Google Password Manager Attacks

Source: Android Police Article

I would believe most of us use passkey storage systems like Google Password Manager, simply because it is so much easier and more convenient than having to type in our passwords every single time. However, this article might make you reconsider how safe this is:

First Attack Path

Named Pass-ta-key, the first method extracts Chrome's Trusted Platform Module (TPM) key to sign an attacker's request, and Google Cloud Authenticator returns a valid assertion that is essentially the same as that for a legitimate request, except the User Verified (UV) flag is left unset. So now, the responsiblity actually shifts to the relying site, since the authentication fails only if the site requires that flag to be set, as proven by Github which enforced that check.

Personally, I feel that this is a perfect opportunity for defense in depth. Google Cloud Authenticator should prevent the reuse of keys while relying parties should always enforce the user verification policy where applicable.

Second Attack Path

The second technique is Silver Pass-ta-key, which can force Chrome to re-enroll a user's device, providing a window in which an attacker can register one of their own user-verification key instead of the one Chrome creates for the user. Since there is no check of whether the key comes from a secure origin, assertions signed with that key will now carry the UV flag. Now, attackers can login without access to the victim's device.

A clear fix for this would be hardware attestation as mentioned in the article, as it completely eliminates the possibility of the attacker's key being accepted. However, another mitigations I believe could help would be another authentication layer for re-enrolling the device.

Third Attack Path

The last one, Golden Pass-ta-key, attacks the 32-byte secret used to decrypt the private keys of the saved passkeys. While forcing re-enrollment, this master secret has to be present in Chrome's process memory as plaintext, so it can be extracted during this window. The attacker can then access all accounts whose passkeys have been stored in the password manager.

This attack is only preventable on the server side, as the master secret must be kept out of client contexts as much as possible, and especially not as plaintext.

Reality of the threat

Whenever I read security news, the initial reaction is usually quite alarming. Because it feels like there are so many new attack vectors and threats cropping up each day, and as day to day users of so many services on the Internet, we might not even realise what exactly we are exposing ourselves to. However, it all comes down to one key concept: Risk. How severe a threat is really depends on how exploitable it is, and how severe the aftermath of the attack is. Although the above attacks seem to have drastic consequences, the pre-requisite is that malware is already running on the victim's device, and the scope of the attack is also limited to Windows systems running Chrome with TPM. Regardless, there are still gaps in the known information about the persistence and feasibility of these attacks, as well as remediation status. Perhaps that too is a cause for concern, but just remember the same 4 letters: RISK!