Η Lenovo επιβεβαίωσε ότι το λογισμικό αυτόματης σύνδεσης Fingerprint Manager Pro (έκδοση 8.01.86), το οποίο επιτρέπει στους χρήστες να ξεκλειδώνουν τις συσκευές τους χρησιμοποιώντας την αναγνώριση δακτυλικών αποτυπωμάτων, επηρεάζεται από μια σοβαρή ευπάθεια.
Attackers could exploit the loophole security to access any system equipped with the application.
According to Lenovo's disclosure, Fingerprint Manager contained a hardcoded code that could connect users locally to non-administrator accounts.
In addition to the hardcoded code, the "security" application stored sensitive information such as login credentials of Windows and fingerprints which he “encrypted using a weak algorithm”.
Vulnerability was discovered by security compass researcher Jackson Thuraisamy.
https://www.youtube.com/watch?v=JRA34PzvANg
Defective software is available for Windows 7, 8, and 8.1. According to the details published on the company's website, below are all devices that use Fingerprint Manager:
- ThinkPad L560
- ThinkPad P40 Yoga, P50s
- ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
- ThinkPad W540, W541, W550s
- ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
- ThinkPad X240, X240s, X250, X260
- ThinkPad Yoga 14 (20FY), Yoga 460
- ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
- ThinkStation E32, P300, P500, P700, P900
Those of you who have any of the above devices, and the version of Fingerprint Manager Pro is 8.01.86 are advised to update immediately to version 8.01.87 or a newer version. You can do it from the following link:
https://pcsupport.lenovο.com/downloads/ds034486
Information, header image: TNW