nerdexam
EC-Council

312-50V9 · Question #39

What is the main reason the use of a stored biometric is vulnerable to an attack?

The correct answer is D. A stored biometric can be stolen and used by an attacker to impersonate the individual identified. Stored biometrics are vulnerable because the digital representation can be exfiltrated and replayed by an attacker, bypassing the authentication system entirely.

Introduction to Ethical Hacking

Question

What is the main reason the use of a stored biometric is vulnerable to an attack?

Options

  • AThe digital representation of the biometric might not be unique, even if the physical characteristic
  • BAuthentication using a stored biometric compares a copy to a copy instead of the original to a
  • CA stored biometric is no longer "something you are" and instead becomes "something you have".
  • DA stored biometric can be stolen and used by an attacker to impersonate the individual identified

How the community answered

(28 responses)
  • A
    11% (3)
  • B
    4% (1)
  • C
    7% (2)
  • D
    79% (22)

Why each option

Stored biometrics are vulnerable because the digital representation can be exfiltrated and replayed by an attacker, bypassing the authentication system entirely.

AThe digital representation of the biometric might not be unique, even if the physical characteristic

Biometric characteristics such as fingerprints and iris patterns are highly unique among individuals, so non-uniqueness is not the primary vulnerability of stored biometrics.

BAuthentication using a stored biometric compares a copy to a copy instead of the original to a

While authentication does compare a live scan against a stored template, the fundamental vulnerability is not the copy-vs-copy comparison process but rather the risk of theft and replay of the stored copy.

CA stored biometric is no longer "something you are" and instead becomes "something you have".

Reclassifying a biometric as 'something you have' is a conceptual observation about authentication factors, not a technical attack vector that makes stored biometrics vulnerable.

DA stored biometric can be stolen and used by an attacker to impersonate the individual identifiedCorrect

Once a biometric is stored digitally, it becomes a data artifact that can be stolen from a database, intercepted in transit, or extracted from a device. An attacker who obtains the stored biometric template or hash can replay it against the authentication system to impersonate the legitimate user, which is the core attack vector. This is why systems like Windows Hello store biometric data in a Trusted Platform Module (TPM) to limit exfiltration risk.

Concept tested: Biometric authentication attack vectors and replay risk

Source: https://csrc.nist.gov/publications/detail/sp/800-76/2/final

Topics

#stored biometric#biometric vulnerability#impersonation attack#authentication weakness

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice