Security Hole In Amazon's Kindle Touch

snoopy · Jul 16, 2012

Security hole in Amazon's Kindle Touch

In a video, The H's associates at heise Security demonstrate a proof-of-concept exploit for the Kindle Touch that causes the kindle to reboot Zoom The web browser built into Amazon's Kindle Touch eBook reader contains a serious security hole: when a user navigates to a specially crafted web page, the Kindle will execute arbitrary shell commands as root. This allows attackers to access the eBook reader's underlying Linux system at the highest privilege level and potentially steal the access credentials for the Amazon account linked to the Kindle, or purchase books with the Kindle user's account.

Although the Kindle browser has been considered to be in "beta" for more than a year, this status doesn't reduce the risk for inquisitive users as the software is installed on each device by default. The H's associates at heise Security have developedGerman language link a proof-of-concept web page that allows arbitrary shell commands to be injected into a Kindle Touch with the current version 5.1.0 firmware. As an example, the Kindle sent the content of the /etc/shadow file to a heise Security web server – this file contains the root user's password hash – our associates then used a password cracker to determine the previously secret plain text password without much trouble.
Click to expand...

http://www.h-online.com/security ews/item/Security-hole-in-Amazon-s-Kindle-Touch-1642718.html

Log in or Sign up

Security Hole In Amazon's Kindle Touch

snoopy Registered Members

Share This Page

Log in or Sign up

Security Hole In Amazon's Kindle Touch

snoopy Registered Members

Share This Page

Useful Searches