FYI
Confirmed: Apple-owned fingerprint software exposes Windows passwords | Ars Technica
-
Thors.Hammer Notebook Enthusiast
Thanks for the heads up. We don't allow fingerprint login in my company. Good thing.
-
It only affects the Thinkvantage tool. Uninstalling the tool, and just using the Windows built-in biometrics support for login, is unaffected.
As to the vulnerability itself, it's actually not very serious. To exploit the vulnerability user must be convinced to execute a tool made by attacker with administrative rights. And if user does that, the attacker is free to install a keylogger and use the system as his own anyway. -
"From a penetration testing perspective, local administrator access is required to obtain the necessary registry key's value, so it only matters if you already have control of the PC,"
Hence this does not bother me.
ThinkVantage Fingerprint Software vulnerability
Discussion in 'Lenovo' started by AofI, Oct 9, 2012.