Quote:
Originally Posted by DNSB
Sadly, the item you reference from the Symantec site does not make it very clear that the hazards from downloading pirated ebooks lies more in the files that are supplied as .pdf, .zip, .rar or .exe and not the ebooks in epub, azw3, mobi or whatever format themselves.
In theory, you could embed malicious javascript in an epub3 ebook. After seeing one item titled "Security Diligence Required to Prevent ePub or Mobi Javascript Hacks", I did some playing with the idea. I could not find an ebook renderer that would execute those malicious code snippets on my ereaders. Blasted programmers who limit the functionality of their code.  As for the mobi format ebooks? Given the age of that format, embedding javascript is not a viable option. |
I think the issue is that EPUB's in particular can be opened and read in a browser these days (not sure about other formats since I tend to buy/edit books as EPUB then convert them to what I need, which largely depends on where I plan on reading them). I was quite miffed that Edge made itself the default app for opening EPUB's after an update some time ago, it kind of makes sense though, EPUBs are written in HTML they even use CSS.
I doubt anyone is targeting ebook readers themselves (the hardware I mean) as there isn't much to be gained from doing so (possibly your Amazon login from Kindles) but people who read on their computers or tablets using a browser, or even using a ereader program that supports scripts could be vulnerable. Browsers themselves have a lot of personal info about people from the autofill alone and if they can get at the saved passwords well that would be the kind of thing they might want to target, without considering anything outside of the browser. Browsers can often access your filesystem too. I will add that Chrome and Firefox don't seem to be willing to open them so perhaps it's just Edge that is vulnerable. Perhaps when it switches to Chromium it will no longer work.
Just to be clear I don't think anyone is suggesting ransomware is being embedded in an ebook but some malicious scripts could be and if opened using a program that supports scripts (Adobe Acrobat for PDF, Edge for EPUB, as two examples) then you could be vulnerable to attack.
Like I said I am not concerned about my ebooks containing anything untoward, I was just responding to someone who seemed to think I was... but your post was interesting so I thought I would respond
