According to an article in The Guardian1, it appears that an HTC smartphone stored users’ fingerprint images in a form that anyone could read. The issue was discovered by 4 FireEye researchers, and on August 5 they presented at BlackHat2 the paper3. The fingerprint images were reportedly stored unencrypted and world-readable at /data/dbgraw.bmp. Consequently, applications and other software could read them freely.
After this discovery, HTC’s share price plunged by nearly 2 percent, and its market capitalization reportedly fell below its liquidation value4.
This security hole affects HTC, but many smartphone manufacturers, including Samsung, reportedly do not use built-in security features provided by ARM and others. As a result, attackers can continue secretly reading users’ fingerprints freely and without detection.
Password theft has become a major problem, but the theft of biometric data—especially raw biometric data—poses an even more serious problem. Unlike passwords, biometric data cannot be replaced. It could therefore create an identity-theft problem more serious than password theft. Much more careful handling is required.
Footnotes
- The Guardian: “HTC stored user fingerprints as image file in unencrypted folder”, (2015/8/10) http://www.theguardian.com/technology/2015/aug/10/htc-fingerprints-world-readable-unencrypted-folder
- BlackHat Briefings – August 5-6, https://www.blackhat.com/us-15/briefings.html
- Zang, Y., Zhaofeng, C., Xue, H., Wei, T.: “Fingerprints On Mobile Devices: Abusing and Leaking”, (2015/8) https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Fingerprints-On-Mobile-Devices-Abusing-And-Leaking-wp.pdf
- Biggs, J.:”HTC Is Now Essentially Worthless (And Insecure)”, (2015/8/10), TechCrunch, http://techcrunch.com/2015/08/10/htc-is-now-essentially-worthless-and-insecure/?ncid=rss&utm_medium=twitter&utm_source=twitterfeed
Related posts
Data Sustains Lives—MyDataConference 2026 Opening Address
The following is the opening address for the MyData Japan Conference 2026, delivered by Nat Sakimura in his capacity as Chair of the General Incorporated Association…
The MyData Conference 2026 Is This Wednesday. See You at Hitotsubashi Hall!
I have been posting announcements on X every few days, and the MyDataJapan Conference 2026 is this Wednesday. There are many highlights: Naohiro Fujie, Representative Director…
Unsubmitted Public Comment on the Call for Comments on the Draft First Report of the Youth Protection Working Group on Information Distribution in the Digital Space
July 823:59 was the deadline for the call for comments on the draft first report. I ended the FAPI WG early and23:40 began the submission process…
You must be logged in to post a comment.