tag: Passkeys · 9 items
- Engineer — Plan: Hard deadline of February 2027 for Entra ID SMS and voice auth retirement; begin inventorying affected users and roll out FIDO2/passkey or Authenticator app enrollment before the cutover to avoid sign-in disruptions.
- SOC/IR — Learn: The eventual deprecation of SMS/voice MFA will shift the phishing and MFA-bypass attack surface — worth tracking to anticipate adjustments to credential-theft detection logic, but no immediate hunting action needed.
- Leader — Plan: Microsoft is enforcing a February 2027 hard deadline on SMS/voice auth in Entra ID; allocate team capacity this quarter to scope user migration and avoid service disruptions that could escalate to a leadership incident.
- Engineer — Plan: Entra ID SMS first-factor sign-in retires February 2027 — begin migrating users to passkeys or other phishing-resistant methods this quarter to avoid sign-in disruptions before the deadline.
- SOC/IR — Skip
- Leader — Plan: Confirm a funded migration roadmap is in place to move Entra ID users off SMS first-factor before the February 2027 cutover; delays could cause sign-in outages and customer-facing disruption.
- Engineer — Learn: Novel attack taxonomy spanning enrollment, credential sync, recovery, and prompt abuse—none break FIDO2 crypto but all exploit surrounding trust boundaries. Use this to audit your passkey rollout design and recovery flow assumptions; no patch or config change is required today.
- SOC/IR — Learn: No active exploitation, IOCs, or ATT&CK-mapped TTPs are present, but understanding these authentication-layer abuse paths could sharpen future detection logic around anomalous passkey enrollment and recovery events.
- Leader — Plan: If the organization is actively deploying or roadmapping passkeys, this research warrants a review of vendor implementation choices and recovery-path risk this quarter—39 documented bypass methods is a meaningful input to a passkey adoption strategy.
- Engineer — Learn: Novel architecture for passkey export/import without plaintext key exposure — worth reading if you’re designing FIDO2 recovery flows, but this is a prototype proposal with no standard status yet and no action required on running systems.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: If you’re deploying or have deployed cloud-synced passkeys, evaluate migrating to hardware-bound (device-local) passkeys where possible; the research shows synced passkey material can be exfiltrated by malware and Windows-issued signed auth tokens can be replayed — audit your passkey configuration to prefer non-synced, phishing-resistant authenticators.
- SOC/IR — Learn: These attacks require malware already present on the endpoint, making detection of credential-theft behaviors (auth token exfiltration, suspicious cloud-sync API calls) the relevant angle — no published IOCs or ATT&CK mappings yet, but worth revisiting passkey-related telemetry if new technique details emerge.
- Leader — Learn: Passkey rollouts sold internally as phishing-proof may need a qualification: device-bound variants maintain that property but cloud-synced ones carry residual risk if endpoints are compromised — useful context for board decks or vendor questionnaire responses that reference passkey adoption.
- Engineer — Learn: Unit 42’s three attack paths show that malware with ordinary user privileges can silently sign into passkey-protected accounts via Chrome’s Google Password Manager cloud authenticator, undermining the assumption that passkeys are malware-resistant. No patch is available; understand this changes the trust model for GPM-backed passkeys as a control and evaluate whether hardware-bound keys or platform authenticators offer stronger guarantees for high-value accounts.
- SOC/IR — Plan: The three named techniques (Pass-ta-key variants) targeting Chrome’s credential store represent detectable post-exploitation behaviors; build detections around suspicious process access to Chrome’s local password/passkey storage and anomalous silent authentication events originating from endpoints, even without prior IOCs.
- Leader — Learn: Research demonstrates that passkeys stored in Google Password Manager do not provide the malware-resistance often assumed in enterprise migration pitches; factor this into any planned passkey rollout strategy and update risk narratives shared with leadership or customers around phishing-resistant MFA claims.
- Engineer — Learn: Researchers demonstrate that Google Password Manager’s synced passkeys can be extracted once malware has endpoint access, undermining a key passkey security assumption. No patch available; factor this into threat models when recommending passkey adoption and ensure endpoint hardening is a prerequisite.
- SOC/IR — Learn: The attack chain requires malware already present on the host, so existing endpoint detection coverage is the primary defense; no IOCs or mapped TTPs are published yet to support a dedicated hunt.
- Leader — Learn: A novel attack class that weakens the ‘passkeys are phishing-resistant’ narrative by showing synced credentials can be stolen post-compromise; useful context for briefings on authentication strategy but no immediate organizational action is warranted.
- Engineer — Plan: Audit your WebAuthn/passkey relying party implementation to confirm the User Verified flag is enforced; if your app accepts assertions without UV=true, you’ve silently degraded MFA to single-factor auth.
- SOC/IR — Learn: No exploitation in the wild reported and no IOCs available; useful for understanding how passkey bypass could appear in authentication logs if UV flag checks are absent.
- Leader — Skip
- Engineer — Plan: This is a breaking change to default authentication behavior in Entra ID — audit your tenant’s authentication policy, test passkey rollout for user flows, and review the updated SMS/voice auth model before it affects production sign-ins.
- SOC/IR — Learn: Passkey adoption changes the phishing-resistant auth landscape and may affect credential-based attack detections; no immediate hunt or detection work required, but worth understanding how login telemetry shifts.
- Leader — Plan: A platform-level auth default change from a major identity provider warrants a quarter-horizon review of helpdesk readiness, user communication plans, and any compliance attestations tied to MFA method specifics.