Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Recent research from Unit 42 has unveiled significant vulnerabilities in Google Password Manager, specifically targeting its cloud authenticator functionality in Chrome. These vulnerabilities allow malware operating on a compromised Windows machine to access passkey-protected accounts without requiring user verification methods such as fingerprints or PINs. This article delves into the technical aspects of these attacks, their implications for enterprise security, and recommended mitigation strategies.

Technical Analysis

The vulnerabilities identified by Unit 42 are categorized into three distinct attack paths: Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. Each method exploits the way Chrome manages device keys and user verification processes, rather than breaking the underlying cryptography.

1. **Pass-ta-key**: This technique allows attackers to extract the wrapped device identity key from Chrome. By leveraging the Windows Cryptography API: Next Generation (CNG), an attacker can manipulate the Trusted Platform Module (TPM) to sign requests without user interaction.

2. **Silver Pass-ta-key**: This method enables the installation of an attacker-controlled user-verification key, permitting ongoing access to the victim's accounts even after the initial compromise.

3. **Golden Pass-ta-key**: The most severe of the three, this attack extracts the 32-byte Security Domain Secret (SDS), which is pivotal for decrypting synced passkey private keys. This grants attackers reusable access to the victim's accounts from their own environment.

Affected Systems

The vulnerabilities are primarily limited to Google Password Manager in Chrome running on Windows systems that utilize a Trusted Platform Module (TPM). It is crucial for organizations to be aware that these attacks are contingent upon malware already being present on the victim's device, marking them as post-compromise techniques.

Attack Method / Threat Activity

These attacks commence with local reconnaissance, where the malware identifies relevant credential records stored in Chrome's LevelDB database. The metadata accessible to an unprivileged process includes usernames, credential identifiers, and encrypted private-key material, all of which facilitate the subsequent exploitation of the identified vulnerabilities.

Detection Opportunities

📬 Stay ahead of the threat

Get the latest SOC guides, threat intel, and detection engineering — straight to your inbox.

Given that these attacks are post-compromise, detection focuses on identifying the presence of malware on endpoints. Security Operations Centers (SOCs) can implement the following strategies:

  • Monitor for unusual access patterns to the LevelDB database.
  • Utilize endpoint detection and response (EDR) tools to identify unauthorized processes accessing Chrome's data.
  • Implement threat hunting practices to proactively search for indicators of compromise (IoCs) related to known malware signatures.

Mitigation Recommendations

To safeguard against these vulnerabilities, organizations should consider the following measures:

  • Regularly update Chrome and associated components to ensure any patches are applied promptly.
  • Employ robust endpoint protection solutions capable of detecting and blocking malware before it can execute.
  • Educate users about phishing and social engineering tactics that could lead to initial malware infections.
  • Implement multi-factor authentication (MFA) wherever possible to add an additional layer of security.

Business Impact

The implications of these vulnerabilities are significant for enterprises. Unauthorized access to sensitive accounts can lead to data breaches, financial loss, and reputational damage. The ability of malware to exploit these vulnerabilities without user interaction further complicates incident response efforts, making it imperative for organizations to adopt a proactive security posture.

Final Summary

The recent findings regarding Google Password Manager highlight critical vulnerabilities that could be exploited by malware on compromised Windows machines. While these attacks do not compromise the cryptographic integrity of the passkeys, they present a serious risk to user accounts. Organizations must prioritize detection and mitigation strategies to protect against these emerging threats and ensure the security of their digital assets.