Passkeys have emerged as the future of passwordless authentication, offering stronger protection against phishing attacks, credential theft, and password reuse. They cannot be copied, written down, or given to someone else. However, new research discloses that once malware has compromised a Windows PC, it could hijack Google-synced passkeys to take over accounts, extract passkey private keys, and bypass user verification.
How Does Malware Exploit Google's Synced Passkeys?
A new report by Palo Alto Networks Unit 42 demonstrates three attack techniques, collectively called “Pass-ta-key,” Silver Pass-ta-key, and Golden Pass-ta-key. Among these, the strongest attacks focus on compromising the master key that protects a user’s synced passkeys.
It is also important to note that these attacks do not break passkey encryption or cryptography. Instead, they exploit the way Chrome manages and protects synced passkeys on Windows.
Pass-ta-key: Bypassing Biometric Verification
The first attack technique, Pass-ta-key, allows unprivileged malware to imitate a trusted device. It does this by abusing Chrome's TPM-backed key to obtain a valid passkey authentication response without prompting the user for biometric verification or requiring a PIN to unlock the device. During testing, the attack was blocked by GitHub because it properly verified user authentication. However, it successfully bypassed eBay's implementation until the vulnerability was disclosed and patched.
Silver Pass-ta-key: Registering a Fraudulent Device
The second attack technique, Silver Pass-ta-key, allows attackers to register a fraudulent device verification key with Google Cloud Authenticator. Malware forces Chrome to re-enroll the device without immediately creating its user-verification key. Once established, the attacker can authenticate the key from their own systems without requiring access to the victim's device or biometric authentication.
Golden Pass-ta-key: Exposing the Master Encryption Key
The third and most concerning technique, named Golden Pass-ta-key, involves Google’s Security Domain Secret (SDS), a master encryption key used to protect all passkeys synchronized through Google.
If malware extracts the SDS, attackers can decrypt every synchronized passkey associated with the user’s account. Even though Google removed the SDS from Chrome’s logging output after receiving the report, researchers found that the secret is still transferred to the client and remains accessible in browser memory.
They also emphasized that Google currently lacks a mechanism to rotate or revoke the compromised master key, meaning it protects existing passkeys even during a system cleanup. Despite these findings, researchers highlight that passkeys remain significantly more secure than traditional passwords.
However, it is important to note that no authentication method can fully protect users once malware gains control of a device, underscoring the need to keep systems patched and protected against malicious software.
To get all the latest news and happenings around the technology ecosystem, visit our website now.
Also Read:
How Does Biometric Authentication Enhance Security Compared To Traditional Password Methods?
