Malware can steal Google Password Manager passkeys on Windows

Researchers have discovered several ways to bypass protections around passkeys stored in Google Password Manager. The attacks, collectively known as Pass-ta-key, can allow malware to intercept authentication and, in some cases, gain access to a user's entire collection of synced passkeys, 9to5Google reports.

The issue affects Google Password Manager in Chrome on Windows, but the device must already be infected with malware for the attacks to work. Passkeys on an uncompromised computer are not affected.

Researchers identified several attack methods:

• The first allows malware to access a protected identification key. Instead of remaining inside the TPM, the key can be exported to disk, allowing malware to authenticate with Google Password Manager without the user's approval.
• The effectiveness of this method depends on the website. During testing, researchers were able to use it to access an eBay account because the service did not check a flag confirming that user verification had taken place.
• The second method, called Silver Pass-ta-key, can make Google Password Manager believe that the device owner has verified their identity using biometrics.
• An infected computer is placed into an incomplete enrollment state in which user verification has not technically been completed. Malware can then register its own keys, which are subsequently treated as approved.

The most serious method, dubbed Golden Pass-ta-key, targets a secret stored in Chrome's memory that is used to encrypt synchronized passkeys.

The secret previously could also appear in Chrome logs. Google has removed it from logging, but researchers found that it still remains in the browser's process memory for a period of time. Malware can create a memory dump and use the extracted secret to decrypt a user's synchronized passkeys.

The stolen secret can expose not only existing passkeys but also new ones subsequently created through Google Password Manager. They remain at risk until the service generates a new encryption secret.

Researchers reported the attack methods to Google and noted that other passkey providers use similar cloud-based storage and synchronization models.

The findings do not mean passkeys themselves have become less secure. They still protect against several weaknesses associated with traditional passwords, including credential guessing and conventional phishing attacks.

The newly discovered methods require the Windows device to already be compromised and target Chrome's authentication and passkey synchronization processes.