Overview
- Palo Alto Networks’ Unit 42 published a report this week detailing three post‑compromise techniques called Pass‑ta‑key, Silver Pass‑ta‑key and Golden Pass‑ta‑key that target Google Password Manager in Chrome without breaking passkey cryptography.
- Pass‑ta‑key lets unprivileged malware use Chrome’s TPM‑backed device identity to request valid authentication assertions without a PIN or biometric check, and the attack succeeds when sites fail to verify the User Verified (UV) flag.
- Silver Pass‑ta‑key forces Chrome to re‑enroll and allows an attacker to register a user‑verification key the cloud will accept because the service did not validate that the new key came from secure hardware.
- Golden Pass‑ta‑key targets the 32‑byte Security Domain Secret (SDS) that encrypts synced passkeys by extracting it from Chrome process memory during re‑enrollment; Google removed the SDS from internal logs but the secret still reaches the client and reporters found no public SDS rotation or revocation control.
- Unit 42 urged practical fixes: websites must require and check the UV bit, cloud services should attest hardware provenance for new keys, credential managers must avoid exposing master secrets in logs or memory, and users must harden Windows endpoints because these attacks only work after malware runs on the device.