Unit 42 discloses three novel attack classes against Google's synced passkey ecosystem on Windows TPM devices, collectively nicknamed 'Pass-ta-key.' All three require pre-existing unprivileged malware on the victim's endpoint. The Pass-ta-key attack silently signs cloud authenticator requests using the extracted TPM-backed device identity key. The Silver Pass-ta-key attack exploits Chrome's deferred UV key onboarding to register an attacker-controlled verification key, enabling persistent remote access without the victim's device. The Golden Pass-ta-key attack extracts the Security Domain Secret from Chrome's process memory during forced re-onboarding, enabling decryption of all synced passkeys. Key gaps include lack of UV flag validation by relying parties, absence of attestation verification for newly registered UV keys, and exposure of the SDS to the client environment.
Passkeys
3 posts
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication NCSC: Leave passwords in the past - passkeys are the future The UK's National Cyber Security Centre (NCSC) has updated its official guidance to recommend passkeys as the default authentication method for consumers and businesses, replacing traditional passwords. Passkeys provide superior resilience against modern cyber threats, particularly phishing and credential theft, while offering a faster, more user-friendly login experience.
Google Authenticator: The Hidden Mechanisms of Passwordless Authentication This architectural analysis details the hidden mechanisms behind Google's synced passkeys, revealing a hybrid model that leverages a cloud-based authenticator (enclave.ua5v[.]com) for sensitive cryptographic operations while anchoring trust to local hardware keys. Understanding this infrastructure is critical for defenders to anticipate emerging attack vectors in passwordless authentication environments.
