Kindle Touch: messy firmware, unsecure device

[JoeD]

Originally Posted by HarryT

Some of the claims made, though, were wrong. Even before the MP3 ID3-tag scripting exploit was fixed, you couldn't "infect" a Kindle by visiting a site which played an MP3 as background music, as claimed, for the simple reason that the Kindle's browser doesn't play music, and will make no attempt to load such a file.

Yep yifanlu covered that.

I just wanted to point out to the OP that chances are every device will have some kind of flaw either known or waiting to be found. So long as they're fixed in a reasonable time limit and a device doesn't have a disproportionate number, it shouldn't really impact a purchase decision.

[HarryT]

Originally Posted by JoeD

I just wanted to point out to the OP that chances are every device will have some kind of flaw either known or waiting to be found. So long as they're fixed in a reasonable time limit and a device doesn't have a disproportionate number, it shouldn't really impact a purchase decision.

Yes, I agree.

[rfog]

Well, finally I was right:

https://www.mobileread.com/forums/sho...41&postcount=2

[geekmaster]

Originally Posted by rfog

Well, finally I was right:

https://www.mobileread.com/forums/sho...41&postcount=2

The bug used in the MP3 hack could not be triggered by a web page. The bug discovered in 5.1.0 CAN be triggered by a web page. That is a big step down in security, and amazon was notified immediately (with a plea to fix that bug but NOT to try to lock down the kindle firmware so we cannot run custom code that WE want on OUR kindles).

[eureka]

Originally Posted by rfog

@yifanlu, I'm the developer has said KT is unsecure, based in reading your messages.

If you read in depth my messages in Spanish, I'm talking about potential problems, not true and real ones.

Hypotetically talking, one malicious website can take control of your Kindle using some Webkit vulnerability allowing write into user partition the tar update file that will install whatever thing website wants.

Originally Posted by rfog

Well, finally I was right:

https://www.mobileread.com/forums/sho...41&postcount=2

Don't fool yourself. Firstly, mentioned security flaw doesn't use any Webkit vulnerability. As yifanlu said, Webkit is a pretty secure web browser engine and it really is. Then, if you'll dig down to original thread about this exploit, you'll find a simple command that fix it without any negative consequences.

Anyway, I'm welcoming public discussion of this subject. It is really serious breach and Amazon doesn't do anything to fix it (for all users) for about of two weeks.