This Kindle safety threat revealed how an e-book may steal your information

When you concentrate on units that may very well be hacked or contaminated with malware, your Kindle in all probability is not the very first thing that involves thoughts. You are extra more likely to fear about your laptop computer, smartphone, or pill. Nevertheless, as one researcher found, Kindles can be susceptible to malware — probably placing your Amazon account and private info in danger when you’re not cautious in regards to the e-books you sideload onto them.

That researcher is Valentino Ricotta, an engineering analyst at Thales, a protection and safety group (by way of The Times). Ricotta was in a position to create a “malicious” e-book that, when loaded onto a Kindle, exploited software program vulnerabilities and gave him full entry to the Amazon account linked to the system.

Ricotta relied on two separate flaws to tug this off. One was a vulnerability within the Kindle software program liable for scanning and extracting information from audiobooks, whereas the opposite affected the on-screen keyboard. By exploiting these vulnerabilities, he tricked the Kindle into executing hidden malicious code throughout the e-book. This allowed him to steal the Kindle’s Amazon session cookies, which may then be used to achieve entry to a consumer’s Amazon account.

It is vital to notice that these safety vulnerabilities contain e-books which are sideloaded onto a Kindle, not these bought instantly from the Amazon Kindle Retailer. Many individuals obtain e-books from third-party web sites and switch them to their Kindles by way of USB, and, as Ricotta identified, books from these sources may very well be contaminated with malware that may achieve entry to your Amazon account and steal private info. So the ethical of the story is, be very cautious and conscious of the locations you obtain e-books from.

“As soon as an attacker will get a foothold inside a Kindle, it may entry private information, your bank card info, pivot to your native community and even to different units which are registered together with your Amazon account,” Ricotta defined to The Occasions.

Amazon has already patched these Kindle safety vulnerabilities

Lately, Amazon has additionally patched a well-liked Kindle jailbreak methodology

After discovering safety flaws within the Kindle’s software program, Ricotta reported them to Amazon, which categorised them as “vital” and subsequently patched them. In line with The Times, Amazon awarded him $20,000 by way of its bug bounty program, which rewards “moral hackers” who assist convey consciousness to safety vulnerabilities. Reportedly, Ricotta and Thales donated the cash to charity.

“We recognized and stuck vulnerabilities affecting Kindle E-readers and the Audible performance on these units,” an Amazon spokesperson informed Good E-Reader. “All affected units have acquired automated updates addressing these points. We recognize the safety researchers who assist us keep excessive safety requirements for our prospects.”

So when you had been nervous about these safety flaws affecting your Kindle, fear not, as Amazon has mounted them. Nevertheless, that does not imply there aren’t different Kindle vulnerabilities on the market that might have an effect on your Kindle, so once more, simply be conscious of the place and the way you get any third-party e-books to your system. When you solely buy and obtain e-books from the official Kindle Retailer, you don’t have anything to fret about.

This is not the primary time Amazon has patched vulnerabilities on its Kindle units, and it will not be the final. Earlier this 12 months, the corporate patched two jailbreak methods that had been gaining recognition amongst customers — WinterBreak and AdBreak — each of which allowed Kindle homeowners to free their e-readers from Amazon’s walled-garden ecosystem and obtain customized apps like KOReader and Kindle Forge.

In different Kindle-related information, Amazon recently announced that DRM-free e-books from Kindle Direct Publishing (KDP) authors shall be downloadable in EPUB and PDF codecs subsequent 12 months, and the corporate additionally not too long ago launched its new Kindle Scribe Colorsoft.