PTKDMobile App Security
Knowledge base / PTKD-AUTH-BIOMETRIC-NOCRYPTO
medium M3 MASVS-AUTH-2 static analysis PTKD-AUTH-BIOMETRIC-NOCRYPTO

Biometric authentication not bound to a cryptographic key

The app calls BiometricPrompt.authenticate() without a CryptoObject, so the biometric check is event-bound (a boolean 'it matched') rather than result-bound to a Keystore key. On a rooted device an attacker can instrument the success callback and pass the check without ever presenting a biometric.

How it's exploited

The app gates a sensitive action behind BiometricPrompt.authenticate() but passes no CryptoObject. The check only reports that a biometric matched; it does not unlock a key. On a rooted device an attacker hooks the onAuthenticationSucceeded callback (or the boolean it sets) with Frida and invokes it directly, passing the gate without any fingerprint or face.

Why it matters

The biometric lock is bypassable on a compromised device: local auth on payments, vaults, or 'unlock to reveal secret' screens can be defeated without the user's biometric.

How to fix it

  1. Create a Keystore key with setUserAuthenticationRequired(true) so the key is usable only after a biometric unlock.
  2. Call authenticate(PromptInfo, CryptoObject) with a Cipher/Signature/Mac initialized from that key.
  3. Perform the sensitive operation with the unlocked CryptoObject (encrypt/decrypt/sign), not merely on the success callback firing, so the result is cryptographically bound to the biometric.

References