8 ms·
Yahoo Axis Chrome Extension Leaks Private Certificate File
- dmboyd 14y agoProbably the obvious fix is for them to change the auto update path to https rather than http on a subsequent update. Are there any good reasons why this wouldn't have been done in the first place?
- dws 14y agoYahoo! released Axis (with this very dumb mistake) at 5pm PST, and by 9pm PST their public key is posted, with a "I report this but have yet to hear back" note. How, exactly, is this responsible disclosure?
- zobzu 14y agoits a private key btw. wouldn't be any issue if it was a public key. its not responsible disclosure but then again, everyone could see the key after an hour. it's not like if it was a complex exploit. Its more like if you printed the password to your stuff on a document and told the world to grab a copy. ;-)
- jrockway 14y agoWhether or not the disclosure is responsible is irrelevant. What's irresponsible is uploading Yahoo's private signing key to the Internet. The author of this article is just warning others so they can uninstall the extension before someone uploads malware and Chrome auto-updates it.
- ktizo 14y agoIs a brand new thing with no userbase. Seems an extremely responsible time to disclose this. As I understand it, responsible disclosure is primarily there to protect the userbase of a piece of software, not the reputation of the producer of that software. And surely they can't be being stupid enough to be using this same signing key on established products, can they? On reflection, scrub that last thought.
- marshray 14y agoThe question isn't so much what other things Yahoo! might be using this signing key for, it's what other things bad guys might be able to sign with it.
- ktizo 14y agoThose two are sort of the same question however. If this is the only thing signed with this key, then the attack surface is only people running this thing.
- dmboyd 14y agoConsidering that in this case the "public end users" are the ones who are most at risk due to this vulnerability, I think its fair game that this be a public disclosure. i.e. people should delete this browser add on (and anything signable with the same key) as its been compromised.
- nikcub 14y agoI always, always, always go the route of contacting vendors - over the past 15 years I have reported hundreds of security and privacy vulnerabilities. This is the first time where I haven't reported to the vendor first before disclosing. The way this came about was a bit different, because it started with a tweet[1] where I pointed out that the file was there, and then it gradually developed into realizing that it is a pretty big deal. The discovery happen out in the open. If you look at my timeline and the replies and conversations you will see how it came about. With hindsight I could have handled it differently, but it just happen to come out in this way. I added an update to the end of the post addressing disclosure. The goal at the moment is to make users aware that there is potentially a big issue here. [1] https://twitter.com/nikcub/status/205489752684765185 https://twitter.com/nikcub/status/205489752684765185
- iuguy 14y agoIt's your bug, finders keepers. I always despair when I hear people talk about 'responsible disclosure', as it's a term so often used by vendors to keep finders quiet. By disclosing it at all you've highlighted the issue and Yahoo have rightly moved to fix it quickly. So I can sign a chrome extension with a valid cert for maybe a day, it's not the end of the world.
- lawnchair_larry 14y agoI too hate that term. Even Microsoft rejects it.
- tptacek 14y agoThere was zero (0) chance this wasn't going to get found 100 times independently whether or not you publicized it. Getting it out quick and loudly was absolutely the right move. You have nothing at all to apologize for.
- nikcub 14y agothanks. and you are right, at least two other people found the same thing, then searched twitter and found my post about it. one of them was @rasmus the creator of PHP (pretty funny timeline of him discovering and then finding on twitter).
- fffggg 14y agoResponsible disclosure exists in order to allow an obscure, previously undiscovered bug to be patched before others know about it. The idea is that no one else is likely to discover the issue while it is repaired. This is not an obscure bug. This is obvious -- very obvious. Many people will have discovered this already. Furthermore this is a pre-release product. There is nothing to be gained by not talking about it.
- sneak 14y agoYahoo were the ones doing the disclosure of the secret (the private key) when they uploaded it to the web. Please stop parroting "responsible disclosure" like a white knight, and engage your brain.
- DennisP 14y agoResponsible disclosure gives the vendor a chance to fix a flaw before everyone knows about it. In the case of a private key exposure, the only possible fix is to tell everyone to stop trusting that key. That's exactly what happened here.
- est 14y agoThe browser is the new toolbar. In case you haven't seen it, IE7Pro added some major features to IE. Some toolbars even added `data:` schema support to IE. Want to see the cool Moog doodle? Download the latest HTML5™ toolbar today! Want to use premium Yahoo features? Download the Axis toolbar!
- jrockway 14y agoOut of protest, I downgraded to NCSA Mosaic and tied an onion to my belt, which was the style at the time. Not many web pages loaded correctly, but the important thing was that I had an onion on my belt, which was the style at the time.
- codezero 14y agoI managed to get Mosaic to compile on OS X, interestingly enough some pages do still load and look OK. One was Dennis Ritchie's page: http://cm.bell-labs.com/who/dmr/ http://cm.bell-labs.com/who/dmr/ It's a entertaining experience.
- damncabbage 14y agoMind posting the instructions / gotchas? :)
- rogerbinns 14y agoSomeone has made a site that emulates the old browsers, which is almost as much fun: http://www.dejavu.org/emulator.htm http://www.dejavu.org/emulator.htm
- codezero 14y agoIt was actually really easy. It's not much of a surprise if you think about it. Most of the libraries Mosaic was built on ended up becoming standard, so you can just go download the old versions, compile them and link. (think libpng, Motif, etc...) If people were interested enough I could write a quick walkthrough of what is needed though since some of it wasn't intuitive :) edit: probably a lot easier to just get it on github https://github.com/alandipert/ncsa-mosaic https://github.com/alandipert/ncsa-mosaic -- possibly not nearly as fun. Make linux probably won't work on Mac OS X (almost), I recall having to force the compiler to create a 32 bit executable and some other things.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- drgath 14y agoI'm a Yahoo. Reviewing the ticket now and things are being taken care of.
