HTC Caught Storing Images Fingerprints without Protection

image source; TNW news

image source; TNW news

Security researchers have discovered that HTC was storing high-resolution images user’s fingerprints directly on various Android phone with little protection. In a white paper released by FireEye researchers last week, the group outlined how simple it was to recover the image files from an HTC phone, the One Max. In the case of the One Max, HTC saved images of configured fingerprints directly to phone storage at /data/dbgraw.bmp with ‘world-readable’ permissions, meaning any app could steal the user’s fingerprints

Apple uses a “secure enclave” to store fingerprint data, but never saves the actual image so it’s not possible to retrieve a scan of the fingerprint, though a group did successfully break into an iPhone using a silicon representation of a stolen fingerprint but the bug was fixed by HTC after FireEye notified the company of how dangerous it was.

To Top