Overview

This test checks if the app uses biometric authentication mechanisms (MASTG-KNOW-0001) that allow fallback to device credentials (PIN, pattern, or password) for sensitive operations.

On Android, the android.hardware.biometrics.BiometricPrompt API (or its Jetpack counterpart androidx.biometric.BiometricPrompt that backward compatibility to API level 23) can be configured to accept different types of BiometricManager.Authenticators via the setAllowedAuthenticators) method.

When the authenticator constant DEVICE_CREDENTIAL is included (either alone or combined with biometric authenticators using the OR operator "|"), the authentication allows fallback to device credentials, which is considered weaker than requiring biometrics alone because passcodes are more susceptible to compromise (e.g., through shoulder surfing).

Similarly, using setDeviceCredentialAllowed(true)) (deprecated since API 30) also enables fallback to device credentials.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0014 to look for the relevant APIs.

Observation

The output should include a list of locations where the relevant APIs are used.

Evaluation

The test case fails if the app uses BiometricPrompt with authenticators that include DEVICE_CREDENTIAL for any sensitive data resource that needs protection.

Note

Using DEVICE_CREDENTIAL is not inherently a vulnerability, but in high-security applications (e.g., finance, government, health), their use can represent a weakness or misconfiguration that reduces the intended security posture. This issue is therefore better categorized as a security weakness or hardening issue, not a critical vulnerability.

Linkitetyt tehtävät

Linkit
is related to MASTG-BEST-0031 Enforce Strong Biometrics for Sensitive Operations (Android)