Yahoo made its first foray into the browser business this evening, but did it give us an unfinished product? As my colleague Rafe Needleman explains, Axis is an aggressive product designed to eliminate the middleman in the usual search process and take visitors from query process straight to the desired page. However, this doesn't appear to be the only step Yahoo skipped; the struggling Internet pioneer also left out an explanation of its terms of service. A search for those basic rules turn up a placeholder page that informs users that, "Terms will go here." Granted most users don't care about the terms of service and even fewer have actually ever read them. But more troubling is a little nugget that Yahoo apparently left in its new browser. Nik Cubrilovic, a self-described blogger and hacker, found that the Yahoo Axis Chrome extension leaks its private certificate file, making it possible to counterfeit extensions: The clearest implication is that with the private certificate file and a fake extension you can create a spoofed package that captures all web traffic, including passwords, session cookies, etc. The easiest way to get this installed onto a victims machine would be to DNS spoof the update URL. The next time the extension attempts to update it will silently install and run the spoofed extension Cubrilovic said he reported the vulnerability to Yahoo but has yet to hear back. "There is also an element of obviousness in this vulnerability," he said in his post. "Any developer who is familiar with how Chrome extensions are verified who looked at the source of this package would have seen and noticed the certificate file." CNET has contacted Yahoo for comment on the matter and will update this post when we learn more information. In a comment attached to Cubrilovic's post, a user identifying himself as Ethan Batraski, head of product for the Search Innovation Group at Yahoo, said the company was taking steps to address the vulnerability: We recently learned of this Chrome vulnerability with Yahoo Axis and immediately disabled the Chrome extension. We have blacklisted the key with Google and is taking into affect immediately.We take these type of issues very seriously and are working around the clock to ensure this is resolved.
GMT 09:14 2017 Wednesday ,18 October
Is facial recognition the stuff of sci-fi? Not in ChinaGMT 08:31 2017 Saturday ,23 September
Vision 2030 will take Saudi Arabia into the futureGMT 20:37 2017 Thursday ,07 September
NASA captures images of strong solar flaresGMT 20:39 2017 Wednesday ,30 August
United Technologies near deal to buy Rockwell Collins: reportGMT 13:41 2017 Saturday ,19 August
Eclipse-chasers trot the globe, addicted to Moon's shadowGMT 17:47 2017 Wednesday ,16 August
NASA: let's say something to Voyager 1 on 40th anniversary of launchGMT 16:41 2017 Friday ,11 August
Asteroid to shave past Earth on Oct 12: ESAGMT 21:32 2017 Tuesday ,18 July
Japanese engineers develop headset-less VR systemMaintained and developed by Arabs Today Group SAL.
All rights reserved to Arab Today Media Group 2021 ©
Maintained and developed by Arabs Today Group SAL.
All rights reserved to Arab Today Media Group 2021 ©
Send your comments
Your comment as a visitor