GoKawiilCalvin Wankhede / Android Authority
TL;DR Security researchers at Palo Alto Networks’ Unit 42 discovered three malware attack paths targeting Google Password Manager’s synced passkeys on Windows PCs.
The attacks exploit device trust, onboarding, and recovery mechanisms rather than breaking passkey cryptography itself. The most severe technique, Golden Pass-ta-key, allows attackers to recover the master secret and decrypt all synced passkeys tied to an account.
Every attack requires malware to be running on the victim’s Windows PC, making endpoint security the biggest takeaway.
While most people may have heard of passkeys, many still don’t fully understand how they work. But according to new research, understanding what passkeys don’t protect you from may be just as important as understanding what they do.
Researchers from Palo Alto Networks’ Unit 42 (via Bleeping Computer) uncovered three ways malware on a compromised Windows PC could abuse Google Password Manager’s synced passkeys by exploiting weaknesses in device trust and recovery, rather than breaking passkey cryptography itself.
Notably, every attack requires malware to be running on the victim’s Windows PC. The research targets Google Password Manager’s synced passkeys in Chrome on Windows devices with a Trusted Platform Module (TPM). It’s not a remote exploit against Google accounts.
The first attack, Pass-ta-key, lets malware authenticate without triggering Windows Hello or biometric verification, but only on services that don’t strictly require user verification. The second, Silver Pass-ta-key, goes further by registering an attacker-controlled verification key, allowing the researchers to bypass that limitation. They demonstrated the technique against eBay before responsibly disclosing it, and eBay has since patched the issue.
The most concerning finding is Golden Pass-ta-key. Researchers showed they could recover the master secret protecting synced passkeys, allowing them to decrypt every passkey tied to an account.
Google has removed one of these oversights by eliminating the secret from Chrome’s debug logs, but Unit 42 says it remains recoverable from memory during device re-registration. The report also notes there’s currently no way to rotate or revoke that master secret if it’s compromised.
... continue reading