A security researcher recently demonstrated a startling vulnerability in Amazon Kindle e-readers: simply loading a specially crafted malicious ebook or audiobook onto the device could allow an attacker to hijack the owner’s entire Amazon account, gaining access without needing a password.
The flaws were revealed earlier this month at the Black Hat Europe conference in London, but the good news is that Amazon was informed in advance, has already patched the issues, and automatically updated affected devices.
Inside the $20,000 Discovery
The vulnerabilities were discovered by Valentino Ricotta, an engineering analyst at defense and security company Thales. The issues reportedly involved Kindle’s onscreen keyboard and audiobook processing features.
Ricotta revealed how malicious code embedded in a manipulated audiobook file could trigger a memory error, allowing access to Amazon session cookies. He then chained that exploit with a second vulnerability impacting the onscreen keyboard, which ran with elevated privileges, to gain broader control over the device.
Ricotta conducted the demonstration live onstage at the Black Hat Europe conference, successfully confirming account access in real time during the presentation.
Amazon, in a statement to Forbes, said that the vulnerabilities were disclosed responsibly and fixed before the public demonstration. The company also declared that affected Kindle devices have already received automatic software updates.
Ricotta received a $20,000 bug bounty from Amazon for reporting the flaws.
Phishing and Impersonation Risk
Separately, cybersecurity experts have reportedly warned that news of the Kindle vulnerabilities has coincided with a rise in phishing and impersonation scams targeting Amazon users. These scams often involve calls or messages claiming an account has been hacked, with attackers attempting to pressure victims into giving up access or installing remote-access software.
This spike in fraudulent activity follows a global warning Amazon issued to hundreds of millions of customers last month, urging them to be on high alert for scams ahead of the peak shopping season.
Amazon has advised users to remain cautious of unsolicited account warnings and to rely only on official Amazon communications.
Source: Forbes