I Know How to Take Over Your Kindle with an E-Book
Check Point researcher Slava Makkaveev compromises Amazon Kindles by embedding malicious payloads inside e-book files, taking over devices upon opening the book.
Summary
Amazon Kindles as an Overlooked Mobile Attack Surface
With tens of millions of Kindles deployed globally, e-readers contain Wi-Fi radios, internal storage, and linked Amazon billing accounts.
Auditing E-Book Parsing Engines and Formats
Slava Makkaveev investigates the proprietary Kindle document parser, auditing how the reader processes MOBI, EPUB, and Kindle Format 8 files.
Exploiting Memory Corruption in Book Rendering Libraries
Embedding a malicious font and script payload inside a standard e-book triggers a heap overflow during text rendering, executing arbitrary root code on the device.
Pivoting Across Local Networks and Account Takeover
The author demonstrates that simply delivering a malicious e-book to a user's Kindle allows attackers to steal account tokens and pivot across local home Wi-Fi networks.
Related talks
Black Hat Europe 2025·30 min
Valentino Ricotta
Security researchers examine technical aspects of Taking Over Your Amazon Account With A Kindle.
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·48 min
David Leadbeater
David Leadbeater revisits 60 years of terminal escape sequence vulnerabilities, detailing multiple remote code execution flaws across major terminal emulators.