From our other sites
The story
After a spate of securities account takeovers last year, brokerages rolled out facial and fingerprint biometric authentication via “passkeys” — but on the 11th, it emerged that a securities account with a passkey set up may have been hijacked anyway, prompting the Japan Securities Dealers Association and individual brokerages to issue a warning. According to Kyodo News, the biometric authentication itself wasn’t broken; rather, the Google or Apple account managing the passkey appears to have been compromised first. On 5ch, comments mistakenly assuming the fingerprint or facial data itself had been stolen mixed with others explaining how the account takeover actually happened via phishing.
Published 16:18, Wed 11/11
Kyodo News
The Japan Securities Dealers Association and brokerages are warning customers after a securities account that had set up facial- and fingerprint-based “passkey” authentication as a security measure against unauthorized access turned out to possibly have been hijacked anyway. Brokerages had rolled out biometric authentication one after another in response to a string of securities account takeovers last year, but it now appears thorough vigilance against opening suspicious emails is needed once again.
Source: news.yahoo.co.jp / Original article here
What people said
This breach apparently didn't bypass the biometric authentication itself — the attacker took over the victim's Google or Apple account and used that to exploit the passkey.
https://greta.5ch.io/test/read.cgi/poverty/1794370413/
[BREAKING] Unauthorized access to SMBC Nikko Securities — stock account info of 56,487 people leaked [422186189]
https://hayabusa9.5ch.io/test/read.cgi/news/1794383546/
Finance got hacked.
Transit's down too.
[BREAKING] Unauthorized access to Sapporo Municipal Subway's operations system — causing mass cancellations and delays [422186189]
https://hayabusa9.5ch.io/test/read.cgi/news/1794383981/
Nuclear plant systems next, maybe?
And sure enough, someone's already been hit.
Guess cold hard cash is the real safe asset after all (lol)
Some idiot just got their biometric info phished away, that's all.
Wonder what the victims are supposed to do now.
So how'd they get past that?
Sadly, there are plenty of fools out there who never even set up a passkey on their actual Google or Apple account…
It's right there in the article — they fell for a phishing site and logged in.
There are some truly hopeless fools out there.
Fingerprints change if you get injured.
Faces don't even have that many distinguishing features.
Your first line already shows how clueless you are.
Is this another data leak too?
Basically, the Google account managing the biometric key got hijacked, so the biometric auth itself was meaningless.
The one who got fooled is 120% at fault, and the one who did the fooling is only 100% at fault — that kind of case.
This is basically how most securities account takeovers go.
Though the victims play innocent and demand compensation from the brokerage anyway.
It's more accurate to say a passkey just requires biometric auth to use it, isn't it?
Biometric auth is just one way to unlock the device so it'll authorize use of the passkey stored on it.
Nah, it's easy. Even an idiot could do it.
You don't need to steal the actual fingerprint — just steal the digitized "fingerprint" data that represents the common denominator of that person's print, and you're done.
Second best would be a physical security key + PIN code, etc.
Cloud-managed ones just don't feel fully safe…
Might be less convenient, but security keys or Windows Hello are less likely to get caught up in trouble like this.
What's really scary is having your authentication hijacked somewhere entirely outside your awareness in the first place.
I'm telling you — it's the same thing.
It's all just converted into data.
Are you okay in the head?
Same goes for retinas and irises.
It all gets converted into scalar data.
Everything has to be converted into scalar data before it can be transmitted.
No, it isn't.
A passkey is just an encryption key generated with public-key cryptography — it doesn't use biometric data at all.
Using your fingerprint on a phone is just a ritual to grant the phone access to that encryption key. It doesn't have to be a fingerprint — a PIN, a pattern swipe, whatever works too.
Passkeys are pointless unless they're stored locally.
I guess it'll eventually come down to external USB-type keys like YubiKey. But those are pricey. Wish they'd hurry up and make them as cheap and easy to buy in bulk as a regular USB flash drive.
Switch everything back to kami. (typo: wrote 髪/"hair" instead of 紙/"paper" — sets up the next reply's joke)
…Sorry, your hair is already… gone. (riffing on the hair/paper typo above, i.e., you're already bald)
Because the account takeover itself was the root cause in the first place.
Never click links in emails.
If there's a connection error, assume your cell tower's been hijacked and walk away.
That's about all I can come up with.
Accidentally clicking one is the whole problem, right?
Just opening an HTML email at all is already asking for trouble.
Even if you hijack the account and use the passkey, you still shouldn't be able to clear the biometric check itself, right?
What's actually going on here?
They basically did the equivalent of switching to a new phone.
Biometric auth only grants passkey-use permission on the specific phone the person is holding.
If the attacker logs into the victim's Google account on their own phone — one with their own fingerprint registered — then it's the attacker's fingerprint that ends up authorizing passkey use on that phone.
You need to understand that a passkey has nothing to do with biometrics per se.
Once your account's taken, it's game over.
If you log into your own Google account on someone else's phone, that other person's fingerprint can now be used to unlock your passkey.
No matter how great a passkey is, if it ends up stored online anyway, I figured AI would crack it in no time (lol)
Well, if it's not synced to an account, dropping your phone or bricking it means getting locked out of every single service where you only registered one passkey — instant death.
It's fine for something like a YubiKey that's meant to be stored away rather than carried around, but for something like a phone, local-only storage just isn't suited for it.
Meanwhile I, a man of principle who refuses to own a cellphone,
am completely fine.
Though the brokerage says you can disable the passkey and switch back to two-factor authentication.
Background and Key Points of This Story
A passkey isn’t a system that transmits fingerprint or facial data itself — it’s a technology that uses an encryption key stored on the device via public-key cryptography, with biometric authentication serving merely as the identity-verification step that grants permission to use that key. In this case, it appears the attacker tricked the victim into handing over their Google or Apple account credentials through a fake email, then logged into that account on their own smartphone — meaning the attacker’s own fingerprint ended up authorizing use of the passkey. In other words, what actually happened wasn’t “biometric authentication being broken” but “the account managing the passkey being hijacked,” and explanations on the thread crossed paths over this distinction. Brokerages had adopted passkeys in response to a wave of major account-takeover incidents last year, and this case has once again exposed the limits of that countermeasure.
*This article is compiled as an excerpt/summary from the 5ch (News Speed+) thread “Biometric-Protected Securities Accounts Hit — Warning Issued Over Takeovers.”
Leave a Reply