SquareX Researchers Demonstrate Vulnerability in Passkey Login via WebAuthn Manipulation

What's Happening?

Researchers at SquareX, a security firm, have identified a method to bypass passkey-protected accounts by exploiting the WebAuthn process. Passkeys, which are considered a secure alternative to traditional passwords, allow users to authenticate using a private key stored on their device. This method is supported by major tech companies like Microsoft, Amazon, and Google due to its resistance to phishing attacks. However, the researchers demonstrated at DEF CON that the passkey system can be compromised if the browser environment is manipulated. The attack involves hijacking the WebAuthn API through JavaScript injection, allowing an attacker to impersonate a user and bypass passkey-based security. This can be achieved by convincing users to install a malicious browser extension or exploiting a client-side vulnerability on a website.

Why It's Important?

The discovery of this vulnerability highlights potential security risks associated with passkey authentication, which is increasingly being adopted as a safer alternative to passwords. The ability to bypass passkey security could have significant implications for user privacy and data protection, especially as more companies and services transition to this method. This vulnerability could undermine trust in passkey systems and prompt a reevaluation of their security protocols. Companies relying on passkey authentication may need to implement additional safeguards to protect against such attacks, potentially affecting their operational costs and security strategies.

What's Next?

In response to this vulnerability, tech companies and security experts may need to develop enhanced security measures to protect passkey systems from manipulation. This could involve stricter controls on browser extensions and more robust detection of client-side vulnerabilities. Additionally, there may be increased scrutiny and testing of WebAuthn implementations to ensure they are resistant to such attacks. Users may also be advised to be cautious about installing browser extensions and to stay informed about security updates from service providers.