Register Guidelines E-Books Search Today's Posts Mark Forums Read

Go Back   MobileRead Forums > E-Book General > News

Notices

Reply
 
Thread Tools Search this Thread
Old 12-30-2016, 05:05 AM   #1
chrisridd
Guru
chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.
 
chrisridd's Avatar
 
Posts: 685
Karma: 1491418
Join Date: Nov 2011
Location: London, UK
Device: Kobo Aura, Kobo Aura ONE, Marvin 3
Malicious ebooks?

I just saw this tweet:

Quote:
Um... I just popped a shell on my Android tablet with a malicious EPUB ebook.
I wonder if many ereaders are written with security in mind?
chrisridd is offline   Reply With Quote
Advert
Old 12-30-2016, 06:37 AM   #2
simond
Fanatic
simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.simond ought to be getting tired of karma fortunes by now.
 
Posts: 517
Karma: 1062753
Join Date: Aug 2005
Location: London, UK
Device: Kobo Aura HD,Kobo Mini,iPad Mini,iPhone, Icarus HD, Nexus 7
I doubt most are that secure.
simond is offline   Reply With Quote
Old 12-30-2016, 09:15 AM   #3
frahse
occasional author
frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.frahse ought to be getting tired of karma fortunes by now.
 
frahse's Avatar
 
Posts: 2,043
Karma: 2056050000
Join Date: Sep 2011
Location: Wandering God's glorious hills, valleys and plains.
Device: Orig Droid, Kindle KB-3G, Archos 43, Samsung S3, Chromebook
Can you imagine this, where a malevolent eBook has taken the place of the TV.

frahse is offline   Reply With Quote
Old 12-30-2016, 09:59 AM   #4
JSWolf
Resident Curmudgeon
JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.
 
JSWolf's Avatar
 
Posts: 48,178
Karma: 36908365
Join Date: Nov 2006
Location: Roslindale, Massachusetts
Device: Kobo Aura H2O, Sony PRS-650, Sony PRS-T1, nook STR, iPad 4, iPhone 5
I've always thought that javascript inside and eBook was a rather bad idea. It's a book, not a computer program.
JSWolf is offline   Reply With Quote
Old 12-30-2016, 10:08 AM   #5
chrisridd
Guru
chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.
 
chrisridd's Avatar
 
Posts: 685
Karma: 1491418
Join Date: Nov 2011
Location: London, UK
Device: Kobo Aura, Kobo Aura ONE, Marvin 3
Quote:
Originally Posted by JSWolf View Post
I've always thought that javascript inside and eBook was a rather bad idea. It's a book, not a computer program.
Yes, Javascript is clearly a significant attack vector. I guess the JS engine can be restricted to only have read access to the filesystem (or no access) and similarly no access to the network, and then you need to prevent resource exhaustion type attacks.

But even plain old XML can also be abused in interesting ways. XML External Entities (e.g. "billion laughs") and XIncludes....
chrisridd is offline   Reply With Quote
Advert
Old 12-30-2016, 11:27 AM   #6
Cinisajoy
Just a Yellow Smiley.
Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.
 
Cinisajoy's Avatar
 
Posts: 14,938
Karma: 73979885
Join Date: Jul 2015
Location: Texas
Device: K4, K5, fire, kobo, galaxy
Did the person happen to tweet where they acquired this epub?
Cinisajoy is online now   Reply With Quote
Old 12-30-2016, 12:52 PM   #7
chrisridd
Guru
chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.
 
chrisridd's Avatar
 
Posts: 685
Karma: 1491418
Join Date: Nov 2011
Location: London, UK
Device: Kobo Aura, Kobo Aura ONE, Marvin 3
Quote:
Originally Posted by Cinisajoy View Post
Did the person happen to tweet where they acquired this epub?
He said he used an existing exploit (like any script kiddie would do) and made it into his own epub.
chrisridd is offline   Reply With Quote
Old 12-30-2016, 01:08 PM   #8
Cinisajoy
Just a Yellow Smiley.
Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.Cinisajoy ought to be getting tired of karma fortunes by now.
 
Cinisajoy's Avatar
 
Posts: 14,938
Karma: 73979885
Join Date: Jul 2015
Location: Texas
Device: K4, K5, fire, kobo, galaxy
Quote:
Originally Posted by chrisridd View Post
He said he used an existing exploit (like any script kiddie would do) and made it into his own epub.
Oh ok. Though now it leads me to ask, what file type did he exploit? And where did he get the file?

I am totally confused.
He tweeted he got a malicious epub, but yet he made the epub?
It cannot be both.
So he made a malicious epub.

Or I am totally misunderstanding the first tweet. I read it as I downloaded a malicious epub from a website.
Cinisajoy is online now   Reply With Quote
Old 12-30-2016, 01:14 PM   #9
chrisridd
Guru
chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.chrisridd ought to be getting tired of karma fortunes by now.
 
chrisridd's Avatar
 
Posts: 685
Karma: 1491418
Join Date: Nov 2011
Location: London, UK
Device: Kobo Aura, Kobo Aura ONE, Marvin 3
No, his first tweet only said he had "a" malicious epub without saying about where he got it from - you have to read the rest of the twitter thread to see he made it using an existing exploit.

I'd be interested in knowing what he did too!
chrisridd is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Kindle and malicious hot spots Julius Caesar Kindle Developer's Corner 20 07-18-2016 02:52 PM
MALICIOUS jpraven Self-Promotions by Authors and Publishers 0 11-19-2013 10:13 AM
Google's official app market found hosting malicious Android apps—again monkeyluis Android Devices 19 04-20-2012 08:33 PM


All times are GMT -4. The time now is 07:33 PM.


MobileRead.com is a privately owned, operated and funded community.