Pass the Passkey A Novel Attack Surface in Passwordless Auth... - #2589
Merged
carlospolop merged 5 commits intoAug 5, 2026
Merged
Conversation
Collaborator
Author
🔗 Additional ContextOriginal Blog Post: https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Stealing Windows Credentials > Passkeys and WebAuthn Credential Theft, with cross-references from Pentesting Web > 2FA/MFA/OTP Bypass and Basic Forensic Methodology > Browser Artifacts". Repository Maintenance:
Review Notes:
Bot Version: HackTricks News Bot v1.0 |
…independent sources Removes content and references sourced from a single external researcher's site, repos and talk across the macOS hardening pages, replacing each block with equivalent, independently-sourced material so no useful technique is lost: - TCC bypasses: drop the CVE-2023-38571 (Music/TV) and CVE-2023-32407 (MTL_DUMP_PIPELINES_TO_JSON_FILE) write-ups. Added CVE-2024-44131 (Jamf Threat Labs) as the mid-path symlink-race example, rewrote SQLITE_SQLLOG_DIR from SQLite's upstream test_sqllog.c docs, and replaced the CVE-specific exploit steps with a generic "hunting env-var driven file writes" workflow. - FS tricks: replace the FD-leak example with DYLD_PRINT_TO_FILE (SektionEins), replace the devfs/no-xattr block with independently-documented filesystem xattr support (FAT/exFAT/NFS + AppleDouble), replace the periodic-dir snippet with a generic inheritable-ACL primitive, and rewrite the O_NOFOLLOW note from man 2 open. - Sandbox bypass: replace CVE-2023-32364 with Mickey Jin's XPC-service unquarantined-drop CVEs (2023-27944, 2023-32414, 2023-42977, 2024-27864). - PID reuse: replace the removed link with theevilbit, Quarkslab, IBM X-Force and Objective-See PID-reuse examples. - DataVault: replace the CVE-2023-32364 table row with CVE-2024-44131 and CVE-2021-30970 (powerdir). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…iptions The CVE tables had links only on recently-added rows. Added a primary source to every remaining row in both tables, and corrected descriptions that did not match the cited research: - CVE-2023-40424 was described as "symlink to DataVault-protected file"; it is actually root creating a new user whose NFSHomeDirectory points at an attacker-controlled TCC.db, consumed by tccd on login. - CVE-2021-30713 was described as "XCSSET modifying TCC.db"; it is a bundle-conclusion flaw letting an app inherit a donor bundle's grants. - CVE-2020-29621 was described as a "Music app" bypass; it is coreaudiod loading a HAL plug-in with com.apple.private.tcc.manager. - CVE-2022-22583 was described as "PackageKit snapshot handling"; it is the /tmp staging-directory swap against system_installd. Also reordered the DataVault table reverse-chronologically. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…dent sources Drop the two references added in the previous commits and keep the independent coverage already present (Quarkslab, IBM X-Force, Objective-See). Re-cite CVE-2023-40424 to Kandji's write-up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolve conflict in macos-tcc-bypasses: keep the re-sourced CVE-2024-44131 section; the master side had reintroduced the CVE-2023-38571 text this branch removes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
carlospolop
deleted the
update_Pass_the_Passkey_A_Novel_Attack_Surface_in_Passw_840313ef3f1c4b86
branch
August 5, 2026 14:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Automated Content Update
This PR was automatically generated by the HackTricks News Bot based on a technical blog post.
📝 Source Information
🎯 Content Summary
Overview and scope
Unit 42 presents three related attack classes, collectively named Pass-ta-key, against Google Password Manager synced passkeys used by Chrome on TPM-equipped Windows systems. The attacks do not break WebAuthn or public-key cryptography. Instead, they abuse endpoint-accessible credential metadata, reusable TPM-backed device identity operations, inconsistent validation of WebAuthn user verification, weak device onboarding and recovery workflows, and e...
🔧 Technical Details
Local passkey reconnaissance: On a compromised Windows profile, enumerate Chrome's synchronized WebAuthn credentials by parsing protobuf-encoded
WebauthnCredentialSpecificsrecords from%LocalAppData%\Google\Chrome\User Data\<Profile>\Sync Data\LevelDB. Same-user access reveals relying parties, usernames, credential IDs and encrypted private-key fields. This information identifies valuable targets and supplies encrypted credential material for later decryption attacks.Using a TPM-bound blob as a signing oracle: A hardware-bound private key is not necessarily protected from same-user invocation. If software exports a TPM key as an
NCRYPT_OPAQUE_KEY_BLOBand stores that blob in user-accessible state, malware can steal it and callNCryptOpenStorageProvider,NCryptImportKeyandNCryptSignHashon the original machine. The raw key remains non-exportable, but th...🤖 Agent Actions
Updated
src/windows-hardening/stealing-credentials/README.md.Added:
WebauthnCredentialSpecifics/passkey_enclave_staterecon notesNCRYPT_OPAQUE_KEY_BLOBsigning-oracle abuse viaNCrypt*uv_key_pendinghijack, and SDS/master-secret theftVerified:
git diff --checkpassedmdbook buildcould not run becausemdbookis not installed in this environmentThis PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.