Bypass Biometric Authentication (Android)
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Method 1 – Bypassing with No Crypto Object Usage
The focus here is on the onAuthenticationSucceeded callback, which is crucial in the authentication process. Researchers at WithSecure developed a Frida script, enabling the bypass of the NULL CryptoObject in onAuthenticationSucceeded(...). The script forces an automatic bypass of the fingerprint authentication upon the method's invocation. Below is a simplified snippet demonstrating the bypass in an Android Fingerprint context, with the full application available on GitHub.
Command to run the Frida script:
Method 2 – Exception Handling Approach
Another Frida script by WithSecure addresses bypassing insecure crypto object usage. The script invokes onAuthenticationSucceeded with a CryptoObject that hasn't been authorized by a fingerprint. If the application tries to use a different cipher object, it will trigger an exception. The script prepares to invoke onAuthenticationSucceeded and handle the javax.crypto.IllegalBlockSizeException in the Cipher class, ensuring subsequent objects used by the application are encrypted with the new key.
Command to run the Frida script:
Upon reaching the fingerprint screen and the initiation of authenticate()
, type `bypass()`` in the Frida console to activate the bypass:
Method 3 – Instrumentation Frameworks
Instrumentation frameworks like Xposed or Frida can be used to hook into application methods at runtime. For fingerprint authentication, these frameworks can:
Mock the Authentication Callbacks: By hooking into the
onAuthenticationSucceeded
,onAuthenticationFailed
, oronAuthenticationError
methods of theBiometricPrompt.AuthenticationCallback
, you can control the outcome of the fingerprint authentication process.Bypass SSL Pinning: This allows an attacker to intercept and modify the traffic between the client and the server, potentially altering the authentication process or stealing sensitive data.
Example command for Frida:
Method 4 – Reverse Engineering & Code Modification
Reverse engineering tools like APKTool
, dex2jar
, and JD-GUI
can be used to decompile an Android application, read its source code, and understand its authentication mechanism. The steps generally include:
Decompiling the APK: Convert the APK file to a more human-readable format (like Java code).
Analyzing the Code: Look for the implementation of fingerprint authentication and identify potential weaknesses (like fallback mechanisms or improper validation checks).
Recompiling the APK: After modifying the code to bypass fingerprint authentication, the application is recompiled, signed, and installed on the device for testing.
Method 5 – Using Custom Authentication Tools
There are specialized tools and scripts designed to test and bypass authentication mechanisms. For instance:
MAGISK Modules: MAGISK is a tool for Android that allows users to root their devices and add modules that can modify or spoof hardware-level information, including fingerprints.
Custom-built Scripts: Scripts can be written to interact with the Android Debug Bridge (ADB) or directly with the application's backend to simulate or bypass fingerprint authentication.
References
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated