The latest articles on DEV Community by El Peruano Loko (@elperuanoloko). https://dev.to/elperuanoloko https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4153255%2F248bbc39-6731-4edd-a923-73418c17e8f7.png https://dev.to/elperuanoloko en El Peruano Loko Thu, 01 Oct 2026 00:52:48 +0000 https://dev.to/elperuanoloko/we-cracked-the-face-2fa-engine-behind-150-banks-forged-tokens-pass-validation-32in https://dev.to/elperuanoloko/we-cracked-the-face-2fa-engine-behind-150-banks-forged-tokens-pass-validation-32in <p>One facial-biometrics vendor quietly sits behind the 2FA selfie wall of <strong>more than 150 banks in 30+ countries</strong>. We reversed their public engine, and the results are uncomfortable: <em>every captured 2FA token is decryptable, and tokens we mint offline validate as legit.</em></p> <h2> The setup </h2> <p>When a bank's online login asks you to take a selfie, it's usually not the bank doing the heavy lifting. A single vendor ships a small widget that runs entirely in the browser: it captures your face, produces an encrypted token, and hands it to the bank's backend.</p> <p>Because the widget is a <strong>publicly served wasm engine</strong>, anyone can download it. We did.</p> <h2> What we found (teaser — full spec on request) </h2> <ul> <li> <strong>The token is a pair.</strong> Every 2FA attempt posts two encrypted blobs — a selfie image and a face-template image. We broke the self-keying scheme: the key is derivable from data already sitting in the clear, seeded from a time value. Both blobs decrypt to the exact bytes the server saw (a JPEG selfie and a PNG template).</li> <li> <strong>Forged blobs read as legit.</strong> Because the key is derivable, we can mint fresh, structurally-valid token pairs that the server accepts. No camera, no face, no live user — just a well-formed encrypted blob.</li> <li> <strong>Per-tenant isolation is dead.</strong> The engine ships a license whitelist of 46-character keys embedded in the public wasm — including the vendor's own key and the keys of at least eight other corporate clients. Every tenant runs the same licensed engine.</li> <li> <strong>The anti-fraud check has a master off-switch.</strong> The current-generation "environment security" module is a case-sensitive keyword blocklist with a single bypass string shipped in the clear.</li> </ul> <h2> The headline deployment </h2> <p>One of the biggest deployments — <strong>Interbank (Peru)</strong>, on a 2020-era build — has the entire 2FA barrier bypassable <strong>headlessly</strong>: no browser, no camera, no face, roughly 1-in-100 per attempt. And every biometric token recorded since the integration went live is decryptable.</p> <p><strong>Upgrading is not a free pass.</strong> The vendor's current 6.x line still embeds the license whitelist in a public wasm and still accepts a still (non-living) selfie at enrollment. A version bump alone doesn't close the door.</p> <h2> What we're selling </h2> <p>The full specification, a headless engine that reproduces the flow against a live tenant, and per-bank recon. We're selling to the vendor, to its bank clients, or to a single operator who wants first refusal.</p> <p>Proof, scope, and a decryptable sample of <em>your</em> bank's token are available on request.</p> <p><strong>Contact:</strong> <a href="mailto:elperuanoloko@proton.me">elperuanoloko@proton.me</a><br> — El Peruano Loko, independent security research</p> security webdev encryption