Don't judge an audiobook by its cover: taking over your Amazon account with a Kindle
summary
Finds a heap overflow in libaudiblexdk.so parsing AAX files via an integer overflow in the STSC atom, discovered by static reverse engineering (IDA) after AFL++/QEMU fuzzing fails; crafts malicious AAX with a huge cover image (pymp) to mmap sprayed fake vtables, uses an ARM thumb LDM gadget to pivot to ROP, calls mprotect and executes shellcode as framework to steal Amazon session cookies. Then exploits a DLopen path traversal in the keyboard LIPC service to become root. Exploit lands with about a 1 in 1000 success rate but runs silently and ultimately works; bugs reported Jan, fixes in March/September, $20,000 bounty.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:30Kindle attack surface
- 9:31Ebook processing phases
- 11:17Heap overflow in extractor
- 18:01Heap overflow to code execution
- 24:21Privilege escalation via keyboard
- 33:26Exploit chain demo
- 35:16Impact and fixes
related talks
27mNew Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari
43mA 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
43mDebug for Bug: Crack and Hack Apple Core by Itself
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
37mAbusing Adobe Reader’s JavaScript APIs
43mPWNIE Awards at Black Hat USA 2014
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...