However, it would be highly effective against high-profile targets, since the hacker could use a photo to complete the spoof. The hack is difficult to execute at scale, largely because the attacker needs to have direct physical access to the target device in order to pull it off. For example, a hacker could pull a photo of their target off the internet, and then use their custom USB camera to send that photo to the Windows OS to bypass Windows Hello entirely. A separate USB camera is much easier to manipulate, and can be modified to send a spoof tailored to a specific device. The problem, according to CyberArk, comes from the fact that Windows Hello allows people to use third-party plug-in devices instead of those built-in sensors.

Thankfully, it is relatively difficult to do so when that sensor comes built-in, and is fully integrated into the design of the device. In most cases, that utility is delivered through a built-in camera or fingerprint sensor, which sends the user’s biometric information to the Windows operating system for authentication.įraudsters can spoof Windows Hello if they can find a way to manipulate that biometric information, or the sensor used to collect it. Windows Hello is a passwordless authentication system that allows people to use face or fingerprint recognition to unlock a Windows device, or to log into various digital applications.

Windows hello devices