Touch ID and Face ID. Is It Secure?

Transcript

1. OWASP ZHYTOMYR. 29 JUNE 2019. JULIA POTAPENKO
   TOUCH ID AND FACE ID
   IS IT SECURE?
   

   View Slide

2. OWASP ZHYTOMYR. 29 JUNE 2019. JULIA POTAPENKO
   TOUCH ID AND FACE ID
   IS IT SECURE?
   Cats Edition
   

   View Slide

3. JULIA POTAPENKO
   • iOS Software Engineer at Stuzo
   • Mobile Dev Lead at WWCode Kyiv
   • Co-organizer of OWASP Zhytomyr
   • Speaker at OWASP, CocoaHeads,
   WWCode and WTM events
   

   View Slide

4. WE WILL TALK ABOUT
   ★ Touch ID and Face ID
   ★ Secure Enclave
   ★ Keychain
   

   View Slide

5. WE WILL TALK ABOUT
   ★ Touch ID and Face ID
   ★ Secure Enclave
   ★ Keychain
   How to do it?
   What can go wrong?
   

   View Slide

6. TOUCH ID AND FACE ID
   LOCAL AUTHENTICATION
   

   View Slide

7. TOUCH ID AND FACE ID
   LOCAL AUTHENTICATION
   USER
   PROTECTED
   RESOURCES
   PROTECTED
   ACTIONS
   

   View Slide

8. LOCAL AUTHENTICATION
   https://support.apple.com/en-us/HT204587
   https://developer.apple.com/documentation/localauthentication
   

   View Slide

9. SECURE ENCLAVE
   CREATE AN EXTRA LAYER OF SECURITY FOR YOUR PRIVATE KEYS.
   https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/
   storing_keys_in_the_secure_enclave
   

   View Slide

10. SECURE ENCLAVE
    • A part of A7 and newer chips
    • Secure Enclave Processor (SEP)
    is separate from Application
    Processor (AP)
    • Shares the RAM with AP but
    encrypted (TZ0)
    • SEP has its own OS
    

    View Slide

11. SECURE ENCLAVE
    • Stores only 256-bit elliptic curve private keys
    • Can’t import preexisting keys
    You can create private key, store it and perform operations on it.
    

    View Slide

12. • Biometry is stored on device as mathematical
    representation
    • It is encrypted with a private key stored in Secure Enclave
    • Biometry data is used by Secure Enclave only
    • It can’t be accessed by OS or any application
    

    View Slide

13. LocalAuthentication
    • Specify a particular policy and user message
    • The framework coordinates with Secure Enclave
    • Validation returns boolean value
    

    View Slide

14. LocalAuthentication
    • Specify a particular policy and user message
    • The framework coordinates with Secure Enclave
    • Validation returns boolean value
    WARNING
    

    View Slide

15. LAContext *myContext = [[LAContext alloc] init];
    NSError *authError = nil;
    NSString *myLocalizedReasonString = @"For Securing App with TouchID";
    if ([myContext canEvaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    error:&authError]) {
    [myContext evaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    localizedReason:myLocalizedReasonString
    reply:^(BOOL) success, NSError *error) {
    if (success) {
    // User authenticated successfully
    } else {
    // User failed to authenticate successfully
    }
    }];
    } else {
    // Could not evaluate policy
    https://nvisium.com/blog/2016/06/22/dont-touch-me-that-way.html
    LocalAuthentication
    

    View Slide

16. LAContext *myContext = [[LAContext alloc] init];
    NSError *authError = nil;
    NSString *myLocalizedReasonString = @"For Securing App with TouchID";
    if ([myContext canEvaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    error:&authError]) {
    [myContext evaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    localizedReason:myLocalizedReasonString
    reply:^(BOOL) success, NSError *error) {
    if (success) {
    // User authenticated successfully
    } else {
    // User failed to authenticate successfully
    }
    }];
    } else {
    // Could not evaluate policy
    https://nvisium.com/blog/2016/06/22/dont-touch-me-that-way.html
    LocalAuthentication
    

    View Slide

17. LAContext *myContext = [[LAContext alloc] init];
    NSError *authError = nil;
    NSString *myLocalizedReasonString = @"For Securing App with TouchID";
    if ([myContext canEvaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    error:&authError]) {
    [myContext evaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    localizedReason:myLocalizedReasonString
    reply:^(BOOL) success, NSError *error) {
    if (success) {
    // User authenticated successfully
    } else {
    // User failed to authenticate successfully
    }
    }];
    } else {
    // Could not evaluate policy
    https://nvisium.com/blog/2016/06/22/dont-touch-me-that-way.html
    VULNERABLE AGAINST REVERSE ENGINEERS
    LocalAuthentication
    

