Advertisements
//
you're reading...
Android, Samsung, Samsung S5

Samsung Galaxy S5 Fingerprint Scanner Hacked Few Weeks Into Launch

s5 hacked

The researchers were able to use the mould to access PayPal’s app

The fingerprint sensor on Samsung’s Galaxy S5 handset has been hacked less than a week after the device went on sale.

Berlin-based Security Research Labs fooled the equipment using a mould it had previously created to spoof the sensor on Apple’s iPhone 5S.

The researchers said they were concerned that thieves could exploit the flaw in Samsung’s device to trigger money transfers via PayPal.

The payments firm played down the risk.

“While we take the findings from Security Research Labs [SRL] very seriously, we are still confident that fingerprint authentication offers an easier and more secure way to pay on mobile devices than passwords or credit cards,” it said.

It added that even if users were hacked it would cover their losses.

A spokesman for Samsung was unable to comment.

Reject pile

SRL created its hack by lifting a real fingerprint from a smartphone screen and then carrying out a fairly elaborate process to create a mould out of glue and graphite spray. This was then swiped across the sensor that sits in the phone’s home button.

“The fingerprint mould was actually one I made for the Apple device back in September,” project manager Ben Schlabs told the BBC.

“All I had to do was take it out of the reject pile as it wasn’t one of the ones that ended up working on the iPhone 5S for whatever reason.

“It was the first one I tried and it worked immediately on the S5.”

Although the fake fingerprint proved easy to use, Mr Schlabs added that he was concerned that Samsung’s software would not lock out thieves who had less luck, allowing them to make repeated attempts.

“Samsung could have enforced a password [lock-out] after five failed swipe attempts,” he said.

“But the way it works is that if it fails five times and asks for a password, if you just turn the screen off and back on again you can have another try.”

This is not true of the iPhone 5S.

Reveal transactions

While Apple currently limits its fingerprint scanner to unlocking the iPhone and verifying purchases in its own online store, Samsung has allowed its sensor to be used by third-party apps that add its Pass API (application program interface) to their code.

PayPal’s mobile app is the first to take advantage of this. The software can be used to send and request money and reveal past transactions.

SRL acknowledged that the fingerprint scanner made it simpler to access, but criticised the company for not requiring a second form of authentication, such as a Pin code.

However, PayPal said Galaxy S5 users should not be deterred from using the feature.

“The scan unlocks a secure cryptographic key that serves as a password replacement for the phone,” it said.

“We can simply deactivate the key from a lost or stolen device, and you can create a new one.

“PayPal also uses sophisticated fraud and risk management tools to try to prevent fraud before it happens. However, in the rare instances that it does, you are covered by our purchase protection policy.”

Source: BBC

Advertisements

About Eta Uso Jr

You won't be wrong in defining me as a combination of creativity, humility and discipline. People say I am Young, Smart and Incredibly Intelligent. An outstanding Electrical / Electronic Engineer with a Masters in Artificial Intelligence and Computing. Also possessing great passion for Information Technology and an ever active Delegate at the yearly GITEX Technology Week, Dubai, UAE - The Middle-East's most prestigious Information Technology event.

Discussion

No comments yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Advertisements

Follow me on Twitter

%d bloggers like this: