Passkeys have been heralded as a more secure alternative to traditional passwords, offering users a streamlined and safer authentication method. However, recent findings have exposed vulnerabilities in Google’s Password Manager, particularly concerning its passkey implementation.
Researchers from Unit 42 have identified a series of exploits, collectively termed the “Pass-ta-key” attack, which can compromise the security of passkeys stored within Google’s Password Manager. These attacks exploit specific flaws in the system, potentially allowing unauthorized access to user accounts.
One method involves malware infecting a Windows machine, enabling the extraction of identity keys from the device. Instead of securely storing these keys within the Trusted Platform Module (TPM), the malware redirects them to a disk, facilitating unauthorized authentication without the user’s consent.
Another technique, dubbed the “silver” passkey attack, deceives the password manager into believing that the user has completed biometric authentication. By keeping the system in a pending verification state, the malware can register its own keys, ensuring that future authentications are approved without genuine user verification.
The most concerning method, referred to as the “golden” attack, exploits the Secure Data Storage (SDS) process. During encryption, sensitive information leaks into Chrome’s log system. Even after attempts to remove this data, remnants persist in Chrome’s memory. Malware can then extract this information, gaining access to the user’s synced passkeys and compromising future authentications.
It’s important to note that these attacks require the Windows machine to be pre-infected with malware. A clean system remains secure when utilizing passkeys. However, the existence of such vulnerabilities underscores the need for continuous vigilance and updates in security protocols.
In response to these findings, users are advised to ensure their systems are free from malware and to stay updated with the latest security patches. While passkeys offer enhanced security, their effectiveness is contingent upon robust implementation and proactive defense against emerging threats.
These revelations highlight the evolving nature of cybersecurity threats. As authentication methods advance, so do the tactics employed by malicious actors. It’s imperative for both developers and users to remain informed and proactive in safeguarding digital assets.
