Palo Alto Details Pass-ta-key Attacks on Google-Synced Passkeys

Summary

Palo Alto Networks researchers describe Pass-ta-key techniques in which Windows/Chrome malware can use Google-synced passkeys without user interaction. Variants can register an attacker key or extract a master secret; Google was notified and reportedly rolled out some m

Key points

Palo Alto Networks researchers describe Pass-ta-key methods targeting Google-synced passkeys through malware already present on a Windows machine running Chrome.
The malware can inspect Chrome’s local synchronization database for protected accounts, usernames and encrypted credential material.
It can recover a Chrome device identity key and use Windows cryptographic APIs to sign a challenge from Google’s cloud authenticator without a biometric prompt, device unlock or elevated privileges.
Google’s cloud service treats the signed request as coming from a trusted device and returns an authentication assertion that the attacker can forward to a target website.
In the Silver Pass-ta-key variant, malware forces device re-registration and registers its own user-verification key, potentially enabling later authentication from another machine.
The Golden Pass-ta-key method extracts a master secret that briefly appears in Chrome process memory during re-enrollment, allowing decryption of synchronized passkey private keys, including future ones.
Google was notified; Palo Alto Networks’ blog post indicates that Google rolled out some mitigations.

Article Details

Attack Vectors: Malware already present on a Windows machine running Chrome examines Chrome’s local synchronization database to identify passkey-protected accounts and associated credential material.
The malware recovers Chrome’s device identity key and uses Windows cryptographic APIs to sign a challenge from Google’s cloud authenticator service, obtaining an authentication assertion without a biometric prompt, device unlock, or elevated privileges.
In the ‘Silver Pass-ta-key’ variant, malware forces Chrome to re-register the device and registers its own user-verification key, enabling later authentication from another machine.
In the ‘Golden Pass-ta-key’ variant, malware extracts a master secret from Chrome process memory during re-enrollment to decrypt synchronized passkey private keys.
Defensive Notes: Google was notified, and Palo Alto Networks’ blog post indicates that Google has rolled out some mitigations.

MITRE ATT&CK

T1555.003 · Credentials from Web BrowsersThe malware examines Chrome’s local synchronization database and extracts passkey-related credential material.

Vendors

GoogleThe new attack methods, named ‘Pass-ta-key’ by Palo Alto Networks, focus on Google-synced passkeys.

Products

Google ChromeIn a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along Microsoft WindowsIn a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along