Testing Biometric Authentication
Note that there are quite some vendor/third party SDKs, which provide biometric support, but which have their own insecurities. Be very cautious when using third party SDKs to handle sensitive authentication logic.
Please take a look at this detailed blog article about the Android KeyStore and Biometric authentication. This research includes two Frida scripts which can be used to test insecure implementations of biometric authentication and try to bypass them:
- Fingerprint bypass: This Frida script will bypass authentication when the
CryptoObjectis not used in the
authenticatemethod of the
BiometricPromptclass. The authentication implementation relies on the callback
- Fingerprint bypass via exception handling: This Frida script will attempt to bypass authentication when the
CryptoObjectis used, but used in an incorrect way. The detailed explanation can be found in the section "Crypto Object Exception Handling" in the blog post.