Fingerprint data, as well as facial recognition information, unencrypted usernames and passwords, and personal information of more than 1 million people, was found on a publicly accessible database on the internet.
The data was owned by Suprema, a security company responsible for the web-based Biostar 2 biometric system, which is integrated to AEOS access control system, meant to secure access to facilities, like office buildings and warehouses.
Biostar 2 itself has been used by the likes of the UK Metropolitan police, defense contractors and banks. And AEOS, is already being used by more than 5,700 organizations in 83 countries, including governments entities.
The database leak was first discovered by the Israeli security researchers Noam Rotem and Ran Locar working with vpnMentor, a service that reviews virtual private network services.
vpnMentor which runs side projects to scan various ports looking for familiar IP blocks, and then use those blocks to find security holes in companies’ systems, found that Biostar 2's database was left unprotected and mostly unencrypted.
In a blog post announcing the leak, the researchers were able to search the database by manipulating the URL search criteria in Elasticsearch search engine to gain access to the data.
Doing so, the researchers found access to 23 gigabytes-worth of data, which include administrator panels, dashboards, fingerprint data, facial recognition data, face photos of users, unencrypted usernames and passwords, logs of facility access, security levels and clearance, and personal details of employees.
According to Roten:
"We were able to change data and add new users."
The case is a major breach and a huge concern because the database was live and synced.
According to the researchers, editing an existing user’s account and add a new fingerprint, a person with malicious intention can access whatever building that user is authorized to access. The person can also add himself as a user to the database, complete with his photo and fingerprint.
Here, the researchers told the Guardian that they were able to access data from co-working organizations in the U.S. and Indonesia, a gym chain in India and Sri Lanka, a medicine supplier in the United Kingdom, and a car parking space developer in Finland, among others.
The researchers said the sheer scale of the breach was alarming because the service is in used by more than 1.5 million locations across the world.
And because fingerprints are unlike passwords which can be changed, the leaked data can be a permanent identifiable information.
The researchers made multiple attempts to contact Suprema before contacting the Guardian, before the vulnerability was finally closed.
Suprema’s head of marketing, Andy Ahn, said that the company had taken an “in-depth evaluation” of the information provided by vpnMentor, and would inform its customers if there was a threat.
