Security researchers from Palo Alto Networks’ Unit 42 have discovered three novel attack techniques that could allow malware to seize control of accounts protected by passkeys stored in Google Password Manager—without triggering fingerprint, facial recognition, or PIN prompts. These findings expose weaknesses in key areas like device enrollment, cloud synchronisation, and the way Google handles the master secret encrypting synced passkeys.
—
## How Passkeys Are Supposed to Work
Passkeys replace traditional passwords with asymmetric cryptography: a public key stays with the service, while the private key—never shared—is kept secure by a user’s authenticator. During login, a one-time challenge is signed using that private key. Because of this design, phishing attacks or credential theft from services’ databases become far less effective.
Syncing passkeys across devices adds convenience, but it also demands extra infrastructure: encryption, cloud-based key recovery, and enrolment processes. While the core WebAuthn and FIDO protocols secure private keys, Unit 42’s research shows it’s the surrounding mechanisms in Google’s implementation that are vulnerable.
—
## The Exploit Techniques: Pass-ta-key, Silver Pass-ta-key, Golden Pass-ta-key
All three attacks require malware already running on a compromised Windows device. From that point, these techniques escalate risk significantly:
### Pass-ta-key
– Uses the device identity key, a hardware-backed key managed by Chrome and sealed in the TPM, to sign login challenges without user verification.
– When signed from the compromised device, it isn’t necessary to provide a fingerprint, PIN, or biometric check.
– The web server must enforce user verification (UV bit) on the server side. Some sites, like GitHub, rejected this kind of attack; others, like eBay (at time of testing), accepted login attempts because they didn’t properly inspect the UV flag.
### Silver Pass-ta-key
– Targets Chrome’s deferred enrolment state, which occurs when a new device has been registered but the user-verification key (e.g. Windows Hello or PIN) isn’t yet fully created.
– Malware manipulates this enrolment state to supply its own verification key that it controls. Once the cloud authenticator accepts this proxy key, the attacker can generate assertions carrying the UV flag.
– This allows bypassing a site that requires proper user verification. The attacker may no longer need access to the victim’s device after enrolment.
### Golden Pass-ta-key
– The most serious technique: attacks the system’s Security Domain Secret (SDS), which is a 32-byte master key that encrypts all synchronized passkey private keys.
– Researchers found the SDS exposed in plaintext via Chrome’s FIDO diagnostic logs during enrollment. Although Google has removed that specific logging, the SDS still appears temporarily in Chrome’s process memory during device recovery or re-enrolment.
– Malware can force enrollment workflows, capture the SDS from memory, combine it with the encrypted key database, extract private key material, and authenticate on attacker’s infrastructure—even after the infected device is cleaned.
—
## What They Found in Chrome and Google Password Manager
– On Windows computers with TPM support, Chrome enrols the device to Google’s “cloud authenticator,” generating a device identity key and a user-verification key associated with Windows Hello or a PIN.
– The enrollment file `passkey_enclave_state` is stored locally and includes wrapped device identity keys, the public portion of the user-verification key, a wrapped SDS, and data used for PIN recovery.
– Metadata about synced WebAuthn credentials—usernames, relying-party (site) IDs, credential IDs, and encrypted key data—is stored in a LevelDB database under Chrome’s profile. Malware already running under the user’s account can access metadata without administrator privileges.
—
## Practical Implications & Limitations
– **Pre-condition**: These are post-compromise attacks. Malware must already be executing in the target’s user session via phishing, software vulnerabilities, or supply-chain attacks.
– **No confirmed real-world exploitation yet**: Unit 42 found no evidence of these techniques being used in the wild. No CVE identifiers were disclosed with the report, and the affected Chrome releases weren’t fully catalogued.
– **Sites’ Mitigation Role**: Relying parties must do more than request `userVerification: “required”`—they must also validate the UV bit in the authenticator’s returned data. Sites not performing that check remain vulnerable to attacks like Silver Pass-ta-key.
—
## What Can Be Done
### For Website Operators
– Enforce strict server-side checks: only accept WebAuthn assertions when the UV flag is explicitly set.
– Require attestation or similar cryptographic proof during registration or replacement of identity and user-verification keys.
– Treat enrollment and recovery workflows as sensitive by default. Introduce additional verification steps or require trusted existing devices to confirm changes.
### For Endpoint Security / Users
– Monitor changes to the `passkey_enclave_state` file, suspicious access to Chrome’s sync database, or unusual usage of TPM-backed cryptographic functions.
– Consider using hardware-bound passkeys (e.g. separate FIDO2 security keys) for critical accounts: finance, developers, administrators.
– If suspicious compromise is suspected: rebuild systems from known-clean images, review Google-account device list, revoke passkeys from critical services. Use secure systems to create new credentials.
—
## Key Take-aways: Passkeys Aren’t Broken—But Implementation Matters
Passkeys continue to offer strong defenses against many traditional threats: phishing, credential reuse, or mass data breaches. Their cryptographic foundation—local private keys, verification via device intent—remains solid.
However, the surrounding infrastructure—how keys are synced, how enrollment is managed, how the master secrets are handled—introduces new risk vectors. These research findings demonstrate that “passwordless” does not automatically mean impermeable.
—
This article is AI-generated content. Please verify the information independently before taking any action based on this article.
