Modify the settings on the Kindle device to static, set DNS to point to “192.168.1.x”. Add a file with malicious content (you may need to use sudo): cd /var/www/htmlĦ. Configure /etc/nf file to listen on the IP and restart DNSMASQ listen-address=192.168.1.xĥ. Modify the /etc/hosts file to add the following entry to map the domain name to the Linux host: 192.168.1.x 192.168.1.x Ĥ. Install dnsmasq and NGINX on the Linux host: sudo apt-get install dnsmasq nginxģ. Install the application on the Android device but do not start it.Ģ. It is also possible for the attacker to observe this traffic and capture the serial number (DSN) of the device.ġ. While monitoring network traffic on a test device, we observed that several calls from the settings section (terms of use and privacy policy) are done without HTTPS and can be injected with malicious content by an MITM attacker. Vulnerability DetailsįireOS is an operating system provided by Amazon for the Fire tablet devices. CVE-2019-7399 has been assigned by MITRE to track this issue. Devices will automatically update to the latest version. The issue was discovered in FireOS v5.3.6.3 and fixed by the vendor in v5.3.6.4 that was released in November 2018. The root cause is lack of HTTPS for legal content (terms of use and privacy policy) within the settings section.
An attacker can also capture the serial number of the device. The FireOS operating system provided by Amazon for Fire tablet devices can be injected with malicious content by an MITM attacker.
0 kommentar(er)
