cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Unit 42 Details Three Pass-ta-key Attacks on Google-Synced Passkeys

· Original article ↗

Summary

Unit 42 says malware already running on Windows can abuse Google Password Manager’s synced passkeys through three Pass-ta-key attacks, bypassing user verification or extracting private keys. Google removed one log exposure, and eBay fixed a validation flaw.

Key points

  • All three attacks require malware already running on a Windows device and do not break passkey cryptography.
  • Pass-ta-key uses a TPM-backed device identity key to request a passkey assertion without administrator privileges or user interaction; Unit 42 said it worked against eBay but failed against GitHub’s user-verification checks.
  • Silver Pass-ta-key abuses device re-registration to register an attacker-controlled verification key, which can later be used to authenticate from another system.
  • Golden Pass-ta-key targets the security domain secret used to encrypt synced passkeys; Unit 42 says it remains temporarily accessible in Chrome’s process memory.
  • The researchers say the secret can decrypt synced passkey records, and that the same key could protect future passkeys because Google’s implementation reportedly has no rotation or revocation method.
  • Google removed the secret from Chrome’s logs after disclosure; eBay fixed its user-verification flaw. Unit 42 recommends validating verification and device keys and hardening recovery and re-registration.

Article Details

Attack Vectors
  • Malware already running on a compromised Windows device uses Chrome’s TPM-backed device identity key to impersonate a trusted device and request a passkey assertion without administrator privileges or user interaction.
  • Silver Pass-ta-key forces Chrome to re-register with Google’s cloud authenticator by invalidating the existing verification key or deleting the local passkey-state file, then registers an attacker-controlled user-verification key.
  • Golden Pass-ta-key forces device re-registration or account recovery and extracts the security domain secret from Chrome’s process memory; the secret can decrypt synced passkey records and expose their private keys.
Defensive Notes
  • Websites should require user verification and properly validate the assertion’s User Verified flag. Unit 42 reported that GitHub validated it, while eBay did not; eBay fixed the flaw after disclosure.
  • Credential managers should verify that newly registered device keys originate from trusted hardware and harden device re-registration and recovery processes.
  • Credential managers should prevent master keys from becoming accessible in browser memory. Unit 42 reported that Google removed the security domain secret from Chrome’s logging output, but that it remained temporarily accessible in process memory.

MITRE ATT&CK

T1078 · Valid AccountsThe recovered private keys or attacker-requested passkey assertions are used to authenticate as the victim to online accounts.T1552.004 · Private KeysThe attack recovers passkey private keys from decrypted synced passkey records for use on another system.T1555.003 · Credentials from Web BrowsersGolden Pass-ta-key extracts the security domain secret and decrypts passkeys synced through Google Password Manager in Chrome.

Vendors

eBayThe research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay.GitHubThe research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay.Googlethree attacks, collectively called Pass-ta-key, that let malware on compromised Windows devices abuse Google Password Manager synced passkeys to bypass verification and take over accounts.

Products

EbayThe research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay.GitHubThe research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay.Google ChromeThe research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay.Google Password Managerattacks, collectively called Pass-ta-key, that let malware on compromised Windows devices abuse Google Password Manager synced passkeys to bypass verification and take over accounts.

Related Articles