Recent investigations have unveiled significant weaknesses in Google’s passkey security, revealing how malware on compromised Windows systems can hijack synchronized passkeys without needing traditional authentication methods like passwords or fingerprints.
Understanding the Core Vulnerabilities
The critical findings, part of an extensive study on passkey security, highlight vulnerabilities in Google’s Cloud Authenticator. These flaws undermine its device trust and onboarding processes, which are supposed to safeguard user accounts by replacing passwords with secure public-key cryptography.
Passkeys eliminate the need for shared secrets, a common target for phishing and credential-stuffing attacks. However, research from Unit 42 reveals that Chrome retains passkey metadata in an unencrypted format, easily accessible to malware. This allows attackers to identify all services using passkey logins without needing elevated system privileges.
Exploiting Chrome’s Identity Key
Central to this issue is how Chrome handles the “identity key,” a hardware-backed credential meant to authenticate devices with Google’s Cloud Authenticator. The key’s temporary and exportable nature makes it vulnerable to extraction by malware, which can then mimic Chrome’s authentication processes using standard Windows cryptography APIs.
This allows for a seamless passkey login, termed the “Pass-ta-key” attack, which occurs without alerting the user through biometric or password prompts.
Advanced Attack Variants and Implications
More sophisticated exploits have also been identified. The “Silver Pass-ta-key” attack circumvents user verification by tampering with local passkey records, compelling Chrome to accept a new, attacker-controlled verification key. This could grant attackers ongoing access to accounts, even those protected by multi-factor authentication.
The “Golden Pass-ta-key” attack targets the master encryption key, or security domain secret (SDS), which protects all synchronized passkeys. Researchers found that this critical 32-byte key is exposed in Chrome’s logs and memory during device recovery, enabling attackers to decrypt all associated passkeys.
Despite these issues not compromising the fundamental cryptography of passkeys, they exploit mismatches between design assumptions and real-world implementations. Some services, such as eBay, have already addressed these gaps following responsible disclosure.
Recommendations for Enhanced Security
Security experts recommend strict enforcement of user-verification checks, validation of device key attestations, restricted local access to credential stores, and vigilance against unexpected onboarding or recovery processes.
As cyber threats continue to evolve, integrating robust threat detection tools and practices into security operations centers (SOCs) is crucial for maintaining secure environments.
