Recent findings by Palo Alto Networks have highlighted sophisticated attack strategies targeting passwordless authentication systems. These methods demonstrate how malware can compromise accounts secured with passkeys, posing a significant threat to users and organizations.
Understanding Passkey Vulnerabilities
Passkeys are becoming more prevalent among major tech companies due to their enhanced security features against phishing attacks. However, the recently identified vulnerabilities, termed ‘Pass-ta-key’ by Palo Alto Networks, reveal potential risks associated with Google-synced passkeys. The researchers illustrated a scenario where an attacker could gain control of accounts without needing elevated permissions or user interaction.
In these attacks, malware already present on a Windows device with Chrome installed can analyze the browser’s local database. This allows the identification of online accounts protected by passkeys, including the usernames and encrypted credentials associated with them.
Detailed Attack Techniques
The attack involves extracting a device identity key stored by Chrome, either in memory or on disk. Through the use of Windows cryptographic APIs, the malware can generate a signature over a challenge from Google’s cloud authentication service, bypassing biometric prompts or the need for elevated privileges.
This process results in the cloud service validating the request as if it originated from a trusted device. Consequently, the attacker can send a valid authentication assertion to the targeted website, successfully completing the login process.
Advanced Variants and Mitigation Efforts
More advanced variations of this attack exist. The ‘Silver Pass-ta-key’ attack involves forcing Chrome into a re-registration process, allowing the malware to register its own verification key with the cloud authenticator during a brief window. This enables future authentication from a different machine.
The most severe form, ‘Golden Pass-ta-key’, involves extracting a master secret from Chrome’s memory, allowing the malware to decrypt all synchronized passkey private keys. This grants the attacker access to decrypt future passkeys as well.
Google has been informed of these vulnerabilities, and according to Palo Alto Networks, the tech giant has already implemented some mitigations to address the threats.
These revelations underscore the importance of continuous vigilance and updates in cybersecurity practices, especially as passwordless authentication becomes more widespread.
