
Despite Microsoft's efforts to give users a better security for the IT&C environment, it seems that there are some misunderstandings in Redmond; otherwise it's hard to understand why the company chooses to provide hackers with the right tool for their operations.
This time it's not about the Windows operating system or any other software product, the culprit
being a hardware device.
According to PC World, a Finnish security researcher was intrigued that Microsoft warns its users about Fingerprint Reader, a device which eases the authentication procedure. The company says that the device should not be used to protect confidential data, but for convenience.
In a report presented last week at the Black Hat Europe conference, the event which reunites hackers and security professionals, Mikko Kiviharju shows how hackers can get their hands on the image scanned by the device.
Although a potential attacker needs to have a good knowledge about security in order to steal the user's fingerprint, Microsoft's decision to prevent its clients from feeling completely secure is strange, to say the least, especially since protecting the image is not a difficult task.
As Mikko Kiviharju explains, Microsoft doesn't encrypt the image scanned by the Fingerprint Reader creating in this way an exploitable vulnerability. The Finnish researcher also says that the procedure to encrypt the image is rather simple for Microsoft, only a few firmware modifications being required.