Recent research highlights vulnerabilities in Google Password Manager that allow malware to bypass passkey protections on Windows systems. These findings, reported by Unit 42, identify three attack strategies targeting the Google Password Manager within Chrome, potentially compromising user accounts without visible indicators on the victim’s device.
Understanding the Attack Strategies
Unit 42 has identified three critical attack paths: Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. These strategies exploit how Chrome handles passkey storage, device re-enrollment, and user verification. The attacks do not compromise the underlying cryptography but instead manipulate the code managing passkeys.
The first method, Pass-ta-key, involves accessing Chrome’s device identity key and manipulating Windows Cryptography API calls to sign unauthorized requests. This process bypasses user verification by exploiting a vulnerability in how Chrome handles TPM keys.
Exploring the Silver Pass-ta-key Path
The Silver Pass-ta-key attack focuses on forcing Chrome to re-enroll a device, allowing attackers to register their own user-verification key. This method leverages a gap in security checks where the system fails to verify if a newly registered key originated from secure hardware. Consequently, attackers can conduct future logins without the victim’s device.
Despite these vulnerabilities, the report does not specify if these issues have been addressed in the latest Chrome updates. The research relies on existing Chromium sources to validate some aspects of these vulnerabilities.
Golden Pass-ta-key and Its Implications
Golden Pass-ta-key targets the Security Domain Secret (SDS) within Chrome. Attackers can extract the SDS, thereby decrypting synced passkey private keys. This attack path is particularly concerning as it allows persistent access to user accounts.
Although some mitigations have been implemented, such as eBay’s enforcement of the user verification flag, the vulnerability remains significant. The report suggests that further security enhancements are needed, including hardware attestation checks and securing client memory against such exposures.
As of the latest updates, there is no confirmation on whether all reported vulnerabilities have been resolved. Users and service providers are advised to enforce stringent security measures, such as requiring user verification and validating newly registered keys.
In conclusion, the research emphasizes the importance of robust security practices in mitigating these vulnerabilities. Continuous updates and user education are crucial in safeguarding against potential threats to Google Password Manager accounts.
