CVE-2024-31695

Executive Summary

CVE-2024-31695 is a critical authentication bypass vulnerability in the Binance: BTC, Crypto and NFTS mobile application (version 2.85.4). The flaw resides in the fingerprint authentication mechanism, allowing an attacker with physical access to an unlocked device to bypass biometric verification when adding a new fingerprint. This enables the attacker to register their own fingerprint, subsequently gaining unauthorized access to the victim's Binance account and performing sensitive actions such as withdrawals, trades, and viewing private keys. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the real-world impact is severe due to the financial nature of the application. No official patch has been confirmed at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a mobile application binary issue. The supply chain risk is limited to the distribution of the vulnerable APK/IPA via official app stores. Users should verify they are running the latest version from trusted sources.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability characteristics is provided below:

• Attack Vector (AV): Physical (AV:P) – Requires physical access to the device.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – Attacker does not need prior access.
• User Interaction (UI): None (UI:N) – No user action needed beyond initial device unlock.
• Scope (S): Unchanged (S:U) – The vulnerable component is the app itself.
• Confidentiality (C): High (C:H) – Attacker can access account data, private keys.
• Integrity (I): High (I:H) – Attacker can modify account settings, perform trades.
• Availability (A): Low (A:L) – Attacker could lock the user out by changing credentials.

Calculated Score: 6.8 (Medium) – However, due to the financial context, this should be treated as Critical.

Threat Level: Critical. The vulnerability directly compromises the security of cryptocurrency assets.

Deep Dive & Mechanics

The vulnerability exists in the fingerprint authentication flow of the Binance app. When a user adds a new fingerprint, the app should verify that the current user is authorized by checking against the existing enrolled fingerprints. Due to a misconfiguration, the app fails to properly validate the authenticity of the fingerprint addition request. Specifically, the app does not enforce a requirement that the user must re-authenticate (e.g., via PIN or password) before enrolling a new biometric.

Technical Breakdown:

1. Normal Flow: User goes to Settings > Security > Fingerprint. App prompts for existing fingerprint or PIN. If verified, new fingerprint can be added.
2. Vulnerable Flow: An attacker who has physical access to an unlocked device can navigate to the fingerprint settings. The app does not check if the current user is the legitimate owner. It directly allows the addition of a new fingerprint without any prior authentication.
3. Root Cause: The BiometricPrompt or FingerprintManager API call is not wrapped with a prior authentication check. The app likely uses a boolean flag to indicate "fingerprint enrollment allowed" but fails to reset it after the initial setup.

Attack Scenario:

• Victim leaves their phone unlocked on a desk.
• Attacker picks up the phone, opens Binance app.
• Attacker goes to Settings > Security > Fingerprint.
• Attacker adds their own fingerprint.
• Attacker locks the phone, then unlocks it using their new fingerprint.
• Attacker now has full access to the Binance account.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (Conceptual - Android/Java):

// Vulnerable: No prior authentication check
public void addFingerprint() {
    BiometricPrompt biometricPrompt = new BiometricPrompt.Builder(context)
            .setTitle("Add Fingerprint")
            .setSubtitle("Place your finger on the sensor")
            .build();
    biometricPrompt.authenticate(new BiometricPrompt.AuthenticationCallback() {
        @Override
        public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
            // Directly enrolls the new fingerprint
            enrollFingerprint(result.getCryptoObject());
        }
    });
}

Patched Code (Conceptual):

// Patched: Requires prior authentication via PIN or existing fingerprint
public void addFingerprint() {
    // Step 1: Verify current user
    if (!isUserAuthenticated()) {
        showPinPrompt();
        return;
    }
    // Step 2: Proceed with biometric enrollment
    BiometricPrompt biometricPrompt = new BiometricPrompt.Builder(context)
            .setTitle("Add Fingerprint")
            .setSubtitle("Place your finger on the sensor")
            .setNegativeButton("Cancel", executor, (dialog, which) -> {})
            .build();
    biometricPrompt.authenticate(new BiometricPrompt.AuthenticationCallback() {
        @Override
        public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
            enrollFingerprint(result.getCryptoObject());
        }
    });
}

private boolean isUserAuthenticated() {
    // Check if user has recently entered PIN or authenticated via existing fingerprint
    return sessionManager.isAuthenticated();
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Physical access to an unlocked Android/iOS device with Binance v2.85.4 installed.
• The device must have fingerprint sensor enabled.

