Incident: Security Vulnerability in Samsung Galaxy S5 Fingerprint Scanner

Published Date: 2014-04-15

Postmortem Analysis
Timeline 1. The software failure incident of hacking into the Galaxy S5 using a phony fingerprint happened in April 2014 as reported in Article 26032.
System 1. Samsung Galaxy S5 fingerprint sensor 2. Fingerprint authentication system on the Galaxy S5 3. Security measures associated with the Galaxy S5's fingerprint scanner [26032]
Responsible Organization 1. Security Research Labs (SRLabs) - The researchers from SRLabs were responsible for causing the software failure incident by demonstrating how they were able to hack past the fingerprint security on Samsung's Galaxy S5 smartphone [26032].
Impacted Organization 1. Samsung - The software failure incident impacted Samsung as the fingerprint sensor on its Galaxy S5 smartphone was hacked, exposing a critical flaw in the security implementation [26032].
Software Causes 1. Inadequate security protection with the fingerprint sensor on Samsung's Galaxy S5 smartphone, allowing for multiple incorrect attempts without requiring a password [26032].
Non-software Causes 1. Lack of adequate security protection in the design of the fingerprint sensor on the Galaxy S5 smartphone [26032].
Impacts 1. The software failure incident allowed researchers to bypass the fingerprint security on Samsung's Galaxy S5 smartphone by creating a "wood glue spoof" from a fingerprint smudge photo, similar to a technique used to hack Apple's iPhone 5S [26032]. 2. The flaw in the Galaxy S5's fingerprint scanner allowed for multiple incorrect attempts without requiring a password, potentially enabling unauthorized access to the device [26032]. 3. Once the initial fingerprint scan gained entry to the phone, the software failure incident allowed access to secure apps like PayPal without further security or identification, potentially compromising sensitive information [26032].
Preventions 1. Implementing a more secure fingerprint authentication system that is not easily bypassed by spoofing techniques like the "wood glue spoof" used in the hack [26032]. 2. Limiting the number of incorrect attempts allowed before requiring a password, to prevent brute force attacks like the one demonstrated in the hack [26032]. 3. Requiring additional authentication steps for accessing sensitive apps and services, even after the initial fingerprint scan, to add an extra layer of security [26032].
Fixes 1. Implement a stricter security protocol for the fingerprint scanner on the Galaxy S5, such as limiting the number of incorrect attempts before requiring a password [Article 26032]. 2. Enhance the security features related to the fingerprint scan's association with secure apps and services to prevent unauthorized access even after initial entry [Article 26032]. 3. Conduct thorough testing and validation of the fingerprint authentication system to identify and address vulnerabilities before the product release [Article 26032].
References 1. Security Research Labs (SRLabs) [Article 26032] 2. PayPal [Article 26032] 3. Samsung [Article 26032] 4. CNET [Article 26032] 5. ArsTechnica [Article 26032]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident of hacking into a smartphone using a phony fingerprint has happened before with Apple's iPhone 5S. The same technique used to hack past the fingerprint scanner in the Galaxy S5 was previously employed to hack the fingerprint scanner in Apple's iPhone 5S [26032]. (b) The software failure incident of inadequate security protection with the fingerprint sensor on the Galaxy S5 has also happened with Apple's iPhone 5S. Both incidents involved flaws in the fingerprint scanner technology that allowed for bypassing the security measures [26032].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. The researchers were able to hack past the fingerprint security of the Galaxy S5 smartphone due to a critical flaw in the design of the fingerprint scanner. Specifically, the flaw allowed for multiple incorrect attempts without requiring a password, enabling someone to keep trying different fingerprint spoofs until access was gained [26032]. (b) The software failure incident related to the operation phase is also highlighted in the article. Once the initial scan gained entry to the phone, the person was able to open secure apps like PayPal with no further security or identification required. This indicates a failure in the operation phase where the system allowed unauthorized access to sensitive apps and services without proper authentication [26032].
Boundary (Internal/External) within_system (a) within_system: The software failure incident in this case, the hacking into the Galaxy S5 using a phony fingerprint, can be categorized as a within_system failure. The failure originated from within the system itself, specifically from the inadequate security protection provided by Samsung's implementation of the fingerprint sensor on the Galaxy S5 smartphone. The flaw in the fingerprint scanner allowing multiple incorrect attempts without requiring a password was a critical vulnerability within the system [26032].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is primarily due to non-human actions. The failure occurred as a result of a flaw in the fingerprint authentication system of the Samsung Galaxy S5 smartphone. Researchers from Security Research Labs were able to hack past the fingerprint sensor by creating a "wood glue spoof" from a mold taken from a photo of a fingerprint smudge left on a smartphone screen. This flaw allowed for multiple incorrect attempts without requiring a password, enabling unauthorized access to the device and associated secure apps like PayPal [26032]. (b) However, human actions also played a role in this software failure incident. The researchers actively exploited the vulnerability in the fingerprint authentication system by creating a spoof and demonstrating the hack. Additionally, the researchers from Security Research Labs highlighted the security concerns and flaws in Samsung's implementation of fingerprint authentication, indicating that human actions in terms of design and implementation decisions contributed to the failure [26032].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article reports a software failure incident related to the Samsung Galaxy S5's fingerprint sensor, which is a hardware component. Researchers were able to hack past the fingerprint security by using a "wood glue spoof" made from a mold taken from a photo of a fingerprint smudge left on a smartphone screen, indicating a vulnerability in the hardware component [26032]. (b) The software failure incident related to software: - The software failure incident in the article is primarily due to a flaw in the software implementation of the fingerprint authentication feature on the Samsung Galaxy S5. The fingerprint scanner allowed for multiple incorrect attempts without requiring a password, enabling potential unauthorized access. This flaw in the software implementation raised security concerns and allowed access to secure apps like PayPal without further security checks [26032].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The researchers from Security Research Labs were able to hack past the fingerprint security of the Samsung Galaxy S5 smartphone by using a "wood glue spoof" made from a mold taken from a photo of a fingerprint smudge left on a smartphone screen. This hack allowed unauthorized access to the device and even enabled the hacker to log in to secure apps like PayPal without further security checks [26032].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The failure was due to contributing factors introduced by poor decisions made in the implementation of the fingerprint authentication feature on the Samsung Galaxy S5 smartphone. The researchers highlighted the critical flaw in the fingerprint scanner that allowed for multiple incorrect attempts without requiring a password, potentially enabling unauthorized access. This design flaw raised security concerns and was criticized for not providing adequate protection [26032].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Article 26032 can be attributed to development incompetence. The researchers from Security Research Labs were able to hack past the fingerprint sensor on the Galaxy S5 smartphone due to a critical flaw in Samsung's implementation of the fingerprint authentication system. The flaw allowed for multiple incorrect attempts without requiring a password, enabling someone to keep trying different fingerprint spoofs until access was gained. This lack of adequate security protection in the development of the fingerprint scanner highlights a professional competence issue in ensuring robust security measures in the software. (b) Additionally, the incident can also be categorized as accidental. The researchers accidentally discovered the vulnerability in the Galaxy S5's fingerprint scanner and demonstrated the hack using a "wood glue spoof" made from a mold taken from a photo of a fingerprint smudge left on a smartphone screen. The accidental discovery of this security flaw showcases how unintended vulnerabilities can be exploited by individuals with malicious intent, highlighting the accidental nature of the software failure incident.
Duration temporary The software failure incident described in the article is more likely to be categorized as a temporary failure. This is because the failure was due to a specific vulnerability in the fingerprint authentication system of the Samsung Galaxy S5 smartphone, which allowed researchers to bypass the security measures using a spoof made from a fingerprint smudge [26032]. The incident was not a permanent failure affecting the entire system but rather a specific flaw in the fingerprint scanner implementation.
Behaviour other (a) crash: The software failure incident in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is related to a security vulnerability in the fingerprint scanner of the Samsung Galaxy S5 smartphone, allowing unauthorized access through fingerprint spoofing [Article 26032].

