Detection of Biometry Enrollment Status
The usage of biometrics is a means of authentication without the need to fill in a PIN or password on a device. On the Android platform, the process of authentication with a PIN or password is vulnerable to several attacks. The secret knowledge might leak through various weaknesses in Android APIs that are exploitable by other apps installed on the device. Examples of such attack vectors might be accessibility API, screen recording, or custom keyboards.
Malwarelytics for Android is able to detect whether the device supports biometry and whether biometric data were enrolled on the device.
Triggering a Manual Check
Biometric detection containing biometric status can be triggered manually in RaspManager by calling the getBiometryDetection() method.
val biometryDetection: BiometryDetection = raspManager.getBiometryDetection()
The BiometryDetection data class contains the following properties:
| Property | Description |
|---|---|
biometricStatus: BiometricStatus |
contains the status of the biometry config on the device. |
androidxLibStatus: Int |
contains the status of the biometry config on the device denoted by the raw value obtained from [androidx.biometric.BiometricManager]. |
Available values of BiometricStatus:
| Value | Description |
|---|---|
CONFIGURED |
corresponds to [androidx.biometric.BiometricManager.BIOMETRIC_SUCCESS]. |
UNKNOWN |
corresponds to [androidx.biometric.BiometricManager.BIOMETRIC_STATUS_UNKNOWN]. |
UNSUPPORTED |
corresponds to either [androidx.biometric.BiometricManager.BIOMETRIC_ERROR_UNSUPPORTED] or [androidx.biometric.BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE]. |
CURRENTLY_UNAVAILABLE |
corresponds to either [androidx.biometric.BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE] or [androidx.biometric.BiometricManager.BIOMETRIC_ERROR_SECURITY_UPDATE_REQUIRED]. |
NONE_ENROLLED |
corresponds to [androidx.biometric.BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED]. |
More information on general RASP feature configuration and usage can be found in this overview.