bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Biometric database with 27.8 million entries unsecured on the net

Summary

In 2019 researchers from vpnMentor found the “Biostar 2” biometric database of the manufacturer Suprema largely unprotected on the net. Using a normal browser, they reached 27.8 million entries totalling 23 gigabytes, including unencrypted user names and passwords, more than a million fingerprints and facial images. The system controlled access control, including via Nedap’s AEOS platform at more than 5,700 organisations in 83 countries.

Ideas

  • Simple port scans were enough to find the open database.
  • Manipulated search parameters in the URL released the data.
  • With admin access, attackers could have locked people out of buildings or tracked entries.
  • Unlike passwords, biometric features cannot be changed.

Insights

  • A biometric data leak is permanent, because fingerprints cannot be replaced.
  • Physical security systems inherit the weaknesses of their cloud platform.

Facts

  • The data comprised 27.8 million entries totalling 23 gigabytes.
  • In Germany, the supplier Identbase is said to have been affected.
  • Suprema stored complete biometric data instead of irreversible hash values.
  • After being reported on 7 August, the hole was closed on 13 August 2019.

References

Critique

  • The report is based mainly on information from the finders, who also market a VPN service.

Recommendations

  • Store biometric data, if at all, only as irreversible features and locally.
  • With cloud access control systems, check where the data is stored and how access is protected.

Read the original article

Search the Web Archive

hß · 2026

iX workshop: hardening Linux servers with encryption and access control

In 2026 heise again advertised the five-day iX workshop “Hardening Linux servers” with Florian Winkler of B1 Systems, this time with dates in September and November. Topics range from physical security through encryption, two-factor authentication and SELinux/AppArmor to logging, monitoring and intrusion detection. The target group is Linux administrators and security officers who want to secure their servers systematically.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.

hß · 2006

IBM closes security holes in Informix database

In August 2006 IBM published updates for several holes in Informix Dynamic Server that NGSSoftware had already reported in January 2005. Functions such as LOTOFILE and SET DEBUG FILE could be used to write arbitrary files, and there were also numerous buffer overflows in SQL functions and at protocol level. One cause of the protocol bugs was the C function getname(), which copies strings unchecked like strcpy().