New yahoo browser

Yahoo made its first foray into the browser business called Axis. It is an aggressive product designed to eliminate the middleman in the usual search process and take visitors from query process straight to the desired page.

However, this doesn’t appear to be the only step Yahoo skipped; the struggling Internet pioneer also left out an explanation of its terms of service. A search for those basic rules turns up a placeholder page that informs users:”Terms will go here.”

(Credit:

Granted, most users don’t care about the terms of service and even fewer have actually ever read them. But more troubling is a little nugget that Yahoo apparently left in its new browser.

Nik Cubrilovic, a self-described blogger and hacker, found that the Yahoo Axis Chrome extension leaks its private certificate file, making it possible to counterfeit extensions:

The clearest implication is that with the private certificate file and a fake extension you can create a spoofed package that captures all web traffic, including passwords, session cookies, etc. The easiest way to get this installed onto a victims machine would be to DNS spoof the update URL. The next time the extension attempts to update it will silently install and run the spoofed extension

Cubrilovic said he reported the vulnerability to Yahoo but has yet to hear back.

“There is also an element of obviousness in this vulnerability,” he said in his post. “Any developer who is familiar with how Chrome extensions are verified who looked at the source of this package would have seen and noticed the certificate file.”

CNET has contacted Yahoo for comment on the matter and will update this post when we learn more information.

In a comment attached to Cubrilovic’s post, a user identifying himself as Ethan Batraski, head of product for the Search Innovation Group at Yahoo, said the company was taking steps to address the vulnerability:

We recently learned of this Chrome vulnerability with Yahoo Axis and immediately disabled the Chrome extension. We have blacklisted the key with Google and is taking into affect immediately.We take these type of issues very seriously and are working around the clock to ensure this is resolved.

Advertisements

One thought on “New yahoo browser”

  1. Very great post. I simply stumbled upon your blog and wished to mention that I have truly loved browsing your blog posts. In any case I will be subscribing in your feed and I hope you write again very soon!

    Like

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s