Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Summary: Unit 42 researchers described three attacks, nicknamed Pass-ta-key, that let malware already on a Windows device misuse Google's synced passkey ecosystem and Cloud Authenticator to take over passkey-protected accounts without user interaction, biometrics, device unlock, or elevated privileges. The attacks exploit Chrome's storage of synced passkey records in its sync database and a TPM-wrapped identity key that malware can extract and use to sign authentication requests, with testing showing a successful login to eBay even though it set userVerification to required, an issue eBay later fixed.

What you should know: The attacks reduce passkey authentication to a single factor: compromising only the device identity key was enough to authenticate even where MFA was required, and relying parties that fail to validate the User Verified flag accept assertions with no user verification at all.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related