Pass-ta-key Attacks Target Google Password Manager Synced Passkeys

Severity

Medium

Security researchers have identified a series of attack techniques, collectively named Pass-ta-key, that could allow malware on a compromised Windows device to abuse Google-synced passkeys and gain unauthorized access to online accounts. Unlike traditional credential theft, the attacks do not rely on stealing passwords or capturing biometric data, but instead exploit weaknesses in device trust, recovery, and synchronization mechanisms.

The attacks require malware to already be running under the victim’s standard Windows user account but do not require administrator privileges. Researchers found that the malware could access locally stored synchronization data used by Google Password Manager in Chrome to identify accounts protected by passkeys.

How?

The first attack technique, known as Pass-ta-key, allows malware to impersonate a trusted device. By accessing locally stored synchronization data and TPM-protected device identity information, the malware can communicate with Google’s cloud authenticator as though it were the victim’s trusted device. If a website only treats user verification as preferred rather than mandatory, attackers may be able to authenticate without requiring biometric verification or a PIN.

The second technique, Silver Pass-ta-key, targets Chrome’s device re-enrollment process. By forcing Chrome to re-register the device during a temporary enrollment state, attackers can register their own user verification key with Google’s cloud authenticator. This enables authentication requests that appear to have successfully completed user verification, potentially bypassing biometric or PIN checks.

The third technique, Golden Pass-ta-key, targets Chrome’s recovery process. Researchers found that a master encryption key, known as the Security Domain Secret (SDS), may be temporarily accessible in Chrome’s process memory during device onboarding. If obtained by malware, the Security Domain Secret (SDS) could decrypt synced passkey private keys stored in Chrome synchronization data. This would allow attackers to copy and reuse passkeys, potentially retaining access even after devices are re-enrolled.

Following responsible disclosure, Google removed the Security Domain Secret from Chrome device logs to reduce the attack surface. Researchers also noted that websites should properly enforce WebAuthn user verification requirements, as they observed some services incorrectly accepting authentication requests that lacked verified user authentication during testing.

The findings demonstrate that although passkeys provide stronger protection against phishing and password theft, endpoint compromise remains a significant security risk, particularly when attackers can abuse cloud synchronization and device trust mechanisms.

Recommendations

Users and organizations utilizing Google-synced passkeys are advised to take the following precautions:

Keep Windows, Google Chrome, and endpoint security software updated with the latest security patches.
Protect endpoints against malware infections, as the demonstrated attacks require malware to already be running on the affected device.
Ensure endpoint protection and monitoring solutions can detect malware running under standard user accounts.
Promptly investigate suspected endpoint compromises, particularly on systems used for passkey-based authentication.

Source

https://gbhackers.com/malware-can-steal-googles-synced-passkeys/