A significant implementation flaw in how Google Password Manager handles passkey synchronization on Windows has been laid bare by security researchers, who devised three methods for malware to hijack these supposedly phishing-resistant credentials. The attacks, which require an initial device compromise, demonstrate how the convenience of cloud synchronization can fundamentally undermine the hardware-bound security model of the FIDO2 standard.
Passkeys are built on FIDO2 principles, which bind private cryptographic keys to a specific device's secure enclave, making them resistant to remote theft and phishing. Google's approach for Windows, however, relies on a software-based sync model managed through its Password Manager. This creates a critical architectural disconnect: where the standard envisions keys locked in tamper-resistant hardware, Google's implementation places them in accessible files within the operating system.
Dubbing the exploit chain "Pass-ta-key," the researchers illustrated three practical attack vectors on already-compromised Windows machines. One method involves malware with elevated privileges directly extracting the passkey storage files. A second technique automates the use of these keys, bypassing Windows Hello or other user verification prompts that normally require a PIN or biometric check. The third vector employs API hooking to intercept authentication requests as they happen, effectively man-in-the-middle-ing the validation process.
While the attacks necessitate prior administrative access and do not allow for remote, unauthenticated exploitation, the enterprise ramifications are serious. Once an attacker gains a foothold on a Windows endpoint, synced passkeys effectively erase the anti-phishing benefits that drive many passwordless authentication strategies. This allows for silent pivoting across cloud services, internal portals, and SaaS applications without triggering traditional alerts for credential theft.
The disclosure forces a broader conversation about the security of cross-device synchronization in the FIDO2 ecosystem. The trade-off between user convenience and robust security is starkly illustrated here, as syncing shifts the trust boundary from immutable hardware to the potentially vulnerable host OS. For security architects, the findings necessitate an update to threat models, treating passkey theft from compromised endpoints with the same severity as traditional credential compromise.
For IT and development teams managing authentication—particularly in rapidly cloud-adopting regions like Hong Kong—this research underscores the need for policy review. Organizations should audit their Google Workspace and Chrome passkey synchronization settings. High-privilege accounts may require the use of strictly hardware-bound, non-synced passkeys on dedicated security keys. Standard user accounts using synced passkeys should be protected with enhanced endpoint detection and response (EDR) and conditional access policies verifying device health. As Google and other identity providers evaluate mitigations, the industry must address whether future standards can safely bridge the gap between usability and the original hardware-root-of-trust promise.
安全研究人員揭露了Google密碼管理器在Windows上處理通行金鑰同步時的重大實現漏洞，並設計出三種讓惡意軟件劫持這些被認為可防釣魚憑證的方法。這些攻擊需先入侵設備，證明雲端同步的便利性可能根本性削弱FIDO2標準的硬件綁定安全模型。
通行金鑰基於FIDO2原則構建，將私密加密金鑰綁定至特定設備的安全隔區，使其能抵禦遠程盜竊和釣魚攻擊。然而Google的Windows方案依賴通過密碼管理器管理的軟件同步模式，導致關鍵架構脫節：標準設計將金鑰鎖定在防篡改硬件中，而Google的實現卻將其置於作業系統的可存取檔案內。
研究人員將此漏洞鏈命名為"Pass-ta-key"攻擊，並在已被入侵的Windows設備上演示了三種實際攻擊途徑。其一涉及具提升權限的惡意軟件直接提取通行金鑰儲存檔案。第二種技術則自動化使用這些金鑰，繞過通常需要PIN碼或生物辨識檢查的Windows Hello或其他用戶驗證提示。第三種途徑採用API鉤子技術，在認證請求發生時進行攔截，實質上對驗證過程進行中間人攻擊。
雖然攻擊需要預先獲取管理權限且無法進行遠未經授權的利用，但其對企業影響極為嚴重。一旦攻擊者在Windows終端設備站穩腳跟，同步通行金鑰實質上消除了驅動眾多無密碼認證策略的防釣魚優勢。這使得攻擊者能在觸發傳統憑證盜竊警報的情況下，靜默轉移至各雲端服務、內部入口及SaaS應用程式。
此披露迫使業界更廣泛探討FIDO2生態系統中跨設備同步的安全性。用戶便利性與強健安全性的權衡在此清楚呈現，同步將信任邊界從不可變硬件轉移至可能受損的主機作業系統。對安全架構師而言，這些發現要求更新威脅模型，應將從受入侵終端盜取通行金鑰視為與傳統憑證洩露同等嚴重的威脅。
對於管理認證的IT及開發團隊——尤其在像香港這樣快速採用雲端的地區——這項研究突顯了政策檢討的必要性。組織應審計其Google Workspace與Chrome通行金鑰同步設定。高權限賬戶可能需要使用嚴格綁定硬件、不同步的通行金鑰專用安全金鑰。採用同步通行金鑰的標準用戶賬戶應透過強化端點偵測與回應(EDR)及驗證設備健全狀況的條件式存取政策進行防護。隨著Google及其他身份提供者評估緩解措施，業界必須解決未來標準能否安全橋接可用性與原始硬件信任根承諾之間差距的問題。