Exploitation Steps:

1. Gain Physical Access: Obtain the victim's unlocked device.
2. Open Binance App: Tap the Binance icon.
3. Navigate to Settings: Tap the profile icon or menu, then "Security".
4. Select Fingerprint: Tap "Fingerprint" or "Biometrics".
5. Add New Fingerprint: The app will immediately prompt to place a finger on the sensor without asking for PIN or existing fingerprint.
6. Enroll Attacker's Fingerprint: Place your finger on the sensor multiple times until enrollment is complete.
7. Lock Device: Press the power button to lock the phone.
8. Unlock with New Fingerprint: Use your enrolled fingerprint to unlock the device and access Binance.
9. Perform Actions: Withdraw funds, change settings, or view private keys.

Proof of Concept (PoC) Script (Conceptual - ADB based):

#!/bin/bash
# This script simulates the exploitation steps via ADB for testing
# Requires device with USB debugging enabled

echo "CVE-2024-31695 PoC - Binance Fingerprint Bypass"
echo "Ensure device is unlocked and Binance v2.85.4 is installed"

# Launch Binance
adb shell am start -n com.binance.dev/.MainActivity

# Wait for app to load
sleep 5

# Navigate to Security settings (example intent, actual may vary)
adb shell am start -n com.binance.dev/.SecuritySettingsActivity

# Simulate fingerprint enrollment (requires physical interaction)
echo "Now place your finger on the sensor to enroll..."
# In a real scenario, the attacker would physically interact

Blue Team (Defender)

Detection and Prevention:

1. Monitor for Unusual Fingerprint Enrollment: Log and alert on any fingerprint enrollment events that occur without prior PIN/password authentication.
2. Device Policy: Enforce a policy that requires device PIN/password before any biometric changes.
3. App Integrity Checks: Implement runtime integrity checks to detect if the app has been tampered with.
4. User Education: Warn users to never leave their device unlocked in public.

Hunting Query (Splunk):

index=endpoint_logs source="*binance*" event_type="fingerprint_enrollment"
| where NOT prior_authentication="true"
| table timestamp, user, device_id, ip_address

Indicators of Compromise (IOCs)

• Application: Binance: BTC, Crypto and NFTS v2.85.4 (SHA256 hash of APK/IPA)
• Behavioral: Unauthorized fingerprint enrollment events in device logs.
• Network: Connections to Binance API endpoints from an unrecognized device fingerprint.
• File: Modified shared_prefs or databases related to biometric settings.

Sample IOC (File Hash):

APK SHA256: 3a7c... (placeholder - obtain from official source)

Detection Engineering

YARA Rule

rule CVE_2024_31695_Binance_Fingerprint_Bypass {
    meta:
        description = "Detects Binance app binary vulnerable to fingerprint authentication bypass"
        author = "Valters IT"
        date = "2024-10-27"
        hash = "3a7c..."
    strings:
        $s1 = "addFingerprint" ascii wide nocase
        $s2 = "BiometricPrompt" ascii wide nocase
        $s3 = "enrollFingerprint" ascii wide nocase
        $s4 = "com.binance.dev" ascii wide nocase
    condition:
        all of ($s*) and filesize < 100MB
}

Sigma Rule

title: Binance Fingerprint Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized fingerprint enrollment in Binance app
logsource:
    product: android
    service: device_admin
detection:
    selection:
        EventID: 1234  # Placeholder for fingerprint enrollment event
        PackageName: 'com.binance.dev'
        AuthenticationMethod: 'fingerprint'
        PriorAuth: false
    condition: selection
falsepositives:
    - Legitimate user adding fingerprint after PIN entry (if app is patched)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-31695 Binance Fingerprint Bypass - Unauthorized API Access"; flow:to_server; content:"/sapi/v1/account"; nocase; content:"Authorization"; nocase; pcre:"/Bearer\s[A-Za-z0-9\-._~+/]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Binance App: Check for updates in the Google Play Store or Apple App Store. If a patched version is available, update immediately.
2. Enable PIN/Password: Ensure the device itself has a strong PIN or password, and that the Binance app requires it for sensitive actions.
3. Disable Fingerprint Login: Temporarily disable fingerprint authentication in the Binance app until a patch is confirmed.
4. Monitor Account Activity: Review recent login history and withdrawal addresses for any unauthorized changes.

Long-Term Fixes:

• Vendor Patch: Binance must release a patched version that requires prior authentication (PIN or existing fingerprint) before adding a new fingerprint.
• Code Review: Implement secure coding practices for biometric authentication flows, including proper session management and authentication checks.
• Penetration Testing: Conduct regular security assessments of mobile applications, focusing on authentication mechanisms.

Workaround:

• Use a hardware security key (e.g., YubiKey) for two-factor authentication instead of relying solely on biometrics.

Report generated by Valters IT DevSecOps & CTI Division