Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Yahoo!'s Chrome search extension dubbed Axis was found on its debut launch to have exposed a private certificate capable of allowing attackers to craft authentic but malicious plugins.
The flaw was detected by Aussie security researcher and coder Nik Cubrilovic who detailed a proof of concept interception attack that used the signing key on his blog.
The certificate file is used by Yahoo! to sign the extension package, which is used by Chrome and the webstore to authenticate that the package comes from Yahoo!," Cubrilovic said.
"With access to the private certificate file, a malicious attacker is able to create a forged extension that Chrome will authenticate as being from Yahoo!
“The clearest implication is that with the private certificate file and a fake extension, you can create a spoofed package that captures all web traffic including passwords [and] session cookies."
He said the code could be delivered by running a DNS spoof of the update URL which would silently install and run the spoofed extension during an update.
Yahoo! disabled the Google Chrome extension and issued a fixed version.
Yahoo!'s Axis team blacklisted the exposed certificate key with Google which it said resolved the vulnerability.
“We take issues like this very seriously and are dedicated to working around the clock to ensure resolution. We apologise for any inconvenience.”
This article originally appeared at scmagazineuk.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.
