Experts reveal Google Password Manager can be hijacked to let hackers steal passkeys and gain access to all your secrets
- Palo Alto Networks’ Unit 42 detailed three Google passkey exploits
- Attacks require prior malware infection; methods ranged from impersonating victims to stealing the master secret protecting synced passkeys
- Google implemented fixes after disclosure, with some services (e.g., eBay) patching vulnerabilities directly
Security researchers from Palo Alto Networks’ Unit 42 have found three ways to exploit Google’s passkey system and log into people’s PIN- or biometrics-protected accounts.
They named these ways ‘Pass-ta-key’, ‘Silver Pass-ta-key’, and ‘Golden Pass-ta-key’, each being progressively more dangerous than the previous one.
While it sounds mighty dangerous, there are major caveats to the exploit, and some of the holes have been plugged already.
Trusting the wrong device
The biggest caveat is that the victim’s device needs to be infected with malware beforehand. Malware can do all sorts of things, from stealing session cookies to exfiltrating sensitive data, so if a device is tainted with malware, it’s...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
