Imagine that you are the leader of a country that is in conflict with another and you want to undermine the morale of the millions of citizens of your enemy. Or you are part of a rebel / paramilitary group that wants to weaken the structures of a government. How would you do it? Many resort to weapons, physical intimidation tactics, destruction … But others are more subtle, and resort to cyber warfare.

Digital war

How do you manage to attack thousands of innocent people at the same time? No, not with older Phishing emails since a 56K connection, nor with the typical WhatsApp scam. There are more effective methods as the Cybersecurity agency Check Point has discovered. Because if instead of trying and trying you use something that people want, they will download your malware instead of having to force them with hoaxes or cyberattacks.

For example, how many people in country A or nation B have an e-book reader? 27% of the population, maybe 56%? If you manage to create a fake eBook that plagiarizes one of the most anticipated books of the year or a classic that always triumphs, fill it with a digital viral load that exploits a security vulnerability in the device, and upload it to nothing less than the largest distribution platform of ebooks from the world for FREE, so there you have a ‘target’ of thousands of potential victims.

And that is precisely what has happened to Amazon, author of the Kindle.

The malicious eBook

Since 2007 when Amazon made history with the first electronic book reader or e-Reader, the Kindle has been the eBook reader par excellence. The cybersecurity firm Check Point Research (CPR) has found security flaws on Amazon Kindle. Bugs that if exploited would allow a hacker to take full control of a user’s Kindle, potentially theft of the Amazon device token, or other sensitive information stored on the device.

The attack consists of send a malicious e-book to the victim, an e-book full of viruses. Once the e-book is delivered, the victim only has to open it to start the chain of exploitation. No other indication or interaction is required from the victim to execute the exploit.

CPR proved that an e-book could be used as malware against Kindle, leading to a number of consequences. For example, an attacker could delete a user’s e-books, or turn the Kindle into a malicious bot, allowing it to attack other devices on the user’s local network.

Access your Amazon account using your Kindle

Security flaws naturally allow a threat actor to target a very specific audience, which is of considerable concern to the RCP. For example, if a hacker wanted to target a specific group of people or demographic, they could easily select a popular e-book in the appropriate language or dialect to orchestrate a targeted cyber attack.

According to the chronology of the events:

• February 2021: Check Point Research Reveals Its Findings to Amazon
• April 2021: Amazon deploys a fix in version 5.13.5 of the Kindle firmware update. The patched firmware is automatically installed on devices connected to the Internet.

Yes, the problem is that 2 months have passed from the identification to the resolution of the vulnerability, but the good thing is that it has been resolved for months. According to Yaniv Balmas, Head of cyber-investigation at Check Point Software, an expert who would have known how to exploit the ‘exploit’ “might to have stolen any information stored in the device, from the credentials of the Amazon account to the billing information ”.

Who is going to suspect a Kindle?

The Kindle, like other IoT devices, “they are generally considered safe and are not considered as a safety risk. But our research shows that any electronic device is, after all, a form of computer. And as such, these IoT devices are vulnerable to the same attacks as computers. “

Yani Balmas uses this example: “If a cyber attacker wanted to target Romanian citizens, all you would have to do is publish some free and popular e-book in Romanian language. From there, the threat actor could be fairly certain that all his victims would indeed be Romanians: that degree of specificity in offensive attack capabilities is highly sought after in the world of cybercrime and cyber espionage. In the wrong hands, those offensive capabilities could cause serious damage, which was of great concern to us. “