Research / people
6 items: 3 advisories · 1 project · 1 talk · 1 post
advisory
A physical attacker can enroll their own fingerprint under a legitimate user’s identity and authenticate to Windows Hello as that user, a complete bypass. Any enrolled user is affected.
✓ fixed Jesse D'Aguanno, Timo Teräs
advisory
A physical attacker can impersonate the sensor with a spoofed USB device and assert that an authorized user has authenticated, bypassing Windows Hello with no valid fingerprint. Any enrolled user is …
✓ fixed Jesse D'Aguanno, Timo Teräs
advisory
A physical attacker can authenticate to Windows Hello as a legitimate user with their own fingerprint, a complete fingerprint-authentication bypass. Any enrolled user is affected.
✓ fixed Jesse D'Aguanno, Timo Teräs
post
TL;DR Microsoft’s Offensive Research and Security Engineering (MORSE) asked us to evaluate the security of the top three fingerprint sensors embedded in laptops and used for Windows Hello fingerprint …
Jesse D'Aguanno, Timo Teräs
project
Microsoft’s Offensive Research and Security Engineering team engaged us to evaluate the security of the top three fingerprint sensors embedded in laptops and used for Windows Hello. Extensive …
1 talk1 post3 advisories Jesse D'Aguanno, Timo Teräs
talk
Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed …