German government report details Windows Hello for Business biometric security limitations

Germany’s Federal Office for Information Security (BSI) published a technical analysis of Windows Hello for Business, detailing how the system performs biometric identification and highlighting potential security vulnerabilities. The study, conducted by ERNW on behalf of the BSI, utilized debugging and reverse engineering techniques to examine the internal processes of Windows 10 Enterprise LTSC 2021, with a specific focus on facial recognition, as first reported by Biometric Update.

The BSI report identifies limitations in Windows Hello for Business when Enhanced Sign-in Security (ESS) is not enabled. While the Trusted Platform Module (TPM) can protect the enterprise authentication key, it does not fully secure all biometric data and processes. The study found that the information required to access the encrypted biometric template database is available on the same computer, creating a gap where a privileged attacker could potentially modify enrollment records. This could allow an attacker to associate a different user's identity with a successful biometric match. Furthermore, the research revealed that the system could be vulnerable to presentation attacks, as demonstrated by the successful enrollment and authentication using a facial mask. Degraded enrollment conditions, such as enrolling with accessories like scarves and glasses, also led to incorrect authentications by another individual. The report emphasizes that the overall security of biometric authentication relies heavily on device configuration, hardware, enrollment permissions, local administrator access control, and the implementation of ESS.

Source: Biometric Update