Innovatrics: Penetration Testing of Biometric Identity Verification

Assignment

Innovatrics entrusted us with independently testing the security of its Identity Verification (IDV) Toolkit, a solution designed for digital identity verification. The objective was to assess the system's resilience against advanced attacks involving spoofed biometric data and attempts to bypass its liveness detection mechanisms.

In consultation with the client, we opted for black-box penetration testing, which simulates the approach of a real-world attacker without access to source code or internal documentation. The assessment focused primarily on the Android platform, the Android Face Lite Library, and its communication with the Digital Identity Service (DIS).

Our Solution

Over 16 days of intensive penetration testing, we assessed the solution's security through reverse engineering, static and dynamic application analysis, and simulated biometric data injection attacks.

Our ethical hackers attempted to bypass the security mechanisms using several techniques. These included replacing the live camera feed with prerecorded video, manipulating biometric data directly in application memory, and injecting image frames at the native library level. The assessment also covered network communication, authentication tokens, and the application's security controls.

Although we successfully bypassed some initial protective mechanisms and gained control over the client application's memory, none of the attack scenarios resulted in a successful bypass of biometric identity verification. The solution's multilayered security architecture successfully detected manipulation attempts and rejected spoofed data.

The results provided Innovatrics with independent validation of its solution's resilience against the tested attack techniques and helped strengthen customer confidence in its security.

“As part of a major customer project, we needed to independently verify the resilience of our identity verification solution against attacks involving spoofed biometric data (Injection Attacks). We chose Citadelo for its technical expertise, strong reputation, and ability to complete the assessment within a demanding timeframe. The security assessment results provided independent confirmation of our solution's resilience and strengthened our customer's confidence in its security.”

Viktor Bielko, Product Manager, IDV Toolkit, Innovatrics

Customer

Innovatrics is a Slovak technology company specializing in the development of biometric solutions for identity verification and identification. Its technologies use facial recognition, fingerprint recognition, and other biometric methods to secure digital identities. The company's solutions are used in the financial sector, public administration, and other industries where reliable and secure identity verification is essential.