    View Slide

18. LAContext *myContext = [[LAContext alloc] init];
    NSError *authError = nil;
    NSString *myLocalizedReasonString = @"For Securing App with TouchID";
    if ([myContext canEvaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    error:&authError]) {
    [myContext evaluatePolicy:LAPolicyDeviceOwnerAuthenticationWithBiometrics
    localizedReason:myLocalizedReasonString
    reply:^(BOOL) success, NSError *error) {
    if (success) {
    // User authenticated successfully
    } else {
    // User failed to authenticate successfully
    }
    }];
    } else {
    // Could not evaluate policy
    https://nvisium.com/blog/2016/06/22/dont-touch-me-that-way.html
    VULNERABLE AGAINST REVERSE ENGINEERS
    LocalAuthentication
    USABLE PAYLOAD
    

    View Slide

19. KEYCHAIN
    

    View Slide

20. KEYCHAIN
    • A database storing encrypted items
    • Good for storing passwords, tokens, not for files
    • Each item is protected by passcode/biometry and device
    secret
    • Keychain items are available when user authenticates to
    the device
    

    View Slide

21. View Slide

22. THE CORRECT FLOW EXAMPLE
    • The user secret is stored in Keychain.
    • When the protected action is triggered, Keychain should
    be unlocked with Touch ID to get the secret.
    • BE should enforce the client to include that secret when
    the protected action is performed.
    

    View Slide

23. THE CORRECT FLOW EXAMPLE
    • The user secret is stored in Keychain.
    • When the protected action is triggered, Keychain should
    be unlocked with Touch ID to get the secret.
    • BE should enforce the client to include that secret when
    the protected action is performed.
    WHAT ELSE CAN GO WRONG?
    

    View Slide

24. KEYCHAIN
    • Accessibility and authentication rules
    

    View Slide

25. KEYCHAIN
    • Accessibility and authentication rules
    SecAccessControlRef
    • kSecAccessControlTouchIDAny – Use any of the registered fingerprints
    • kSecAccessControlTouchIDCurrentSet – Use the current set of fingerprints
    when data saved to keychain. If current set changes, the TouchID
    evaluation fails.
    

    View Slide

26. View Slide

27. ANY VULNERABILITIES IN
    SECURE ENCLAVE?
    

    View Slide

28. https://twitter.com/xerub/status/897896081874329600
    HACKER CLAIMS TO HAVE DECRYPTED
    SECURE ENCLAVE
    

    View Slide

29. https://twitter.com/xerub/status/897896081874329600
    HACKER CLAIMS TO HAVE DECRYPTED
    SECURE ENCLAVE
    

    View Slide

30. https://youtu.be/ei6NWGfRs2o
    Apple Secure Enclave Processor Hack Explained
    • Firmware decryption key for iPhone 5s only
    

    View Slide

31. IS IT SECURE?
    ★ Chance that someone else fingerprint will unlock
    you device is 1 in 50 000
    ★ For Face ID it is 1 in 1 000 000
    https://images.apple.com/business/docs/FaceID_Security_Guide.pdf
    

    View Slide

32. IS IT SECURE?
    ★ Chance that someone else fingerprint will unlock
    you device is 1 in 50 000
    ★ For Face ID it is 1 in 1 000 000
    ★ To compare: 4 digit passcode has 1 in 10 000
    chance while 6 digit passcode has 1 in 1 000 000
    https://images.apple.com/business/docs/FaceID_Security_Guide.pdf
    

    View Slide

33. TOUCH ID AND FACE ID
    ARE VULNERABLE AGAINST TARGETED ATTACKS
    https://youtu.be/2u4ZLGsw1zo
    

    View Slide

34. View Slide

35. WHERE TO GO NEXT
    OWASP MSTG – Testing Local Authentication
    https://github.com/OWASP/owasp-mstg/blob/master/Document/0x06f-Testing-Local-
    Authentication.md
    iOS Security Guide
    https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf
    WWDC 14 – Keychain and Authentication with Touch ID
    https://devstreaming-cdn.apple.com/videos/wwdc/
    2014/711xx6j5wzufu78/711/711_keychain_and_authentication_with_touch_id.pdf
    David Lindner – Don’t Touch Me That Way
    https://nvisium.com/blog/2016/06/22/dont-touch-me-that-way.html
    

    View Slide

36. https://speakerdeck.com/julep/
    owasp-mstg-in-real-life
    https://speakerdeck.com/julep/owasp-
    mstg-when-authentication-goes-wrong
    OTHER TALKS
    https://www.facebook.com/julia.potapenko.16
    https://t.me/OWASP_ZHYTOMYR_CHAT
    

    View Slide

37. THANK YOU!
    

    View Slide