Full Report
Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager's synced passkeys to take over accounts, bypass user verification, and extract passkey private keys. [...]
Analysis Summary
This summary is based on the research provided by Palo Alto Networks Unit 42 regarding vulnerabilities in how Google Password Manager handles synced passkeys on Windows.
# Tool/Technique: Pass-ta-key (Attack Suite)
## Overview
**Pass-ta-key** is a collection of three novel attack techniques that allow malware on an already-compromised Windows device to abuse Google Password Manager's synced passkeys. These attacks exploit the trust relationship between a local Chrome instance and Google’s cloud authenticator to hijack accounts, bypass user verification (biometrics/PIN), or extract master encryption keys.
## Technical Details
- **Type:** Attack Technique / Vulnerability Research
- **Platform:** Windows (Chrome browser with TPM)
- **Capabilities:** Authentication bypass, user-verification spoofing, and private key extraction.
- **First Seen:** Publicly disclosed August 2024.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1539 - Steal Web Session Cookie]** (Related mechanism for account takeover)
- **[T1555.003 - Credentials from Web Browsers]**
- **[TA0004 - Privilege Escalation]**
- **[T1548 - Abuse Elevation Control Mechanism]** (Bypassing user verification prompts)
- **[TA0001 - Initial Access]**
- **[T1204.002 - User Execution: Malicious File]** (Prerequisite for the attack)
## Functionality
### Core Capabilities
* **Device Impersonation:** Abuses the TPM-backed device identity key to sign requests to Google’s cloud authenticator.
* **Unprivileged Execution:** The basic "Pass-ta-key" technique does not require administrator rights or user interaction.
* **Assertion Generation:** Obtains valid authentication responses from the cloud to log into services (e.g., eBay).
### Advanced Features
* **Silver Pass-ta-key:** Forces device re-registration to inject an attacker-controlled user-verification key, allowing the attacker to bypass biometric/PIN requirements.
* **Golden Pass-ta-key:** Extracts the "Security Domain Secret" (SDS)—the master key for all synced passkeys—from Chrome's process memory during re-registration.
* **Persistence:** The stolen SDS allows for the decryption of future synced passkeys as the key currently cannot be rotated or revoked.
## Indicators of Compromise
* **Behavioral Indicators:**
* Unexpected invalidation or deletion of local passkey state files (triggering re-registration).
* Unauthorized processes attempting to read Chrome’s memory space (specifically searching for the SDS pattern).
* Logins from new/unrecognized devices immediately following a local system compromise.
* Chrome internal FIDO logging activity (in older versions).
## Associated Threat Actors
* **Research-only:** Currently attributed to **Palo Alto Networks Unit 42**. While no specific malware families were named in this report, these techniques are designed to be implemented by **Infostealers** (e.g., Lumma, RedLine, or Vidar variants).
## Detection Methods
* **Behavioral detection:** Monitor for unauthorized access to Chrome’s memory (VirtualProcessRead) by unprivileged or suspicious binaries.
* **EDR/SIEM:** Alert on the deletion of Chrome profile components related to WebAuthn/Passkey state.
* **Service Provider Side:** Websites should implement strict validation of the "User Verified" (UV) flag in FIDO2 assertions to detect attempts where biometrics were skipped.
## Mitigation Strategies
* **For Service Providers:** Ensure web applications strictly validate the User Verified flag. Do not allow authentication if the flag is missing or false when user presence is required.
* **For Users:** Maintain robust endpoint protection (AV/EDR) to prevent the initial malware infection, as all Pass-ta-key attacks require an existing foothold.
* **System Hardening:** Use Windows Hello with hardware-backed security and ensure Chrome is updated to the latest version to benefit from Google's logging-related patches.
## Related Tools/Techniques
* **Pass-the-Cookie:** A similar concept where stolen session tokens are used to bypass MFA.
* **Infostealer Malware:** Generic tools used to harvest browser-based credentials and secrets.