Menu Close

Digital identity provider SDK leaves hundreds of thousands of biometric records vulnerable

Apps with exposed AWS access tokens are exposing biometric data, according to a new blog post from cybersecurity software provider Symantec. Hundreds of thousands of fingerprint records have been found unsecured online.

The supply chain for mobile apps turns out to be vulnerable to the lowest level of diligence a software or technology provider in the chain demonstrates.

Symantec found a vulnerable third-party SDK using AI for digital identity verification which is used by several popular banking apps on iOS.

“Embedded in the SDK were cloud credentials that could place entire infrastructures at risk,” writes Symantec Security Researcher Kevin Watkins. “The credentials could expose private authentication data and keys belonging to every (emphasis Symantec’s) banking and financial app using the SDK. Furthermore, users’ biometric digital fingerprints used for authentication, along with users’ personal data (names, dates of birth, etc.), were exposed in the cloud.”

The access key exposed the infrastructure server, API source code and AI models, along with more than 300,000 fingerprint templates across five mobile banking apps that use the SDK.

This particular SDK is far from alone. Symantec found that more than three-quarters of the apps it examined contain valid AWS access tokens that can be used to get into private clouds running on AWS.

Issues identified by Symantec also include mobile apps outsourced to developers who are unable to properly secure them, and larger companies developing multiple apps across teams and winding up using cross-team vulnerable libraries.

Ultimately, Symantec recommends adding security scanning to the app development lifecycle and requiring outside developers to use mobile app report cards that scan both SDKs and frameworks for vulnerabilities and insecure behavior.

The app vulnerability discovery follows an even larger biometric data breach suffered by a Chinese access control provider and revealed this week. Read More

Generated by Feedzy

Disclaimer

Innov8 is owned and operated by Rolling Rock Ventures. The information on this website is for general information purposes only. Any information obtained from this website should be reviewed with appropriate parties if there is any concern about the details reported herein. Innov8 is not responsible for its contents, accuracies, and any inaccuracies. Nothing on this site should be construed as professional advice for any individual or situation. This website includes information and content from external sites that is attributed accordingly and is not the intellectual property of Innov8. All feeds ("RSS Feed") and/or their contents contain material which is derived in whole or in part from material supplied by third parties and is protected by national and international copyright and trademark laws. The Site processes all information automatically using automated software without any human intervention or screening. Therefore, the Site is not responsible for any (part) of this content. The copyright of the feeds', including pictures and graphics, and its content belongs to its author or publisher.  Views and statements expressed in the content do not necessarily reflect those of Innov8 or its staff. Care and due diligence has been taken to maintain the accuracy of the information provided on this website. However, neither Innov8 nor the owners, attorneys, management, editorial team or any writers or employees are responsible for its content, errors or any consequences arising from use of the information provided on this website. The Site may modify, suspend, or discontinue any aspect of the RSS Feed at any time, including, without limitation, the availability of any Site content.  The User agrees that all RSS Feeds and news articles are for personal use only and that the User may not resell, lease, license, assign, redistribute or otherwise transfer any portion of the RSS Feed without attribution to the Site and to its originating author. The Site does not represent or warrant that every action taken with regard to your account and related activities in connection with the RSS Feed, including, without limitation, the Site Content, will be lawful in any particular jurisdiction. It is incumbent upon the user to know the laws that pertain to you in your jurisdiction and act lawfully at all times when using the RSS Feed, including, without limitation, the Site Content.  

Close Bitnami banner
Bitnami