Kindle and malicious hot spots

Julius Caesar · 07-15-2016, 02:51 AM

What could a hacker do if I inadvertently use a wifi hotspot that has been compromised by hackers? How do I protect my Kindle from being remotely accessed by hackers? There is no anti virus or firewall for the Kindle, especially Kindle ereader.

EDIT: I have Kindle Oasis latest firmware

knc1 · 07-15-2016, 04:33 AM

Quote:

Originally Posted by Julius Caesar

What could a hacker do if I inadvertently use a wifi hotspot that has been compromised by hackers?

How do I protect my Kindle from being remotely accessed by hackers?

There is no anti virus or firewall for the Kindle, especially Kindle ereader.

Too vague -
give sufficient context, such as model/firmware and compromised in what fashion.

What makes you think that is possible?

Now what makes you think there is no firewall?
Just because nobody charges you extra for it or because you don't have any (factory) options to change it?

= = = =

tl;dr:
Nothing
Not possible
Dead wrong

geekmaster · 07-15-2016, 07:57 AM

Our forum talks about the built-in firewall plenty often, including how to tweak it to allow SSH over wifi for root shell on the kindles. As we explain, you need the real root password when doing that, which indicates that the firewall is more strict for wifi than it is for USBnet, so your fears are unfounded in this case (but not in all cases, as Edward Snowden has demonstrated).

However, I am curious why you want to "borrow" wifi bandwidth from potentially compromised wifi hotspots. You can be tracked and identified anyway, because wifi protocols leak your MAC address.

knc1 · 07-15-2016, 09:20 AM

The recommended (by myself and NiLuJe the author) is to use pub-key authorization -
It is the first choice for the IGG (instant gratification generation) it just works, nearly instantly.

Does not require changes to the files in the Amazon image (which will be replaced by the next OTA update) just leave the disabled password authentication in the Kindle alone.

See directions in the USBnet package and/or the numerous threads written here on the subject of ssh on the Kindle.

geekmaster · 07-15-2016, 09:28 AM

Quote:

Originally Posted by knc1

The recommended (by myself and NiLuJe the author) is to use pub-key authorization -
It is the first choice for the IGG (instant gratification generation) it just works, nearly instantly.

Does not require changes to the files in the Amazon image (which will be replaced by the next OTA update) just leave the disabled password authentication in the Kindle alone.

See directions in the USBnet package and/or the numerous threads written here on the subject of ssh on the Kindle.

I had that working once, but I generally just login using the computed password. I have hundreds of kindles and setting up pub-keys is an extra step. However, it is certainly much more convenient for the few MOST USED kindles.

knc1 · 07-15-2016, 09:30 AM

Who said you have to use a different pub-key pair for every kindle?

geekmaster · 07-15-2016, 09:32 AM

Quote:

Originally Posted by knc1

Who said you have to use a different pub-key pair for every kindle?

Ahh.. <light goes on over head> That would avoid all those SSH key change warnings wouldn't it?

Yourcat · 07-15-2016, 12:18 PM

Each ssh server should have it's own private key. If you use the same IP address for 2-n Kindles the client should warn you that the server key changed. Using host names could avoid this - not sure whether you already gave a cute name to every Kindle.
I have no idea when the key is generated and whether it survives reboots.

Yourcat · 07-15-2016, 12:28 PM

@Julius: A hacker may install a backdoor on your Kindle and use it to compute bitcoins if he gets access. He may have setup a special crafted firmware server and your Kindle may install his custom firmware/ransomware.
Anyhow hackers are likely not interested in Kindles readers with very limited resources.

knc1 · 07-15-2016, 12:47 PM

The firewall blocks unrelated, inbound traffic.

If you have my BBB (Block Big Brother) package installed, it includes a 'report' function that will print the current iptable rules.

eschwartz · 07-15-2016, 02:15 PM

Well, anything you actually do over the internet can be snooped on. Obviously.

But as said above, the Kindle actually does include a very strict firewall. It is such a Windows mentality to think you'd need a manually-installed firewall.

The only thing you are at risk for, is a malicious individual discovering a remote exploit that can be triggered entirely from the browser.

But don't laugh -- Amazon once included the Native Bridge in the browser, which allowed someone to run a shell command via javascript!

The forum members who were active at the time reported it, got a CVE number and everything, and Amazon had it fixed.
(That one was way too dangerous to keep around as a jailbreak exploit.

)

Also, Branch Delay's jailbreak. Which was likewise reported and fixed before being released as a jailbreak.
It was also slightly harder to trigger.

Yourcat · 07-15-2016, 02:30 PM

Actually Kindle creates outgoing connections (to Amazon servers) which one could terminate on a local server and send custom replies. No need to penetrate the firewall. As we have seen one could delete developer keys. Locking the device could also be possible.

geekmaster · 07-15-2016, 03:16 PM

Quote:

Originally Posted by Yourcat

Actually Kindle creates outgoing connections (to Amazon servers) which one could terminate on a local server and send custom replies. No need to penetrate the firewall. As we have seen one could delete developer keys. Locking the device could also be possible.

The only safe thing to do is keep airplane mode on. Even secure traffic is decrypted as it travels through the amazon proxy, and they could do code injection if they wanted to. That is the price you pay for convenience, and many people openly accept those terms.

If a local server is hacked, you are doomed anyway, even on a PC. Internet explorer shows a green "secure" icon even with a bad cert if only one hop away (so your ISP can spy on your HTTPS connections and you still think your browser is secure) -- another reason to use firefox (or better, TOR).

