Security Firm Discloses Three New Attack Methods Against Passkey Systems
Researchers at Palo Alto Networks have revealed three novel "Pass-ta-key" attack techniques that can potentially compromise Passkeys synced via Google Password Manager, leading to account hijacking.
Cybersecurity firm Palo Alto Networks has disclosed three new methods to exploit vulnerabilities in Passkey systems. Dubbed "Pass-ta-key" by researchers, these attacks specifically target Passkeys synced through Google Password Manager and could lead to account hijacking.
The disclosed attacks leverage security flaws in device registration, account recovery, and synchronization mechanisms. Crucially, these attacks require the attacker to have already gained control of the victim's Windows computer via malware. The first method utilizes Chrome's TPM-based device identity key, impersonating a trusted Windows device to request authentication responses from Google's cloud authentication service without requiring user verification or even unlocking the computer.
The second attack, termed "Silver Pass-ta-key," involves the malware deleting or corrupting the current Passkey state in Chrome, forcing the browser to re-initiate the device registration process. During this re-registration, the malware submits a verification key controlled by the attacker. This can allow bypassing websites that correctly demand PIN or biometric verification, and subsequently, attackers can authenticate from other devices.
The third method, "Golden Pass-ta-key," targets the security domain secret key that Google Password Manager uses to encrypt all synced Passkeys. While Google has reportedly removed this key from sensitive logs after being notified, researchers suggest it might still temporarily reside in Chrome's process memory. Attackers could potentially extract this key, decrypt synced Passkey data, and transfer the corresponding private keys to another device to impersonate the victim.
While the researchers privately reported these findings to Google before public disclosure, and Google has likely taken steps to address them, the full extent of the remediation is not yet publicly confirmed. This research underscores that despite the enhanced security of Passkeys over traditional passwords, they remain vulnerable if the device managing credentials is compromised by malware.
Security experts recommend that websites enforce user verification when using Passkeys and that password managers verify the trustworthiness of new device keys. Developers should also strengthen device recovery and re-registration processes and minimize the time sensitive encryption keys remain in browser memory.