BioStar 2 Leak Exposes 23GB Data, 1M FingerprintsBioStar 2 Leak Exposes 23GB Data, 1M Fingerprints
Thousands of organizations, including banks, governments, and the UK Metropolitan Police, use the biometric security tool to authenticate users.
August 14, 2019
Researchers with VPNMentor have discovered a massive leak in biometric security platform BioStar 2, which uses facial recognition and fingerprint scanning as part of its means to identify users. Thousands of organizations use the tool to control access to buildings and secure areas.
Suprema, the security firm that built BioStar 2, recently partnered with Nedap to integrate the platform into its AEOS access control system. More than 5,700 institutions across 83 countries, including local businesses, governments, banks, and the UK's Metropolitan Police, use AEOS.
Noam Rotem and Ran Locar, both Internet privacy researchers, first detected the leak on August 5 while scanning ports as part of a Web-mapping project. Their team hunts for familiar IP blocks and uses them to find holes in a company's Web system. When these holes are found, the researchers then look for vulnerabilities that could lead to a data breach. During this process, the team found large chunks of BioStar 2's database unsecured and unencrypted.
The database held "almost every kind of sensitive data available," researchers wrote in a blog post. They could access more than 27.8 million records and a total of 23 GB of data, including more than 1 million fingerprints; facial recognition data and user images; access to client admin panels, dashboards, back-end controls, and permissions; unencrypted usernames and passwords, records of entry and exit to secure areas; and employee records.
"One of the more surprising aspects of this leak was how unsecured the account passwords we accessed were," they point out. "Plenty of accounts had ridiculously simple passwords, like 'Password' and 'abdc1234.'" While some users had more complex passwords, the researchers were able to view passwords across the database because they were stored as plaintext files.
Following a rocky disclosure process, BioStar 2 secured the database on August 13.
Read more details here.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks