Passkey Security Flaw Exposed: Malware Can Hijack Google-Synced Credentials
Researchers have uncovered critical vulnerabilities in passkey implementations, demonstrating how malware can bypass protections in Google Password Manager to steal or misuse credentials. Despite passkeys being touted as a phishing-resistant alternative to passwords, flaws in synchronization and authentication processes create new attack vectors.
Passkeys, which rely on public-key cryptography, eliminate reusable secrets by generating unique key pairs for each account preventing phishing and credential-stuffing attacks. By late 2024, Google reported 800 million accounts using passkeys, with major platforms increasingly adopting the standard. However, their security depends on proper implementation, particularly in how services verify authentication requests.
The researchers identified three attack methods targeting Google’s passkey synchronization:
- Pass-ta-key: Malware silently generates a valid passkey login via Chrome and Google’s cloud without requiring biometric or PIN verification.
- Silver Pass-ta-key: Malware exploits device re-enrollment to register an attacker-controlled verification key, enabling remote login from an unrelated machine.
- Golden Pass-ta-key: Malware extracts Google’s master encryption key, decrypting all synced passkeys for unrestricted reuse, even after losing access to the original device.
The core issue lies in over-reliance on the "user verified" flag, which services accept without validating whether a legitimate biometric or PIN event occurred. Google’s synchronization feature, while convenient, also expands the attack surface by allowing passkeys to be accessed across devices.
Google and other providers are urged to strengthen device registration and recovery processes, ensuring new keys are hardware-backed and properly verified. Until these gaps are addressed, malware remains a primary threat to passkey security, underscoring the need for robust endpoint protection. The findings highlight that while passkeys mitigate traditional password risks, their real-world security hinges on rigorous implementation.
Google cybersecurity rating report: https://www.rankiteo.com/company/google
"id": "GOO1785932643",
"linkid": "google",
"type": "Vulnerability",
"date": "12/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '800 million accounts using '
'passkeys (as of late 2024)',
'industry': 'Technology/Software',
'location': 'Global',
'name': 'Google',
'size': 'Large Enterprise',
'type': 'Technology Company'}],
'attack_vector': 'Malware',
'data_breach': {'data_encryption': 'Vulnerable (master encryption key '
'extraction possible)',
'data_exfiltration': 'Potential (via malware)',
'personally_identifiable_information': 'Potential (account '
'access could lead to '
'PII exposure)',
'sensitivity_of_data': 'High (authentication credentials)',
'type_of_data_compromised': 'Passkey credentials (public-key '
'cryptography key pairs)'},
'description': 'Researchers have uncovered critical vulnerabilities in '
'passkey implementations, demonstrating how malware can bypass '
'protections in Google Password Manager to steal or misuse '
'credentials. The flaws in synchronization and authentication '
'processes create new attack vectors, allowing malware to '
"exploit the 'user verified' flag and Google's synchronization "
'feature to access passkeys across devices without proper '
'verification.',
'impact': {'brand_reputation_impact': 'Potential erosion of trust in passkey '
'security',
'data_compromised': 'Passkey credentials (public-key cryptography '
'key pairs)',
'identity_theft_risk': 'High (unauthorized account access)',
'operational_impact': 'Potential unauthorized access to accounts '
'using passkeys',
'systems_affected': 'Google Password Manager, Chrome, Google Cloud '
'synchronization'},
'lessons_learned': 'Passkeys mitigate traditional password risks but require '
'rigorous implementation to prevent malware-based attacks. '
"Over-reliance on 'user verified' flags and "
'synchronization features can expand attack surfaces.',
'post_incident_analysis': {'corrective_actions': ['Strengthen device '
'registration and recovery '
'processes',
'Ensure hardware-backed '
'keys for new registrations',
'Improve validation of '
'authentication requests'],
'root_causes': ["Over-reliance on 'user verified' "
'flag without proper validation',
'Flaws in passkey synchronization '
'across devices',
'Insufficient protection of master '
'encryption keys']},
'recommendations': ['Strengthen device registration and recovery processes to '
'ensure hardware-backed keys and proper verification.',
'Improve endpoint protection to mitigate malware threats '
'targeting passkey implementations.',
'Enhance validation of authentication requests to prevent '
'bypass of biometric/PIN verification.'],
'references': [{'source': 'Researchers (unspecified)'}],
'response': {'remediation_measures': 'Strengthening device registration and '
'recovery processes, ensuring '
'hardware-backed keys and proper '
'verification'},
'title': 'Passkey Security Flaw Exposed: Malware Can Hijack Google-Synced '
'Credentials',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'Flaws in passkey synchronization and '
"authentication processes, over-reliance on 'user "
"verified' flag"}