BioStar 2 Leak Exposes 23GB Data, 1M Fingerprints

Thousands of organizations, including banks, governments, and the UK Metropolitan Police, use the biometric security tool to authenticate users.

Researchers with VPNMentor have discovered a massive leak in biometric security platform BioStar 2, which uses facial recognition and fingerprint scanning as part of its means to identify users. Thousands of organizations use the tool to control access to buildings and secure areas.
Suprema, the security firm that built BioStar 2, recently partnered with Nedap to integrate the platform into its AEOS access control system. More than 5,700 institutions across 83 countries, including local businesses, governments, banks, and the UKs Metropolitan Police, use AEOS.
Noam Rotem and Ran Locar, both Internet privacy researchers, first detected the leak on August 5 while scanning ports as part of a Web-mapping project. Their team hunts for familiar IP blocks and uses them to find holes in a companys Web system. When these holes are found, the researchers then look for vulnerabilities that could lead to a data breach. During this process, the team found large chunks of BioStar 2s database unsecured and unencrypted.
The database held almost every kind of sensitive data available, researchers wrote in a blog post. They could access more than 27.8 million records and a total of 23 GB of data, including more than 1 million fingerprints; facial recognition data and user images; access to client admin panels, dashboards, back-end controls, and permissions; unencrypted usernames and passwords, records of entry and exit to secure areas; and employee records.
One of the more surprising aspects of this leak was how unsecured the account passwords we accessed were, they point out. Plenty of accounts had ridiculously simple passwords, like Password and abdc1234. While some users had more complex passwords, the researchers were able to view passwords across the database because they were stored as plaintext files.
Following a rocky disclosure process, BioStar 2 secured the database on August 13.
Read more details
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
BioStar 2 Leak Exposes 23GB Data, 1M Fingerprints