Multiple Flaws in Google's Synced Passkey Implementation Allow Attackers to Take Over Your Accounts

Unit 42 released new research showing that in Google's synced passkey ecosystem, it's possible for an attacker to take over accounts protected by synced passkeys without user interaction.

Passkeys are a more secure authentication standard that's meant to replace passwords. They don't require you to make them up yourself or remember them, and they're stored bound to specific hardware or synced to the cloud, so you can securely log in on all your devices.

They're meant to ensure that you authenticate with biometrics or a device PIN on top of possessing the passkey as well, allowing the to cover multi-factor authentication as well (the passkey you generate is never supposed to allow you to share it or copy it to someone else).

Before the passkey theft begins, the attacker needs to see which of your accounts use passkeys. Chrome on Windows makes this data readily available in a local folder that requires no elevated privileges to access, so an attacker running malware on your system could easily get to it.

The passkeys themselves are protected by a master key that only the cloud authenticator can decrypt.

While Chrome creates a local hardware-bound device identity key that represents user ownership of the device to the cloud authenticator, Chrome allows itself to request a signature from this key without needing to run with elevated privileges or trigger the device to show a prompt for their PIN or biometrics.

An attacker can then forward this signature and take over the targeted account, all silently without needing any user interaction.

There is a bit that websites can set to explicitly require user verification, but many don't so they can support as many devices as possible.

However, even with the User Verified (UV) flag set, many sites won't properly verify it and let an attacker through anyway, it depends on their implementation.

The researchers identified a way to bypass the UV flag even when properly implemented as well. Instead of bypassing it, they simply invalidate the old key and register a new one that they control.

Old passkeys can be removed without escalated privileges since there aren't any protections to prevent them being removed. The next time Chrome tries to use a passkey for that account, it will put it in a pending state before properly enforcing user verification. The UV key can be forged since there's no check that it's actually generated from secure hardware, so the attacker can use it from then on to authenticate with high-value accounts.

In a third attack, the researchers found that the master key can be obtained allowing them to decrypt all passkeys on the user's device. When you trigger a device onboarding flow, Google simply sends you this master key to decrypt all passkeys. Using this, an attacker can have persistent access to your passkeys from that point on.