- ktizo 14y agoCue sound of black helicopters being dispatched to visit nikcub. (only kidding, for one thing Yahoo's black helicopters don't make any sound)
- gojomo 14y agoAnd, Yahoo's black helicopters are purple.
- drgath 14y agoAnd, they yodel when they take off.
- phillco 14y agoThis effect can be simulated by going to yahoo.com and clicking the period in the logo.
- ktizo 14y agoThat isn't a simulation. When you click the period it actually launches a black helicopter. It isn't actually meant to do this, but the guy who wrote the code left a while back and nobody knows how to fix it, or even where the helicopters are being sent. However there are unconfirmed reports of an interesting pile of scrap metal growing at the bottom of Jerry Yang's garden.
- alanh 14y agoYou’ve been around about as long as me — why are you participating in /r/HN? (That is… why are we talking about this like we’re on Reddit?)
- jmathai 14y agoThe most surprising part of this is that there's an established security audit process for any product before it gets launched to the public. Somehow this made it though. From my experience having worked at Yahoo! I'm a bit shocked as the process has always seemed pretty good.
- superxor 14y agoAny word on which Yahoo! services use this key?
- mcpherrinm 14y agoAlmost certainly nothing other than this addon. It would be silly to do otherwise. But then, it'd be silly to leak your private key.
- thousande 14y agoProbably not. The key is generated by some tool in the Chrome browser http://code.google.com/chrome/extensions/packaging.html#H2-0 http://code.google.com/chrome/extensions/packaging.html#H2-0
- hooande 14y agoI think this might go down as the moment where Yahoo? lost their last shred of credibility as a technology company. And it's not this one mistake that signals the end...it's the fact that I'm not that surprised by it. If it were Google or even Facebook I would be shocked. But Yahoo? Yeah, sounds about right. For a long time I've said that Yahoo? needs to forget the fact that they started as a search company. They're still a serious player in online display advertising and they own a lot of properties that are disproportionately valuable in terms of CPM. They should stop trying to come up with new doohickies and focus on what they do best - selling targeted advertising to major advertisers. It's a shame that they didn't hit the goldmine like google or fb did, but there's no point in letting the past get in the way of the opportunities of the moment. Yahoo could still be one hell of an ad network.
- spoiledtechie 14y agoI have to agree with you. They have lost all cred as a tech company and have been circling the toilet for a while. Sadly, I think this has a lot to do with management and very little to do with engineers. I personally feel they are just sitting comfortable trying to squeeze every dollar out of the company.
- deleted 14y ago[deleted]
- DavidSJ 14y agoDon't trust credentials from Yahoo, whether cryptographic or educational.
- kevinpet 14y agoThis is not a security flaw in Axis, this is a leaked trusted key that could be used to sign any extension (or possibly any other type of signed code). Any code purporting to come from Yahoo is unsafe, probably until Chrome is updated.
- ajross 14y agoSurely Chrome implements a cert revocation mechanism; the idea of using a cert to establish identity really doesn't work without it (for precisely this reason). Anyone have details?
- adgar 14y agoIt does. See drgath's comment: http://news.ycombinator.com/item?id=4019500 http://news.ycombinator.com/item?id=4019500
- kevinpet 14y agoI wasn't sure it if it was reliable. I remember during the last "ca leaks root cert" fiasco there was talk about how browsers don't implement this securely.
- ajross 14y agoRight, but that's different. That was a root certificate that was compromised: something you can use to make new certs. The basic certs themselves can be revoked, and are fairly routinely. There is always a root of trust in a cert scheme (vs. a web scheme, say, which has no single point of failure but a squishier notion of validity). The reason it got caught is that Chrome implemented an independent "pinning" feature for Google's own domains (basically an independent root of trust) and caught the fraudulent certs.
- Isofarro 14y agoHopefully Yahoo have patented this.
- pagehub 14y agoIf this had come out a year or two ago I may have considered trying it. Still too disgusted at the way the company has been run recently to even consider using their products.
- spleeyah 14y agoChrome now says "This extension is blacklisted." when you try to install it.
- rplnt 14y agoThey probably revoked the cert.
- sneak 14y agoWhere is the signature from this key used? I don't see any signatures or certificates in the crx archive (just the key), and I'm curious as to the trust path here - or is this an internal-to-Google's-extension-site key?
- SoftwareMaven 14y agoThe signature it generates is used by Chrome to determine whether an upgraded extension really came from the same source. With this leaked, anybody could conceivably put up an upgraded, evil version of Axis and Chrome would happily upgrade it behind the scenes. I say conceivably because you still need to either MitM the Chrome store or get Yahoo!'s credentials to the store.
- Flenser 14y agoI installed the Chrome extension (direct link to original Chrome extension, probably not a good idea to install it) with the idea of checking out the source code. You don't need to install chrome extensions to look at their source, you can use this extension to view it before installing: https://chrome.google.com/webstore/detail/bbamfloeabgknfklmgbpjcgofcokhpia https://chrome.google.com/webstore/detail/bbamfloeabgknfklmg... (ok, you have to install that extension before you can look at it's source :)
- Getahobby 14y agoI don't know why he uses the term "private certificate file." It is a private key.