New "Pass-ta-key" Attacks Expose Flaws in Google’s Synced Passkeys
Security researchers at Palo Alto Networks’ Unit 42 uncovered a series of attacks dubbed "Pass-ta-key" that allow malware on compromised Windows devices to hijack Google-synced passkeys without requiring passwords, biometrics, or device unlocking. The findings, published on August 23, 2023, reveal three techniques targeting Chrome’s Google Password Manager on systems with a Trusted Platform Module (TPM).
How the Attacks Work
Passkeys, designed to replace passwords with cryptographic key pairs, rely on Google’s cloud authenticator and hardware-backed device keys. However, Unit 42 demonstrated that malware running under a standard user account (no admin privileges needed) could exploit weaknesses in Chrome’s synchronization and device trust mechanisms.
-
Pass-ta-key (Basic Impersonation)
- Malware accesses Chrome’s LevelDB database (
%LocalAppData%\Google\Chrome\User Data\<Profile>\Sync Data\LevelDB), extracting WebAuthn credential records, including encrypted private keys. - By stealing Chrome’s TPM-wrapped device identity key, attackers can sign authentication requests via Windows’ Cryptography API: Next Generation (CNG), impersonating the victim’s trusted device.
- If a website’s WebAuthn policy is set to "preferred" (not "required") for user verification, the attacker may bypass biometric or PIN checks entirely.
- Malware accesses Chrome’s LevelDB database (
-
Silver Pass-ta-key (Device Re-Enrollment)
- Attackers force Chrome to re-onboard a device by deleting the
passkey_enclave_statefile or issuing a "device-forget" command. - During the temporary
uv_key_pendingstate, they register a new user-verification key under their control, enabling assertions with the User Verified (UV) flag even if the victim’s device is offline. - This grants persistent, reusable access to accounts.
- Attackers force Chrome to re-onboard a device by deleting the
-
Golden Pass-ta-key (Master Key Exposure)
- The most severe threat involves stealing Chrome’s 32-byte Security Domain Secret (SDS), a master key used to encrypt synced passkeys.
- While Google removed the SDS from device logs post-disclosure, Unit 42 noted it may still be temporarily accessible in Chrome’s process memory during onboarding.
- If obtained, attackers could decrypt all synced passkey private keys, enabling credential theft, resale, or long-term access even after device re-enrollment.
Impact and Mitigations
- Affected Services: During testing, eBay was found to improperly validate the UV flag but patched the issue after disclosure.
- Vulnerable Configurations: Websites with userVerification="preferred" (instead of "required") are at higher risk.
- Recommended Fixes:
- Websites should enforce userVerification="required" and rigorously validate the UV flag.
- Credential providers should validate attestation for new device keys, secure recovery workflows, and prevent sensitive keys from lingering in memory.
- Monitoring for unauthorized modifications to local passkey state files is advised.
The research highlights that while passkeys resist phishing and password theft, endpoint compromises can undermine their security if cloud synchronization, device trust, and recovery systems are not equally hardened.
Source: https://gbhackers.com/malware-can-steal-googles-synced-passkeys/
Google cybersecurity rating report: https://www.rankiteo.com/company/google
eBay cybersecurity rating report: https://www.rankiteo.com/company/ebay
"id": "GOOEBA1785824643",
"linkid": "google, ebay",
"type": "Vulnerability",
"date": "8/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of Google Chrome with '
'synced passkeys',
'industry': 'Technology/Software',
'location': 'Global',
'name': 'Google',
'size': 'Large',
'type': 'Technology Company'},
{'customers_affected': 'Users with passkey '
'authentication',
'industry': 'Retail/E-commerce',
'location': 'Global',
'name': 'eBay',
'size': 'Large',
'type': 'E-commerce Platform'}],
'attack_vector': 'Malware on compromised endpoint',
'data_breach': {'data_encryption': 'Data was encrypted but could be decrypted '
'if SDS was exposed',
'file_types_exposed': 'LevelDB database files, TPM-wrapped '
'keys',
'sensitivity_of_data': 'High (can enable unauthorized account '
'access)',
'type_of_data_compromised': 'Cryptographic keys (passkey '
'private keys, device identity '
'keys, Security Domain Secret)'},
'date_detected': '2023-08-23',
'date_publicly_disclosed': '2023-08-23',
'description': 'Security researchers at Palo Alto Networks’ Unit 42 uncovered '
"a series of attacks dubbed 'Pass-ta-key' that allow malware "
'on compromised Windows devices to hijack Google-synced '
'passkeys without requiring passwords, biometrics, or device '
'unlocking. The attacks exploit weaknesses in Chrome’s '
'synchronization and device trust mechanisms, enabling '
'impersonation, device re-enrollment, and master key exposure '
'to decrypt synced passkeys.',
'impact': {'brand_reputation_impact': 'Potential erosion of trust in passkey '
'security and Google’s authentication '
'mechanisms',
'data_compromised': 'Passkey private keys, device identity keys, '
'Security Domain Secret (SDS)',
'identity_theft_risk': 'High (if passkeys are used for sensitive '
'accounts)',
'operational_impact': 'Potential unauthorized access to accounts '
'using passkeys',
'systems_affected': 'Windows devices with Google Chrome and Google '
'Password Manager'},
'investigation_status': 'Completed (research and disclosure)',
'lessons_learned': 'Passkeys are resistant to phishing and password theft but '
'can be compromised if endpoint security is weak. Cloud '
'synchronization, device trust, and recovery systems must '
'be hardened to prevent exploitation. Websites must '
'enforce strict WebAuthn policies to mitigate risks.',
'post_incident_analysis': {'corrective_actions': ['Google patched the SDS '
'exposure issue '
'post-disclosure',
'eBay fixed improper UV '
'flag validation',
'Recommendations for '
'stricter WebAuthn policies '
'and key management'],
'root_causes': ['Weaknesses in Chrome’s '
'synchronization and device trust '
'mechanisms',
'Insecure WebAuthn policy '
'configurations '
"(userVerification='preferred')",
'Exposure of TPM-wrapped device '
'identity keys and Security Domain '
'Secret (SDS) in memory']},
'recommendations': ["Enforce userVerification='required' for WebAuthn "
'policies',
'Validate attestation for new device keys',
'Secure recovery workflows to prevent key exposure',
'Prevent sensitive keys from lingering in memory',
'Monitor for unauthorized modifications to local passkey '
'state files',
'Improve endpoint security to prevent malware infections'],
'references': [{'date_accessed': '2023-08-23',
'source': 'Palo Alto Networks’ Unit 42'}],
'response': {'enhanced_monitoring': 'Monitoring for unauthorized '
'modifications to passkey state files',
'remediation_measures': ['Websites should enforce '
"userVerification='required' and "
'validate the UV flag',
'Credential providers should validate '
'attestation for new device keys',
'Secure recovery workflows and prevent '
'sensitive keys from lingering in '
'memory',
'Monitor for unauthorized modifications '
'to local passkey state files'],
'third_party_assistance': 'Palo Alto Networks’ Unit 42 (research '
'and disclosure)'},
'title': "New 'Pass-ta-key' Attacks Expose Flaws in Google’s Synced Passkeys",
'type': 'Credential Theft',
'vulnerability_exploited': 'Weaknesses in Chrome’s Google Password Manager '
'synchronization, TPM-wrapped device identity key '
'exposure, and insecure WebAuthn policy '
"configurations (userVerification='preferred')"}