CPR finds security flaws in Amazon Kindle

Check Point Research (CPR) found security flaws in Amazon Kindle. If exploited, the flaws would have enabled a threat actor to take full control over a user’s Kindle, resulting in the possible theft of Amazon device token, or other sensitive information stored on the device. The exploitation is triggered by deploying a single malicious e-book on a Kindle device.

CPR is scheduled to demonstrate the exploitation at this year’s DEF CON conference in Las Vegas.

The exploitation involves sending a malicious e-book to a victim. Once the e-book is delivered, the victim simply needs to open it to start the exploit chain. No other indication or interactions are required on behalf of the victim to execute the exploitation. CPR proved that an e-book could have been used as malware against Kindle, leading to a range of consequences. For example, an attacker could delete a user’s e-books, or convert the Kindle into a malicious bot, enabling them to attack other devices in the user’s local network.

The security flaws naturally allow a threat actor to target a very specific audience, which significantly concerned CPR. For example, if a threat actor wanted to target a specific group of people or demographic, the threat actor could easily select a popular e-book in the correlating language or dialect to orchestrate a highly targeted cyber-attack.

CPR disclosed its findings to Amazon in February 2021. Amazon deployed a fix in the 5.13.5 version of Kindle’s firmware update in April 2021. The patched firmware installs automatically on devices connected to the Internet.

Comments

Comments