Mobile Authentication Bypass

What Is Broken and Why

Mobile authentication is broken when the authentication check is event-driven (callback-only) rather than cryptographically bound to a Keystore/Secure Enclave key. An app that calls BiometricPrompt / LAContext.evaluatePolicy() and then checks a boolean success return can be bypassed by hooking the callback with Frida and forcing true. Truly secure biometric auth requires a CryptoObject (Android) or SecAccessControl with biometry binding (iOS) — without this, the biometric check has no cryptographic consequence and can be bypassed at the application layer.

Key Signals

• BiometricPrompt used without a CryptoObject parameter (event-only, not key-bound)
• LAContext.evaluatePolicy(_:localizedReason:reply:) with no Keychain operation tied to auth
• userAuthenticationValidityDurationSeconds > 0 with large values (minutes/hours)
• No kSecAccessControlBiometryCurrentSet flag — new enrollments silently unlock Keychain items
• setUserAuthenticationRequired(false) on a Keystore key intended for biometric-gated operations
• Fallback path (device PIN) bypasses Keystore binding constraints
• onAuthenticationSucceeded callback contains business logic without using cryptoObject.cipher

Methodology