Pass-ta-key Attacks Target Google-Synced Passkeys

Security researchers have uncovered three Pass-ta-key attacks that let malware abuse Google Password Manager’s synced passkeys on compromised Windows devices.

The attacks can hijack accounts, bypass user verification in certain cases, and extract the private keys behind synced passkeys. They target Chrome on Windows systems that use a Trusted Platform Module, or TPM.

Palo Alto Networks Unit 42 discovered the techniques. The researchers stressed that attackers must already have malware running on a victim’s computer.

Passkeys remain safer than passwords

Passkeys use cryptographic keys stored on a device to sign users into online accounts. They replace passwords and can use a PIN, fingerprint, or facial recognition for authentication.

They are generally more resistant to phishing than passwords. Users cannot reuse, guess, or accidentally share them in the same way as traditional credentials.

However, the Pass-ta-key attacks show that passkeys cannot fully protect users once malware has compromised their device.

The techniques do not break the cryptography behind passkeys. Instead, they exploit how Chrome and Google’s cloud authenticator handle trusted devices, recovery, onboarding, and synced credentials.

First Pass-ta-key attack abuses device trust

The first technique, called Pass-ta-key, allows unprivileged malware to impersonate a trusted device and request a valid authentication response for one of the victim’s passkeys.

The malware uses Chrome’s TPM-backed device identity key to sign a request for Google’s cloud authenticator. It does not need administrator permissions, user interaction, biometrics, or an unlocked device.

Google’s service then treats the request as legitimate and returns a signed authentication assertion. An attacker can use that assertion to attempt to sign into the targeted account.

However, the assertion includes a User Verified flag. This flag shows whether the user completed PIN or biometric verification.

The attack fails when a website requires user verification and properly validates that flag. Unit 42 said GitHub rejected the attack because it checked the flag correctly.

Researchers successfully tested the technique against eBay, which required user verification but did not validate the flag correctly. eBay has since fixed the issue.

Silver Pass-ta-key registers an attacker-controlled key

The second technique, Silver Pass-ta-key, can let attackers add their own user-verification key to Google’s cloud authenticator.

Malware first forces Chrome to register the device again. It can do this by invalidating the existing verification key or deleting the local file containing passkey state.

During that process, the attacker can register a key they control. According to Unit 42, the cloud authenticator does not check whether the new key came from trusted hardware.

Google then accepts requests signed by the attacker’s key as proof that the user unlocked the device. This can bypass services that correctly require and validate user verification.

After registering the malicious key, attackers can authenticate from another computer without retaining access to the victim’s device.

Golden Pass-ta-key exposes the master key

Golden Pass-ta-key is the most serious technique. It lets malware obtain the security domain secret, the master key used to encrypt every passkey synced through a Google Password Manager account.

Chrome temporarily receives this secret when a device registers or recovers access to the account.

Unit 42 initially found the secret in Chrome’s internal FIDO logs. Google removed it from the logs after receiving the report.

However, the researchers said the secret still reaches Chrome and remains temporarily available in the browser’s process memory. Malware can force re-registration, search memory for the secret, and extract it.

An attacker could then decrypt synced passkey records, recover private keys, and use them from another system to impersonate the victim.

The same secret may also decrypt passkeys added in the future. Unit 42 said Google’s current implementation does not provide a way to rotate or revoke it.

Pass-ta-key attacks do not make passkeys less secure than passwords. Still, they underline the importance of keeping devices free from malware. Websites should require and properly validate user verification, while credential managers need stronger device-key validation and recovery protections.