sensor
Firmware validated against ROM root of trust
Biometric operations cryptographically securedEnroll()
Authenticated (via MAC) nonce used as stored user identifier
Identify()
Authenticated to prevent MitM and replay

blackwinghq.com

Secure Device Connection
Protocolblackwinghq.com

Secure Device Connection
Protocolblackwinghq.com

Secure Device Connection
ProtocolWindows Biometric Framework
https://learn.microsoft.com/en-us/windows/win32/secbiomet/framework-security

blackwinghq.com

Windows Biometric Framework

Initial Analysis

Approach

Initial RE
Attack Surface Assessment
Bus / Protocol Identification
System Configuration Review
Code Quality Assessment

Target Prioritization
Target Assessment & Exploitation
In-depth RE
Protocol dissection
Vulnerability Research
Exploit Development (PoCs)

blackwinghq.com

1 - Goodix

Target Prioritization

Supports Secure Device Connection Protocol (SDCP)
Good support in Linux
Cleartext USB communication
Overall poor code quality

2 - Synaptics
Supports SDCP (kinda)
Limited Linux support
Encrypted USB communication
Better code quality

3 – ELAN
Doesn’t support SDCP
Limited tooling (Surface Pro X – Windows on Arm)blackwinghq.com

Targets

Bus

Goodix - Overview

Internal USB

TypeMatch on Chip (MOC)

OS Support
Windows HelloLinuxblackwinghq.com

Goodix - Research

Research Goals
Examine Windows Configuration
Examine Linux driversObserve Host-Sensor Communications
Reverse Engineer Drivers
Reverse Engineer Firmware

blackwinghq.com

Goodix - Findings

blackwinghq.com

Goodix - Findings

blackwinghq.com

Goodix - Findings❌

❌

❌
blackwinghq.com

Goodix - Findings

blackwinghq.com

Goodix - Findings

💡blackwinghq.com

Goodix - Overview

WindowsIdentify()
Spoofs existing user

LinuxEnroll()
Attacker’s fingerprint w/
same id as existing Windowsuser
Template DB

blackwinghq.com

Goodix - Findings

😔

blackwinghq.com

Goodix - Overview

WindowsLinuxWindows
Template DBLinuxTemplate DB

blackwinghq.com

How does the sensor know what database to use?

Goodix - Overview

Driver sends configuration packet to sensor on device initialization
Sets various interesting config data - including what DB to use!
Maintains configuration state until next configuration received
Unauthenticatedblackwinghq.com

Goodix - Normal

Windows
Config Packet:- DB choice- etc.

Windows
Template DBLinux
Template DB
blackwinghq.com

Goodix - Normal

Windows

identify(),enroll(),…

Windows
Template DB

Authenticated (SDCP)

Linux
Template DB
blackwinghq.com

Goodix ID – Windows DB

Goodix ID – Linux DBGoodix – Findings Recap

Windows Support
Windows driver uses SDCP
Dedicated template database on sensor
Cannot write arbitrary entries

Linux Support
Linux driver does not support SDCP
Separate template database on sensor
Can write arbitrary entries
Does not enforce SDCP enrollment
Does calculate identify() response
blackwinghq.com

Vulnerability Chain:

Goodix - Vulnerabilities

Info Leak: Template DB enumeration
Arbitrary Write to Linux Template Database
Unauthenticated Sensor Configuration

blackwinghq.com

Exploitation

Goodix - Vulnerabilities

Enumerate sensor’s Windows template DB
Enroll attacker fingerprint using secure ID (SDCP MAC’d nonce) of existing user into Linux template
DB
MitM USB and boot Windows
Rewrite configuration packet to point sensor to Linux template DB
Login with attacker’s fingerprint

blackwinghq.com

USB Research in 2023, a word…

USB MitM

USBProxy
Not maintained (now USBProxy-legacy…)
GreatFET One + Facedancer

blackwinghq.com

Zero Length Packets (ZLP)

USB Bulk Transfers
blackwinghq.com

Goodix - OverviewWindows

USB MitM rewrites configpacket to point to Linux DBWindowsTemplate DBLinuxTemplate DB
blackwinghq.com

Goodix - Overview

Windowsidentify()…

WindowsTemplate DB

Sensor returns valid
MAC for injected
SDCP ID

LinuxTemplate DB
blackwinghq.com

Goodix - Demoblackwinghq.com

Match on Chip (MOC)

Synaptics - Overview

Limited Linux Support
Encrypted Communication
Encrypted Firmware

blackwinghq.com

USB traffic encrypted by TLS makes on the wire protocol analysis more difficult…

Synaptics – TLS
Implementation

Few early packets unencrypted, but most important functionality requires TLS channel
Need to break TLS!

Which Required
Lots of REExtracting TLS session keys with DBI/debugging
Reimplement broken TLS implementation
Custom protocol dissection

blackwinghq.com

Synaptics – TLS Paring

blackwinghq.com

Synaptics – TLS Paring

blackwinghq.com

Synaptics – TLS Paring

blackwinghq.com

Vulnerability Chain

Synaptics - Vulnerabilities

Insecure Default Configuration
SDCP is off by default – would mitigate this attack
Host Derived Cryptographic Keys
Derived from machine BIOS/ACPI product name and serial number
Sensor Database Enumeration
Once inside TLS
Arbitrary Fingerprint Enrollment
Once inside TLS

blackwinghq.comSynaptics – TLS Attack

blackwinghq.com

Synaptics - Demoblackwinghq.com

Match on Chip (MOC)

ELAN - Overview

Unknown custom bus & hardware connector
Microsoft brandedHARD! 😬

blackwinghq.com

Vulnerability Chain

ELAN - Vulnerabilities

Sensor Spoofing
Info Leak – Valid SID

blackwinghq.com

ELAN - Vulnerabilities✅

blackwinghq.com

ELAN - Vulnerabilities

ELAN - Vulnerabilities✅

blackwinghq.com

Why is number of fingerprints queried?

ELAN - Vulnerabilities

Unclear, but possibly a (weak) protection against someone plugging in a Type Cover that’s configured
with the same SID
If the number of fingerprints reported by the sensor doesn’t match the host’s expectations, the driverwill erase the chip
Trivially bypassable by simply querying the actual sensor

blackwinghq.com

Exploitation:

ELAN - Vulnerabilities

Plug-in spoofed device
Advertise sensor PID / VID
Observe valid SID from Windows driver
Return number of fingerprints (PoC hardcoded to one)
Initiate Fingerprint Login on Windows
Send Valid Login Response From Spoofed Device

blackwinghq.com

ELAN - Demoblackwinghq.com

Conclusion

Full authentication bypass on all three targets

Conclusion

Inconsistency between vendors
Common issues:
Code quality
Misunderstanding of SDCP by developers
Logic issues – especially non spec’d commands / support for other OSs
Unauthenticated attack surface
Info leak by design
All sensors leak valid IDs to support fingerprint option on login screen

blackwinghq.com

Recommendations

Conclusion

Make sure SDCP is enabled
Enhance SDCP to prevent this class of vulnerability
Vendors – Have a qualified 3rd party audit your implementation!

blackwinghq.com

Future work

ConclusionAdditional Hardware and Firmware ResearchFirmware Security
Potential memory corruption for code execution
Hidden functionality
HW vulns put secrets at risk
JTAG, decapping, storage access, glitching, power analysis, etc.
Other targets
Linux, Android, Apple

blackwinghq.com

MORSEThanks

Windows Hello TeamBlackwing Team
Chris Williams
Ricardo Lobo

blackwinghq.com

Final slide with logo

© Copyright Microsoft Corporation. All rights reserved.