Android Biometric Bypass

Android Biometric Authentication Pentesting

A comprehensive skill for testing and bypassing Android biometric authentication mechanisms during security assessments.

When to Use This Skill

Use this skill when:

• Testing Android app security and authentication flows
• Analyzing biometric prompt implementations (FingerprintManager, BiometricPrompt)
• Performing mobile penetration testing on authentication mechanisms
• Reviewing Android Keystore usage and crypto object handling
• Assessing in-app biometric authentication security
• Investigating authentication bypass vulnerabilities

Quick Start

# Basic Frida hook for biometric bypass
frida -U -f <target-package> --no-pause -l scripts/biometric-bypass.js

Method 1: NULL CryptoObject Bypass

Targets apps that don't validate the CryptoObject in onAuthenticationSucceeded().

How It Works

The onAuthenticationSucceeded callback receives an AuthenticationResult containing a CryptoObject. Many apps fail to validate this object, allowing bypass with a NULL crypto object.

Execution

frida -U -f <target-package> --no-pause -l scripts/biometric-bypass-null-crypto.js

Then in the Frida console:

> bypass()

What to Check

• Does the app verify result.cryptoObject is not null?
• Does the app validate the cipher/signature before granting access?
• Are sensitive operations protected by the crypto object?

Method 2: Exception Handling Bypass

For apps that use different cipher objects after authentication.

How It Works

Invokes onAuthenticationSucceeded with an unauthorized CryptoObject. If the app uses a different cipher, it triggers IllegalBlockSizeException. The script handles this and ensures subsequent objects use the new key.

Execution

frida -U -f <target-package> --no-pause -l scripts/biometric-bypass-exception.js

In Frida console:

> bypass()

Method 3: Universal Biometric Bypass (API 28-34)

Community script that hooks all BiometricPrompt.authenticate() overloads and legacy FingerprintManager.authenticate().

Features

• Works on Android 8.0 (API 28) through Android 14 (API 34)
• Hooks both modern and legacy biometric APIs
• Triggers onAuthenticationSucceeded with fabricated AuthenticationResult
• Silent to UI - no biometric dialog appears
• No root required (user-space only)

Execution

frida -U -f <target-package> --no-pause -l scripts/universal-biometric-bypass.js

Limitations

Only works if the target app performs no cryptographic checks on the returned CryptoObject.

Method 4: Downgrade/Fallback Manipulation

Forces weaker authentication requirements at runtime.

How It Works

Hooks setAllowedAuthenticators() to replace strong-only policy with weak/device-credential:

var PromptInfoBuilder = Java.use('androidx.biometric.BiometricPrompt$PromptInfo$Builder');
PromptInfoBuilder.setAllowedAuthenticators.implementation = function(flags){
    console.log('[*] Original flags: 0x' + flags.toString(16));
    return this.setAllowedAuthenticators(0x0002 | 0x8000); // BIOMETRIC_WEAK | DEVICE_CREDENTIAL
};

Execution

frida -U -f <target-package> --no-pause -l scripts/biometric-downgrade.js

What to Test

• Can the app be tricked into accepting PIN/Pattern fallback?
• Does the app validate the authenticator type after authentication?
• Are weak biometrics (face unlock) accepted when strong (fingerprint) was required?

Method 5: Instrumentation Frameworks

Beyond Frida, consider:

• Xposed/LSPosed: System-wide hooking framework
• Magisk Modules: Root-level modifications
• Custom ADB Scripts: Backend interaction simulation

Method 6: Reverse Engineering Approach

For static analysis and code modification:

1. Decompile: apktool d app.apk
2. Analyze: Look for BiometricPrompt, FingerprintManager, KeyStore usage
3. Identify Weaknesses: Missing crypto object validation, fallback mechanisms
4. Modify: Remove authentication checks, recompile, sign, test

Method 7: Vendor/Kernel CVEs

Monitor Android security bulletins for:

• CVE-2023-20995: Pixel 8, Android 13 - captureImage logic error
• CVE-2024-53835/53840: December 2024 Pixel bulletin - biometric bypass

These can chain with app-level flaws for complete bypass.

Hardening Checklist (For Developers)

When reviewing or recommending fixes:

• Enforce setUserAuthenticationRequired(true) on Keystore keys
• Set setInvalidatedByBiometricEnrollment(true) for key generation
• Always verify result.cryptoObject is not null
• Validate cipher/signature before unlocking sensitive features
• Use BIOMETRIC_STRONG only - never fall back to BIOMETRIC_WEAK
• Pin androidx.biometric to latest version (≥1.2.0-beta02)
• Implement server-side authentication for critical operations

Common Vulnerability Patterns

Reporting Findings

When documenting biometric bypass vulnerabilities:

1. Include the Frida script used for the bypass
2. Show the authentication flow before and after bypass
3. Demonstrate access to protected functionality
4. Provide remediation using the hardening checklist
5. Rate severity based on data sensitivity and bypass difficulty

References

• Universal Android Biometric Bypass - Frida CodeShare
• WithSecure Android Keystore Audit
• Android Security Bulletins
• BiometricPrompt API Documentation