IoT System Layer

Layer Option Rationale
Perception embedded_software The software failure incident reported in the article [26032] is related to the embedded software layer of the cyber physical system. The failure was specifically related to the fingerprint authentication feature implemented by Samsung on the Galaxy S5 smartphone. The researchers were able to bypass the fingerprint security by exploiting a flaw in the embedded software that allowed multiple incorrect attempts without requiring a password. This flaw in the embedded software layer enabled the hack to be successful, compromising the security of the device and allowing unauthorized access to secure apps and services like PayPal.
Communication unknown Unknown
Application TRUE The software failure incident reported in Article 26032 is related to the application layer of the cyber physical system. The failure was due to a flaw in the implementation of the fingerprint authentication feature on Samsung's Galaxy S5 smartphone. The researchers were able to bypass the fingerprint security by using a "wood glue spoof" made from a mold taken from a photo of a fingerprint smudge left on a smartphone screen. This flaw allowed for multiple incorrect attempts without requiring a password, enabling potential unauthorized access to the device and associated secure apps like PayPal [26032].

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident reported in the article [26032]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [26032]. (c) basic: The incident did not impact people's access to food or shelter [26032]. (d) property: The software failure incident did impact people's material goods, money, or data as it allowed unauthorized access to secure apps like PayPal, potentially compromising the owner's account [26032]. (e) delay: There is no mention of any activities being postponed due to the software failure incident [26032]. (f) non-human: The software failure incident impacted the security of the Galaxy S5 smartphone's fingerprint sensor, which is a non-human entity [26032]. (g) no_consequence: The article does not mention that there were no real observed consequences of the software failure incident [26032]. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident, such as security concerns raised by the researchers regarding the fingerprint authentication on the Galaxy S5 [26032]. (i) other: There are no other consequences of the software failure incident mentioned in the article [26032].
Domain finance (a) The failed system in this incident was related to the finance industry. The software failure incident involved the security vulnerability of the fingerprint scanner on Samsung's Galaxy S5 smartphone, which could potentially allow unauthorized access to sensitive financial apps like PayPal [Article 26032].

Sources

Back to List