http://www.techworld.com/security/news/index.cfm?newsID=11863

By Matthew Broersma
Techworld
02 April 2008

A British security researcher has demonstrated a "biologging" system for intercepting biometric authentication data, warning that attacks on biometric systems could become relatively straightforward if current practices don't change.

Matthew Lewis, of London-based Information Risk Management, demonstrated a proof-of-concept biologger last week at Black Hat Amsterdam and released the tool's source code.

Biologger is designed to highlight what Lewis considers a defect in the design of many current biometric systems: the biometric data isn't encrypted between the biometric scanner and the processing server.

The tool identifies and captures such data, opening the way to exploits such as man-in-the-middle attacks, Lewis said.

A number of difficulties remain in carrying out an attack, not the least of which would be inserting the biologger into the network, Lewis said.

However, Lewis' point was to highlight that such dangers exist.

"Organisations across a number of different sectors are beginning to implement biometric systems as part of their physical and logical access controls, while a number of these systems and devices are configured to integrate with existing infrastructures for ease of deployment, such as through the use of IP protocols," Lewis said in a recent white paper on biologging. "It is properties such as this that we seek to explore and exploit as part of a proof of concept construction of a biologger."

The tool can be configured for sniffing biometric devices in a domain, as an inline wire tap or proxy device, for ARP poisoning, or as a memory-resident keylogger on a host, according to Lewis' presentation.

While Lewis' current research focuses on fingerprint systems, he said the same techniques could be carried out against biometric modes such as face and iris recognition access control systems.

Lewis said his aim was not to discourage the use of biometric access control systems, but to encourage their secure design.

"Biometric device manufacturers and system integrators cannot rely on security through obscurity alone for the overall security of their devices and systems," he said in the white paper.

He said that where IP networks are involved, particularly, those deploying biometric systems should identify network traffic routing and the accessibility of biometric-related data on those networks.

Encryption of all biometric, user and control data between devices and management servers could mitigate most of the issues identified in the presentation, Lewis said.

Robust authenticated sessions between devices and servers would also improve the systems, he said.