bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Lenovo admits security holes in Fingerprint Manager

Summary

In January 2018 Lenovo admitted holes in its Fingerprint Manager Pro software, which managed biometric data on computers running Windows 7, 8 and 8.1. The software used a weak encryption algorithm, contained a hard-coded password and was accessible to local users without special rights. Windows 10 was not affected because Windows Hello takes over the function there.

Ideas

  • A hard-coded password renders any encryption worthless.
  • Biometric data was stored on the device for websites and logins.
  • Functions integrated into the operating system replaced manufacturer software.

Insights

  • Additional software from device manufacturers is often less well secured than the operating system.
  • With biometrics, leaks weigh more heavily because fingerprints cannot be replaced.

Facts

  • The holes were discovered by Jackson Turaisamy of Security Compass.
  • Lenovo did not name the algorithm used.
  • Lenovo recommended an update to version 8.01.87 or newer.

References

Critique

  • The report does not say whether stored credentials had to be re-encrypted or deleted after the update.

Recommendations

  • Remove preinstalled manufacturer software whose function the operating system itself provides.
  • Store biometric data only in the device’s dedicated security hardware.

Read the original article

Search the Web Archive

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

g · 2023

Cisco warns of security holes it will not patch

In January 2023 Cisco warned of critical holes in the small business routers RV016, RV042, RV042G and RV082, but announced that it would not deliver any more updates. Manipulated HTTP requests to the web interface could bypass authentication and gain root access (CVE-2023-20025). As the devices had reached end of life, Cisco only pointed to blocking ports 443 and 60443, although proof-of-concept code already existed.

g · 2013

Critical security hole in the Security Manager

In January 2013 an already actively exploited hole became known in the Security Manager of Java 7 up to and including Update 10. A combination of JMX MBean and internal JavaScript classes in an applet could be used to bypass the Security Manager and execute code from websites. US-CERT recommended disabling Java in the browser; there was no patch from Oracle yet.