How to give Windows Hello the finger and login as someone on their stolen laptop

Hardware security hackers have detailed how it's possible to bypass Windows Hello's fingerprint authentication and login as someone else – if you can steal or be left alone with their vulnerable device.

The research was carried out by Blackwing Intelligence, primarily Jesse D'Aguanno and Timo Teräs, and was commissioned and sponsored by Microsoft's Offensive Research and Security Engineering group. The pair's findings were presented at the IT giant's BlueHat conference last month, and made public this week. You can watch the duo's talk below, or dive into the details in their write-up here.

For users and administrators: be aware your laptop hardware may be physically insecure and allow fingerprint authentication to be bypassed if the equipment falls into the wrong hands. We're not sure how that can be fixed without replacing the electronics or perhaps updating the drivers and/or firmware within the fingerprint sensors. One of the researchers told us: "It's my understanding from Microsoft that the issues were addressed by the vendors." So check for updates or errata. We've asked the manufacturers named below for comment, and we will keep you updated.

For device makers: check out the above report to make sure you're not building these design flaws into your products. Oh, and answer our emails.

The research focuses on bypassing Windows Hello's fingerprint authentication on three laptops: a Dell Inspiron 15, a Lenovo ThinkPad T14, and a Microsoft Surface Pro 8/X, which were using fingerprint sensors from Goodix, Synaptics, and ELAN, respectively. All three were vulnerable in different ways. As far as we can tell, this isn't so much a problem with Windows Hello or using fingerprints. It's more due to shortcomings or oversights with the communications between the software side and the hardware.

• Phones' facial recog tech 'fooled' by low-res 2D photo
• Crane horror Reg reader uses his severed finger to unlock Samsung Galaxy phone
• Microsoft's bug bounty turns 10. Are these kinds of rewards making code more secure?
• Your password hygiene remains atrocious, says NordPass

Windows Hello allows users to log into the OS using their fingerprint. This fingerprint is stored within the sensor chipset. What's supposed to happen, simply put, is that when you want to set up your laptop to use your print, the OS generates an ID and passes that to the sensor chip. The chip reads the user's fingerprint, and stores the print internally, associating it with the ID number. The OS then links that ID with your user account.

Then when you come to login, the OS asks you to present your finger, the sensor reads it, and if it matches a known print, the chips sends the corresponding ID to the operating system, which then grants you access to the account connected to that ID number. The physical communication between the chip and OS involves cryptography to, ideally, secure this authentication method from attackers.

But blunders in implementing this system have left at least the above named devices vulnerable to unlocking – provided one can nab the gear long enough to connect some electronics.

"In all, this research took approximately three months and resulted in three 100 percent reliable bypasses of Windows Hello authentication," Blackwing's D'Aguanno and Teräs wrote on Tuesday.

Here's a summary of the techniques used and described by the infosec pair:

• • Model: Dell Inspiron 15

  • Method: If someone can boot the laptop into Linux, they can use the sensor's Linux driver to enumerate from the sensor chip the ID numbers associated with known fingerprints. That miscreant can then store in the chip their own fingerprint with an ID number identical to the ID number of the Windows user they want to login as. The chip stores this new print-ID association in an internal database associated with Linux; it doesn't overwrite the existing print-ID association in its internal database for Windows.

    The attacker then attaches a man-in-the-middle (MITM) device between the laptop and the sensor, and boots into Windows. The Microsoft OS sends some non-authenticated configuration data to the chip. Crucially, the MITM electronics rewrites that config data on the fly to tell the chip to use the Linux database, and not the Windows database, for fingerprints. Thus when the miscreant next touches their finger to the reader, the chip will recognize the print, return the ID number for that print from the Linux database, which is the same ID number associated with a Windows user, and Windows will log the attacker in as that user.

• • Model: Lenovo ThinkPad T14
  • Method: The attack used against the ThinkPad is similar to the one above. While the Dell machine uses Microsoft's Secure Device Connection Protocol (SDCP) between the OS and the chip, the T14 uses TLS to secure the connection. This can be undermined to again, using Linux, add a fingerprint with an ID associated with a Windows user, and once booted back into Windows, login as that user using the new fingerprint.
• • Model: Microsoft Surface Pro 8 / X Type Cover with Fingerprint ID
  • Method: This is the worst. There is no security between the chip and OS at all, so the sensor can be replaced with anything that can masquerade as the chip and simply send a message to Windows saying: Yup, log that user in. And it works. Thus an attacker can log in without even presenting a fingerprint.

Interestingly enough, D'Aguanno told us restarting the PC with Linux isn't required for exploitation – a MITM device can do the necessary probing and enrollment of a fingerprint itself while the computer is still on - so preventing the booting of non-Windows operating systems, for instance, won't be enough to stop a thief. The equipment can be hoodwinked while it's still up and running.

"Booting to Linux isn't actually required for any of our attacks," D'Aguanno told us. "On the Dell (Goodix) and ThinkPad (Synaptics), we can simply disconnect the fingerprint sensor and plug into our own gear to attack the sensors. This can also be done while the machine is on since they're embedded USB, so they can be hot plugged."

In that scenario, "Bitlocker wouldn't affect the attack," he added.

As to what happens if the stolen machine is powered off completely, and has a BIOS password, full-disk encryption, or some other pre-boot authentication, exploitation isn't as straight forward or perhaps even possible: you'd need to get the machine booted far enough into Windows for the Blackwing team's fingerprint bypass to work. The described techniques may work against BIOSes that check for fingerprints to proceed with the startup sequence.

"If there's a password required to boot the machine, and the machine is off, then that could stop this just by nature of the machine not booting to the point where fingerprint authentication is available," D'Aguanno clarified to us.

"However, at least one of the implementations allows you to use fingerprint authentication for BIOS boot authentication, too. Our focus was on the impact to Windows Hello, though, so we did not investigate that further at this point, but that may be able to be exploited too."

The duo also urged manufacturers to use SDCP and enable to connect sensor chips to Windows: "It doesn't help if it's not turned on."

They also promised to provide more details about the vulnerabilities they exploited in all three targets in future, and were obviously circumspect in giving away too many details that could be used to crack kit. ®

This article was updated after publication to incorporate further commentary from Blackwing Intelligence.