Researchers Uncover 'Pass-ta-key' Attacks Exploiting Passkey Vulnerabilities
New research reveals novel attack vectors, dubbed 'Pass-ta-key,' that can compromise accounts secured by passkeys, undermining the security promises of passwordless authentication.
Palo Alto Networks' Unit 42 has identified a significant new attack surface within passkey implementations, particularly affecting Google's synced passkey ecosystem and cloud authenticators. These "Pass-ta-key" attacks demonstrate how malware on a compromised endpoint can exploit onboarding, recovery, and device trust workflows to achieve full account takeover, even bypassing user verification steps.
While passkeys promise to usher in an era of enhanced security by replacing vulnerable passwords with public-key cryptography, this research highlights that the transition is not without its own risks. The attacks challenge fundamental assumptions of passkey security: that users provide explicit consent on their device, that multi-factor authentication requires a device unlock, and that private keys cannot be shared or copied. The "Pass-ta-key" moniker playfully encapsulates the complex and tangled nature of these new exploits.
The research details three distinct attack classes. The primary "Pass-ta-key" attack allows an attacker to take over an account protected by a Google-synced passkey using malware already present on the victim's device. This occurs without the need for privilege escalation, device unlock, or any user interaction, directly contradicting the expected security model.
A more sophisticated variant, the "Silver Pass-ta-key" attack, deceives the Google Cloud Authenticator into believing the victim has authenticated biometrically. This enables account takeover without the attacker needing to use the victim's actual device during the authentication process, further eroding the trust placed in the authenticator's verification mechanisms.
The most alarming of the three is the "Golden Pass-ta-key" attack. This exploit provides a method for attackers to extract all synced passkeys. The compromised keys are then in a format that can be easily shared or sold on the dark web, potentially leading to widespread credential theft and account compromises.
These attacks are particularly concerning as they leverage malware already present on a victim's device, a common initial compromise vector. The research focuses on Google Password Manager in Chrome on Windows with a Trusted Platform Module (TPM), but the underlying principles could affect other passkey providers and platforms that utilize similar cloud authenticator models.
Before launching these attacks, an attacker requires reconnaissance to understand how passkeys are used within the victim's account. Chrome locally stores synced passkey data, including encrypted private keys, within its sync database in a format accessible without elevated privileges. This allows attackers to enumerate services where passkeys are used and gather the necessary identifiers to initiate an attack.
Palo Alto Networks emphasizes that its customers are protected through products like Cortex Cloud Identity Security and Idira Threat Detection and Response. The company has responsibly disclosed these vulnerabilities, urging defenders to prepare for this new generation of attacks as passkey adoption scales globally.