New Malware Exploits Bypass Passkey Security to Hijack Accounts
Research from Palo Alto Networks reveals new methods allowing malware to exploit passkey authentication systems, compromising accounts without user interaction or elevated privileges.
New techniques have been identified that allow malware to compromise accounts secured by passkey authentication, according to research from Palo Alto Networks. These methods exploit vulnerabilities in passwordless authentication systems, demonstrating how malicious software can gain unauthorized access to protected accounts without requiring user interaction or elevated privileges. The attacks, termed “Pass-ta-key” by the researchers, specifically target passkeys synchronized with Google services. The process begins with malware installed on a Windows device running the Chrome browser. This malware accesses the browser’s local synchronization database to identify online accounts protected by passkeys, along with associated usernames and encrypted credential data. It then retrieves a device identity key stored by Chrome either on disk or in memory. Using Windows cryptographic application programming interfaces (APIs), the malware generates a signature for a challenge issued by Google’s cloud-based authenticator service. This signature is created without triggering biometric prompts, device unlock requirements, or administrative privileges. The cloud service interprets the signed request as originating from a legitimate, trusted device, granting the attacker a valid authentication assertion. This assertion is then used to complete login attempts on the target website. A more sophisticated variant, labeled “Silver Pass-ta-key,” manipulates Chrome into initiating a device re-registration process. During a brief window in this procedure, the malware intercepts and exploits the re-registration flow to gain further access. The most severe method, “Golden Pass-ta-key,” involves extracting a master secret that temporarily resides in Chrome’s process memory during re-enrollment. This secret enables the decryption of all synchronized passkey private keys linked to the account, allowing the attacker to decrypt future passkeys and maintain persistent access. Google has been informed of these findings, and the company has implemented partial mitigations as outlined in the researchers’ published analysis. The vulnerabilities highlight risks associated with passwordless authentication systems, particularly when synchronization mechanisms and cryptographic implementations are not sufficiently secured. The research underscores the evolving nature of cyber threats targeting authentication protocols, emphasizing the need for continuous evaluation of security measures in passwordless systems. Organizations are advised to monitor for signs of unauthorized access and ensure that endpoint security solutions are updated to detect and block such exploit techniques.
About Author
English