mobile-auth-bypass

Mobile Authentication Bypass

What Is Broken and Why

Mobile authentication is broken when the authentication check is event-driven (callback-only) rather than cryptographically bound to a Keystore/Secure Enclave key. An app that calls BiometricPrompt / LAContext.evaluatePolicy() and then checks a boolean success return can be bypassed by hooking the callback with Frida and forcing true. Truly secure biometric auth requires a CryptoObject (Android) or SecAccessControl with biometry binding (iOS) — without this, the biometric check has no cryptographic consequence and can be bypassed at the application layer.

Key Signals

• BiometricPrompt used without a CryptoObject parameter (event-only, not key-bound)
• LAContext.evaluatePolicy(_:localizedReason:reply:) with no Keychain operation tied to auth
• userAuthenticationValidityDurationSeconds > 0 with large values (minutes/hours)
• No kSecAccessControlBiometryCurrentSet flag — new enrollments silently unlock Keychain items
• setUserAuthenticationRequired(false) on a Keystore key intended for biometric-gated operations
• Fallback path (device PIN) bypasses Keystore binding constraints
• onAuthenticationSucceeded callback contains business logic without using cryptoObject.cipher

Methodology

Android:

1. Decompile APK — search for BiometricPrompt, FingerprintManager, KeyguardManager
2. Check BiometricPrompt.authenticate() call: does it pass a CryptoObject?
3. If no CryptoObject → callback-only auth → hookable with Frida
4. Check Keystore key spec: setUserAuthenticationRequired(true) and setInvalidatedByBiometricEnrollment(true)
5. Check userAuthenticationValidityDurationSeconds: 0 = require auth on every use (correct); >0 = time-window (weaker)
6. Test fallback: trigger failed biometric → does PIN bypass the Keystore key requirement?
7. Frida hook: override onAuthenticationSucceeded to fire without user touching sensor

iOS:

1. Search IPA source for LAContext, evaluatePolicy, kLAPolicyDeviceOwnerAuthenticationWithBiometrics
2. Check Keychain item: SecAccessControlCreateWithFlags with .biometryCurrentSet or .userPresence?
3. If auth is event-only (just checks LAContext result, no Keychain op) → bypass with Frida
4. Verify evaluatedPolicyDomainState is checked on launch to detect enrollment changes
5. Frida: hook LAContext.evaluatePolicy reply block, force error=nil to simulate success