B - Production Support » BSN CDB Support

Description :

At the time of assessment, LGMS security team successfully bypassed the application's local biometric authentication to gain access to sensitive data as an unauthenticated user.

Attackers can easily bypass local biometric authentication if no data returns from the authentication process. Additionally, the lack of enforcement of authentication at the remote endpoint allows attackers to bypass local authentication and query data from the remote endpoint directly.

LGMS Solution:

Local biometric authentication should always be enforced at a remote endpoint or be based on a cryptographic primitive. For Android, better security for local biometric authentication can be achieved by using the fingerprint API in conjunction with the Android KeyGenerator class. For iOS, it is recommended to leverage the Keychain for implementing local biometric authentication.

Penril Plan :
To integrate new finger print service (Same as android)