No matter how careful you are, the NSA knows better.

knc1 · 07-15-2016, 03:26 PM

Quote:

Originally Posted by geekmaster

- - - - -
No matter how careful you are, the NSA knows better.

Similar to trying to teach an old hound dog how to suck eggs.

eschwartz · 07-15-2016, 04:13 PM

Quote:

Originally Posted by Yourcat

Actually Kindle creates outgoing connections (to Amazon servers) which one could terminate on a local server and send custom replies. No need to penetrate the firewall. As we have seen one could delete developer keys. Locking the device could also be possible.

I think most of that is encrypted. At least, the sensitive stuff.
And updates are signed with Amazon's keys which we don't have and are baked into the initramfs.

07-15-2016, 02:51 AM	#1
Julius Caesar Addict Posts: 343 Karma: 1510042 Join Date: Oct 2012 Device: Kindle Paperwhite	Kindle and malicious hot spots What could a hacker do if I inadvertently use a wifi hotspot that has been compromised by hackers? How do I protect my Kindle from being remotely accessed by hackers? There is no anti virus or firewall for the Kindle, especially Kindle ereader. EDIT: I have Kindle Oasis latest firmware Last edited by Julius Caesar; 07-15-2016 at 07:26 AM.

07-15-2016, 07:57 AM	#3
geekmaster Carpe diem, c'est la vie. Posts: 6,433 Karma: 10773670 Join Date: Nov 2011 Location: Multiverse 6627A Device: K1 to PW3	Our forum talks about the built-in firewall plenty often, including how to tweak it to allow SSH over wifi for root shell on the kindles. As we explain, you need the real root password when doing that, which indicates that the firewall is more strict for wifi than it is for USBnet, so your fears are unfounded in this case (but not in all cases, as Edward Snowden has demonstrated). However, I am curious why you want to "borrow" wifi bandwidth from potentially compromised wifi hotspots. You can be tracked and identified anyway, because wifi protocols leak your MAC address. Last edited by geekmaster; 07-15-2016 at 08:00 AM.

07-15-2016, 09:20 AM	#4
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	The recommended (by myself and NiLuJe the author) is to use pub-key authorization - It is the first choice for the IGG (instant gratification generation) it just works, nearly instantly. Does not require changes to the files in the Amazon image (which will be replaced by the next OTA update) just leave the disabled password authentication in the Kindle alone. See directions in the USBnet package and/or the numerous threads written here on the subject of ssh on the Kindle. Last edited by knc1; 07-15-2016 at 09:23 AM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Free (Kindle) Hot Doug's [Chicago Local Restaurant History, Memoir, & Hot Dog Trivia]	ATDrake	Deals and Resources (No Self-Promotion or Affiliate Links)	2	07-06-2015 12:07 PM
Kindle Voyage bright spots	pufff	Amazon Kindle	3	11-11-2014 01:04 PM
Fun with Amazon Kindle TV spots	Alexander Turcic	Amazon Kindle	3	08-07-2013 04:18 PM

07-15-2016, 09:30 AM	#6
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Who said you have to use a different pub-key pair for every kindle?

07-15-2016, 12:18 PM	#8
Yourcat Groupie Posts: 175 Karma: 54048 Join Date: Mar 2016 Device: PW3 5.6.5-usbnet	Each ssh server should have it's own private key. If you use the same IP address for 2-n Kindles the client should warn you that the server key changed. Using host names could avoid this - not sure whether you already gave a cute name to every Kindle. I have no idea when the key is generated and whether it survives reboots.

07-15-2016, 12:28 PM	#9
Yourcat Groupie Posts: 175 Karma: 54048 Join Date: Mar 2016 Device: PW3 5.6.5-usbnet	@Julius: A hacker may install a backdoor on your Kindle and use it to compute bitcoins if he gets access. He may have setup a special crafted firmware server and your Kindle may install his custom firmware/ransomware. Anyhow hackers are likely not interested in Kindles readers with very limited resources.

07-15-2016, 12:47 PM	#10
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	The firewall blocks unrelated, inbound traffic. If you have my BBB (Block Big Brother) package installed, it includes a 'report' function that will print the current iptable rules.

07-15-2016, 02:15 PM	#11
eschwartz Ex-Helpdesk Junkie Posts: 19,421 Karma: 85400180 Join Date: Nov 2012 Location: The Beaten Path, USA, Roundworld, This Side of Infinity Device: Kindle Touch fw5.3.7 (Wifi only)	Well, anything you actually do over the internet can be snooped on. Obviously. But as said above, the Kindle actually does include a very strict firewall. It is such a Windows mentality to think you'd need a manually-installed firewall. The only thing you are at risk for, is a malicious individual discovering a remote exploit that can be triggered entirely from the browser. But don't laugh -- Amazon once included the Native Bridge in the browser, which allowed someone to run a shell command via javascript! The forum members who were active at the time reported it, got a CVE number and everything, and Amazon had it fixed. (That one was way too dangerous to keep around as a jailbreak exploit. ) Also, Branch Delay's jailbreak. Which was likewise reported and fixed before being released as a jailbreak. It was also slightly harder to trigger.

07-15-2016, 02:30 PM	#12
Yourcat Groupie Posts: 175 Karma: 54048 Join Date: Mar 2016 Device: PW3 5.6.5-usbnet	Actually Kindle creates outgoing connections (to Amazon servers) which one could terminate on a local server and send custom replies. No need to penetrate the firewall. As we have seen one could delete developer keys. Locking the device could also be possible.