Report: Data Breach in Biometric Security Platform Affecting Millions of Users
Maybe this is the one that gets us seriously talking about socio-technical systems and the inherent vulnerability of human factor contributions in any system.
Which will win here; blame or learning?
#fraudmanagement #cyberresilience #humanfactor #cyber #rootcauseanalysis
Source: VPN Mentor | August 14, 2019
Led by internet privacy researchers Noam Rotem and Ran Locar, vpnMentor’s team recently discovered a huge data breach in security platform BioStar 2. BioStar 2 is a web-based biometric security smart lock platform. A centralized application, it allows admins to control access to secure areas of facilities, manage user permissions, integrate with 3rd party security apps, and record activity logs.
As part of the biometric software, BioStar 2 uses facial recognition and fingerprinting technology to identify users.
The app is built by Suprema, one of the world’s top 50 security manufacturers, with the highest market share in biometric access control in the EMEA region. Suprema recently partnered with Nedap to integrate BioStar 2 into their AEOS access control system. AEOS is used by over 5,700 organizations in 83 countries, including some of the biggest multinational businesses, many small local businesses, governments, banks, and even the UK Metropolitan Police.
The data leaked in the breach is of a highly sensitive nature. It includes detailed personal information of employees and unencrypted usernames and passwords, giving hackers access to user accounts and permissions at facilities using BioStar 2. Malicious agents could use this to hack into secure facilities and manipulate their security protocols for criminal activities. This is a huge leak that endangers both the businesses and organizations involved, as well as their employees. Our team was able to access over 1 million fingerprint records, as well as facial recognition information. Combined with the personal details, usernames, and passwords, the potential for criminal activity and fraud is massive.
Once stolen, fingerprint and facial recognition information cannot be retrieved. An individual will potentially be affected for the rest of their lives.
Timeline of Discovery and Owner Reaction
After we discovered the breach in BioStar 2’s database, we contacted the company alerting them of our findings.
However, we found BioStar 2 generally very uncooperative throughout this process. Our team made numerous attempts to contact the company over email, to no avail. Eventually, we decided to reach out to BioStar 2’s offices by phone. Again, the company was largely unresponsive.
Upon speaking to a member of their German team, we received a mumbled reply that “we don’t speak to vpnMentor”, before the phone was suddenly hung up. This suggests they were aware of us, and our attempts to resolve the issue.
We also tried to contact BioStar 2’s GDPR compliance officer but received no reply.
Eventually, after speaking to the more cooperative French branch over the phone, steps were taken by the company to close the breach.
- Date discovered: 5th August 2019
- Date vendors contacted: 7th August 2019
- Date of Action: 13th August, the breach was closed