Passkeys were supposed to be the password killer. They eradicated the struggle to remember a password for the 47th time. No more password resets or security questions asking about the name of your first pet from 15 years ago. Instead, passkeys use your device, biometrics, and cryptographic keys to give you access to accounts.
Very convenient. However, security researchers have found that if malware gets inside your computer, it may be able to steal your passkey.
A group of security experts called Unit 42 has demonstrated attacks that can bypass Google Chrome-based passkeys using techniques they call “Pass-ta-key.” The attacks target weaknesses in how Google Password Manager handles passkeys on compromised Windows machines. Before you start deleting every passkey you own, there are important details you need to know.
Passkeys are safer than passwords, but they aren’t hack-proof
The whole point of passkeys is to remove one of the biggest security headaches on the internet: passwords. Passwords can be guessed, leaked, reused, phished, and stolen from massive data breaches. Passkeys, on the other hand, work differently.
Instead of typing a secret string of characters, your device creates a cryptographic key pair. One key stays with the service you are logging into, while the other stays protected on your device. When you sign in, your device uses biometrics, like a fingerprint or face scan, to prove your identity. The website never sees your actual secret.
That is why companies like Google, Apple, and Microsoft have been pushing passkeys as the next evolution of online security. The problem, however, is that the lock is only as strong as the place where you keep the key.
The ‘Pass-ta-key’ attacks target the weakest link
According to Unit 42, the issue is not that passkeys themselves are broken. Instead, attackers can target the moment when a device is creating, storing, or using those keys.
The researchers found multiple ways malware could interfere with Google Password Manager’s passkey system. The first attack involves stealing a protected account from an already infected Windows machine. Instead of the security key being properly protected by hardware security features like the Trusted Platform Module (TPM), malware could export the identity key and use it to authenticate itself. In very simple terms, the attacker is convincing the lock that they are you.
The silver attack tricks devices into trusting malware
The second method is called the “silver” passkey attack. In this scenario, malware tricks Google Password Manager into believing the user already approved access with biometrics.
The computer remains stuck in a sort of unfinished verification state, allowing the malware to register its own keys. That means future authentication attempts could approve the attacker’s keys as if they belonged to the real user. It’s the digital equivalent of someone sneaking into your house, copying your spare key, and then making unlimited copies afterward.
The ‘golden’ method is the nightmare scenario
The most concerning method is the “golden” attack. This one involves stealing information from Chrome’s internal processes. Researchers found that sensitive encryption information connected to Google Chrome’s passkey system could remain accessible in memory, even after Google removed certain logs containing that information.
If malware can extract that data, an attacker may be able to access a user’s synced passkeys. And the stolen information could potentially become a blueprint for decrypting future passkeys created through Google Password Manager.
Malware is the real enemy
Having read up to here, it is easy to assume the world is back to square one as far as account access and security is concerned. But that’s not exactly the point. Passkeys still eliminate many of the biggest problems with passwords. They can’t simply be copied from a company’s database, reused across multiple sites, or easily stolen through phishing emails.
That said, your device needs to already be infected with malware for these attacks to work. A hacker who has already gained deep access to your computer has many ways to cause damage.
It’s worth noting that Google is not the only company facing this challenge. According to Unit 42, other passkey providers use similar cloud-based authentication models, hence, the lessons could apply beyond Chrome and Google Password Manager. The passwordless world is still very much valid. But before we throw passwords a retirement party, these security experts are reminding everyone that passkeys also need a secure place to live.
Source: 9to5Google