Lenovo's Fingerprint Manager Pro exposed user passwords, security update released

[Puppy]

Just another Lenovo "Pro" software
https://www.notebookcheck.net/Lenovo-s- ... 494.0.html

https://support.lenovo.com/us/en/produc ... /len-15999
A vulnerability has been identified in Lenovo Fingerprint Manager Pro. Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in.

[Thinkpad4by3]

Just another Lenovo "Pro" software
https://www.notebookcheck.net/Lenovo-s- ... 494.0.html

https://support.lenovo.com/us/en/produc ... /len-15999
A vulnerability has been identified in Lenovo Fingerprint Manager Pro. Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in.

When you make Windows XP security look good, you should be firing the programmer ASAP. Ugh Lenovo.

[dr_st]

When you make Windows XP security look good, you should be firing the programmer ASAP. Ugh Lenovo.

Most likely the task was given to a junior programmer without any proper process of training and code review.

[Thinkpad4by3]

When you make Windows XP security look good, you should be firing the programmer ASAP. Ugh Lenovo.

Most likely the task was given to a junior programmer without any proper process of training and code review.

Even a Junior programmer could put it in something better than plain text. Is implementing an SHA-256 algorithm that hard? Just downloading a github library would be suffice.

[dr_st]

Even a Junior programmer could put it in something better than plain text. Is implementing an SHA-256 algorithm that hard? Just downloading a github library would be suffice.

In this business doing something is often not as hard as understanding why you should do it. This understanding is what junior programmers often lack.