<http://schema.org/articleBody>
"Yahoo's new Axis browser has a problem. It was released Wednesday as both an app for iOS and as an add-on for desktop browsers, but Yahoo may not have dotted all the \"i's\" before launch in the latter case.\nThe Google Chrome extension for Axis appears to have launched with a security hole, identified by self-described \"entrepreneur, hacker and blogger\" Nik Cubrilovic. After downloading the extension with the intention of checking out the source code, he found that the private certificate the extension uses to authenticate itself with Google \u2014 essentially the code that performs the \"handshake\" that lets your computer know the download is safe \u2014 could be easily accessed by anyone.\nThat means if a hacker wanted to create a piece of malware that infects Chrome, they could use the certificate to make the malware seem authentic. Once it saw the certificate, Chrome would think the forged extension has been approved by Yahoo.\nCubrilovic says he tested the vulnerability by cloning the Axis extension, then emptying the content (i.e. Axis itself), replacing it with a Javascript alert. Sure enough, the extension installed perfectly as if it were a real Yahoo extension.\n\nSEE ALSO: Yahoo Axis Shines on iPad, an Afterthought on Desktop [REVIEW]\nIf a hacker were to use the certificate, they could theoretically create a piece of malware that could capture all the sites a user visited, including passwords and cookies, Cubrilovic writes. A commenter on Cubrilovic's site claims to be Ethan Batraski, Yahoo's director of product management. He said the company would release an updated extension that would resolve the issue.\nResponding to a query from Mashable, a Yahoo spokesperson said, \"We recently learned of a vulnerability with Yahoo Axis on Chrome. We worked quickly to resolve the issue and have issued a new Chrome plug-in. Users who downloaded Yahoo Axis on Chrome between the hours of 6 and 9 p.m. Pacific Time on May 23, 2012, are encouraged to uninstall the previous version and reinstall the new version.\u201D\nA blog post from Sophos, a digital-security company, confirms Yahoo did replace the Chrome extension.  However, the post says it's unclear whether Chrome will actually know that the earlier certificate has been revoked if a user tried to install a cloned extension using it. The site recommends waiting a few days before trying out Axis for Chrome.\nWhat do you think about how Yahoo handled the Axis launch and the security hole? Have your say in the comments.\nBONUS: A Tour of Yahoo Axis\n\n\nYahoo's New Search App, Axis\n\n\n\n\n\n\n\nYahoo Axis, Splash Screen\nThe screen that greets you when you launch Axis on iPad.\n\n\n\n\n\n\n\n\n\n\nTutorial Screen\nLike many apps today, when you first launch Axis it walks you through how to use it.\n\n\n\n\n\n\n\n\n\n\nAxis Search\nHere's how a typical search shows up on Axis, as a strip of thumbnails across the top.\n\n\n\n\n\n\n\n\n\n\nNew Tab\nNew tabs look like this, with bookmark folders shown similar to search results, with a row of thumbnails.\n\n\n\n\n\n\n\n\n\n\nRegular Search\nHere's how a search for \"The Avengers\" looks in normal mode. Note that the first result is aggregated information, not a thumbnail.\n\n\n\n\n\n\n\n\n\n\nImage Search\nHere's the same search for \"The Avengers\" for images.\n\n\n\n\n\n\n\n\n\n\nPinterest Integration\nAxis for iOS lets you save pin pages using the Pinterest app.\n\n\n\n\n\n\n\n\n\n\nSearch History\nAxis saves your search history, but it doesn't sync it across devices.\n\n\n\n\n\n\n\n\n\n\nOn iPhone\nSince the iPhone screen is smaller, the thumbnail strip takes up the whole screen in landscape mode.\n\n\n\n\n\n\n\n\n\n\nTrending Searches\nYahoo puts search terms that are currently popular front and center before you type anything.\n\n\n\n\n\n\n\n\n\n\nChrome Error\nThe Chrome extension didn't work for us \u2014 we saw this same error over and over.\n\n\n\n\n\n\n\n\n\n\nDesktop Visual Search\nA typical image search, done vie the Axis Firefox add-on.\n\n\n\n\n\n\n"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2012/05/24/yahoo-axis-security-issue/>