FireEye claims Samsung Galaxy S5 fingerprint vulnerability
23 April 2015 15:56 GMT

Security firm FireEye has this week said that a vulnerability in the Android operation system means malware could potentially steal fingerprint data from devices like the Samsung Galaxy S5’s fingerprint reader before it reaches a secure processor.

FireEye’s Tao Wei and Yulong Zhang are planning to show a presentation on the attack at the RSA conference in San Fransico today which shows how hackers merely need root-level access to Android to intercept the data.

"If the attacker can break the kernel [the core of the Android operating system], although he cannot access the fingerprint data stored in the trusted zone, he can directly read the fingerprint sensor at any time. Every time you touch the fingerprint sensor, the attacker can steal your fingerprint," Zhang was quoted saying to Forbes.

He added that: “You can get the data and from the data you can generate the image of your fingerprint. After that you can do whatever you want.”

A Samsung spokesperson told Forbes over email that it is investigating FireEye’s claims.

The security gap has been plugged on Android 5.0 Lollipop or above, so users should upgrade where they can, the researchers added.

In April 2014, researchers at Germany’s Security Research Labs (SRLabs) posted a video showing how it was possible to spoof the device with lifted fingerprints.