📰 Source: The Hacker News
Summary
Google's Password Manager has been found vulnerable to attacks that can bypass passkey protection and grant malware access to users' accounts. Researchers at Unit 42 identified three attack paths, with the most severe targeting the master key. This vulnerability allows attackers to sign into accounts without users' knowledge or interaction.
Attack Flow
Diagram Error
flowchart TB A["Malware Execution"] -->|"Runs as ordinary user"| B["Vulnerability"] B -->|"Exploits Pass-ta-key| C["Cloud Authenticator"] C -->|"Obtains Master Key"| D["Access to Protected Accounts"] D -->|"Unauthorized Access"| E["Victim's Account"]
IAM Impact
This vulnerability has significant implications for Identity and Access Management (IAM) as it allows unauthorized access to accounts protected by passkeys. It highlights the importance of multi-factor authentication and the need for robust IAM controls to prevent such attacks. Organizations must reassess their IAM strategies to ensure they are not vulnerable to similar attacks.
Key Takeaways
- Master Key Compromise: The most severe attack path targets the master key, allowing attackers to bypass all security measures.
- Passkey Vulnerability: The vulnerability in Chrome's Google Password Manager cloud authenticator can be exploited by malware running as an ordinary user.
- Multi-Factor Authentication: The incident underscores the importance of multi-factor authentication to prevent unauthorized access to sensitive accounts.
Recommendations
- Implement Multi-Factor Authentication: Organizations should consider implementing multi-factor authentication for all sensitive accounts to prevent unauthorized access.
- Regular Security Audits: Conduct regular security audits to identify and address potential vulnerabilities in IAM systems.
- Monitor for Malware: Implement robust malware detection and prevention measures to prevent malicious software from exploiting the vulnerability.