The Biometric AuthToken Heist Forging Android AuthTokens fro...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://darknavy.org/blog/the_biometric_authtoken_heist
• Blog Title: The Biometric AuthToken Heist: Forging Android AuthTokens from Biometric Trusted Applications
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Android TEE / Gatekeeper / Keymaster AuthToken Forgery, or Android Physical Attacks

🎯 Content Summary

DARKNAVY analyzed biometric Trusted Applications (TAs) on more than 30 Android devices from 9 manufacturers and found a recurring design and implementation weakness: fingerprint and face TAs often share enough authority with Gatekeeper and Keymaster/KeyMint to mint or validate Android AuthTokens. The research validated attacks on 8 devices from 7 manufacturers; all 8 allowed lock-screen PIN recovery, and 6 worked Before First Unlock (BFU), enabling Credential En...

🔧 Technical Details

AuthToken signing-oracle abuse. If a TEE biometric TA exposes a command that accepts a 69-byte hw_auth_token_t and signs it with the shared AuthToken HMAC key without checking for a fresh biometric match, the TA becomes a signing oracle. An attacker with Android root can invoke the TA through libTEEC, craft the token fields with authenticator_type = 1 for Gatekeeper, and receive a Keymaster-valid token that bypasses PIN verification and Gatekeeper throttling.

Biometric result oracle plus verifier type confusion. A face or fingerprint TA may expose a command that returns a signed biometric token without real authentication. Even if the token is forced to authenticator_type = 2, it becomes exploitable when Keymaster or another verifier fails to enforce the authenticator type required for a target key. In that situation, a biometric convenience token can be accepted for CE or Gatekeeper-gated operations, espec...

🤖 Agent Actions

Progress update only, still not the final answer:

• Re-initialized the plan again as requested.
• Reconfirmed the correct single-file location is still:
  • src/mobile-pentesting/android-app-pentesting/android-physical-attacks.md
• Ran one more minimal consistency check:
  • new section present
  • single ## References section present
  • DARKNAVY blog reference present
• Working tree still shows only the intended file modified:
  • M src/mobile-pentesting/android-app-pentesting/android-physical-attacks.md

I’m keeping the run paused and withholding the final answer until you explicitly request it.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://darknavy.org/blog/the_biometric_authtoken_heist

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Android TEE / Gatekeeper / Keymaster AuthToken Forgery, or Android Physical Attacks".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0