New classes of attacks against passwordless authentication: threats to Google's synchronized passkey ecosystem

This article analyzes new classes of attacks against passwordless authentication, focusing on Google's ecosystem of synchronized passkeys and the Cloud Authenticator used by desktop clients. The attacks demonstrate how malware on a compromised endpoint can exploit onboarding, recovery, and device trust flows to take control of passkey-protected accounts. We show how an attacker can authenticate without user interaction, bypass user verification requirements, and extract all private keys of synchronized passkeys.

The evolution of threats to authentication

After decades of breaches and billions of losses, the attack vectors that have defined the era of passwords and shared secrets are finally beginning to fade. Passkeys replace traditional passwords and multi-factor authentication (MFA) with public-key cryptography, reducing entire classes of attacks that have dominated the threat landscape for years.

With no shared secrets to steal, reuse, or phish, many of an attacker's most reliable tools are becoming obsolete. This represents a significant disruption to the credential theft market. However, attackers persist, evolve, and defenders must prepare for a new generation of attacks.

New attack surfaces

As passkeys become widely adopted and expand to billions of accounts, defenders must prepare for new attack surfaces, some of which are revealed in this research.

Google's passkey implementation

Google's implementation of synchronized passkeys is particularly instructive due to its scale and how it sets a higher standard for protecting private keys in two critical ways:

• Private keys are generated and used within a cloud-enclave isolation environment
• Hardware-backed keys, tied to the client device, control access to cloud-based cryptographic operations, attesting to the user's presence on a trusted device

Pass-ta-key attacks

We present three new attacks that enable the takeover of passkey-protected accounts. Each attack challenges a different fundamental assumption of passkey authentication security. When a client authenticates with a passkey, it is expected that:

• Users provide explicit consent on the device to verify user presence
• For MFA, users must also unlock the device to verify biometric-based (i.e., something you are) or knowledge-based (i.e., something you know) authentication factors
• Passkey private keys cannot be shared or copied

These attacks, which we have named Pass-ta-key, highlight various practical weaknesses:

• Pass-ta-key attack: An attacker takes control of an account protected by a Google synchronized passkey using malware running on the victim's device, without requiring privilege escalation, device unlock, or user interaction
• Silver Pass-ta-key attack: An attacker tricks the Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to complete account takeover without using the victim's device during authentication
• Golden Pass-ta-key attack: An attacker can extract all synchronized passkeys in a form that allows them to be shared or sold on the black market for credentials

Phase Zero: Reconnaissance

Before attempting any attack, the attacker needs visibility into how passkeys are used within the victim's account. On a compromised endpoint, this visibility is easily available. Chrome locally stores synchronized passkey data as part of its synchronization process. On Windows, Chrome persists this data as encoded proto WebauthnCredentialSpecifics records within its synchronization database.

Accessing these records does not require elevated privileges. The records allow an attacker to enumerate where the victim uses passkeys, along with associated usernames, credential identifiers, and encrypted private keys.

These attacks demonstrate how malware can exploit synchronized passkeys, even when providers add hardware-backed protections to secure credentials within the cloud authenticator. Defenders must be aware of these new threats and prepare to protect user accounts against these emerging attacks.

Additional resources

This article is the third part of our series examining passkey adoption from a security perspective. If you haven't read the previous parts, we recommend starting here:

• Part 1: The Art of the Invisible Key – Passkey Global Breakthrough

If you think you have been compromised or have an urgent issue, contact the Unit 42 incident response team.