Overview

This test checks if the app implements event-bound biometric authentication (MASTG-KNOW-0001) to access sensitive resources (e.g., tokens, keys), where authentication success relies solely on a callback result rather than being cryptographically bound to sensitive operations and requiring user presence.

On Android, BiometricPrompt.authenticate() can be called with a CryptoObject) or without a CryptoObject). When used without a CryptoObject the app relies on the onAuthenticationSucceeded) callback to determine if authentication was successful (event-bound). This makes it susceptible to logic manipulation by overwriting the callback without successfully passing the biometric verification.

In contrast, when a CryptoObject is used (crypto-bound), the app passes a cryptographic object (e.g., Cipher, Signature, Mac) that requires user authentication. This ensures authentication is not just a one-time boolean, but part of a secure data retrieval path (out-of-process), so bypassing authentication becomes significantly harder.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0014 to look for the relevant APIs.

Observation

The output should include a list of locations where the relevant APIs are used.

Evaluation

The test case fails for each sensitive operation worth protecting if all of the following applies:

Linkitetyt tehtävät

Linkit
is related to MASTG-BEST-0036 Use Cryptographic Binding for Biometric Authentication (Android)