Lenovo warns its fingerprint ID manager has ‘high’ threat vulnerability (+ video)

MORRISVILLE – If you thought your unique fingerprint meant tamper-proof security for your Lenovo device, you are wrong. So says Lenovo, which issued an alarm after researcher Jackson Thuraisamy at Surity Compass discovered the threat.

The world’s No. 2 PC seller has issued a warning that its Fingerprint Manager, which permits access to computers and other devices through a fingerprint scan, has a “high” threat for exploitation.

Customers are urged to update Fingerprint Manager Pro to version 8.01.87 or later, Lenovo said.

Lenovo acknowledges a “weak algorithm” for encryption and a “hard-coded password” that could be exploited.

“A vulnerability has been identified in Lenovo Fingerprint Manager Pro,” Lenovo declared.

“Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in.”

Noted tech news site The Register:

“The tool could be configured to store and authenticate website credentials via fingerprint.

Unfortunately, Lenovo says, it was also improperly protecting those stored credentials, leaving the readers far less secure than they should be. Now, the PC slinger is advising users still running the Fingerprint Manager Pro software to install the latest update (version 8.01.87) to address the issue.”

Affected devices include: