fingerprint entrance technology

Security Company Exposes Fingerprint, Facial Recognition Data of Over 1 Million Users

Suprema, which operates the Biostar 2 biometric smart lock system, leaked over 27.8 million records in a publicly accessible database discovered by security researchers.

A publicly accessible database holding the biometric and personal information of over 1 million people ⁠— including fingerprints, facial recognition data and unencrypted usernames and passwords ⁠— was discovered online in what security researchers are calling a “huge data breach” in a new report released Wednesday.

Two researchers and a team at vpnMentor were able to access over 27.8 million records maintained by Suprema, a security company that operates the web-based Biostar 2 biometric smart lock system responsible for access control to warehouses, office buildings and more. The company recently integrated the Biostar 2 platform into the AEOS access control system, which is used by 5,700 organizations across the world, including banks, police forces and governments, The Guardian reported.

Researchers Noam Rotem and Ran Locar found that since the database included encrypted username and password information, they were able to easily create and modify user credentials. In turn, hackers would be able to gain access to any building using the platform by either editing an existing user’s account or adding themselves as users with photographs and fingerprints.

“Putting all the data found in the leak together, criminals of all kinds could use this information for varied illegal and dangerous activities,” the researchers wrote, noting that fingerprint and facial recognition information cannot be retrieved once stolen, potentially affecting people for the rest of their lives.

Since Rotem and Locar alerted Suprema to the issue, the vulnerability was closed, but the pair had not heard directly from the company. In a statement to The Guardian, the company’s head of marketing, Andy Ahn, said Suprema had taken an “in-depth” evaluation of the research’s findings and would inform customers if there was a threat.

It was not immediately clear if the database had been accessed by unauthorized users before Suprema took action. But the team at vpnMentor remained troubled by the methods Suprema used to secure the data, which left it vulnerable to malicious actors.

“The unsecured manner in which BioStar 2 stores this information is worrying, considering its importance, and the fact that BioStar 2 is built by a security company,” the researchers wrote. “Instead of saving a hash of the fingerprint (that can’t be reverse-engineered) they are saving people’s actual fingerprints that can be copied for malicious purposes."

Security experts noted that multi-factor authentication could help mitigate similar breaches by preventing hackers from entering a building with only one means of identification. But this only works if organizations maintaining identification data do not keep it all within the same system, as Suprema appeared to in this case.

“As long as I can’t get access to a system or building with only one factor, then the compromise of my password, key card or fingerprint doesn’t result in compromise of the whole system,” said Tim Erlin, vice president of product management and strategy at Tripwire. “Of course, if these factors are stored or alterable from a single system, then there remains a single point of failure.”

Robert Capps, a vice president and authentication strategist at NuData Security, said that it’s unclear if the fingerprint data is full resolution or templatized, which would make it difficult for hackers to use the files. However, he said, the other information included in the leak could be used to access financial services accounts.

“It is advisable, therefore, that any company using Biostar 2 for physical access should make plans to ensure their facilities remain secure until the full scope of the vulnerability is known, and consumers whose information was contained in the breach, take precautions to protect any accounts related to the information disclosed in the breach,” Capps said.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.