Windows Hello Fingerprint Security Bypassed on Major Laptop Brands

Security researchers have discovered vulnerabilities in the embedded fingerprint sensors of Dell Inspiron, Lenovo ThinkPad, and Microsoft Surface Pro X laptops, allowing them to bypass Windows Hello fingerprint authentication. The researchers successfully exploited security flaws in the fingerprint sensors made by ELAN, Synaptics, and Goodix, using man-in-the-middle attacks and custom Linux-powered devices. Despite Microsoft's Secure Device Connection Protocol (SDCP), which was designed to protect the communication between the fingerprint device and the host, the researchers found that SDCP was not enabled on two out of three of the targeted laptops. They recommend that vendors enable SDCP to enhance the security of biometric authentication solutions.