Hacker hijacks Amazon accounts via Kindle ebook

Valentino Ricotta, an ethical hacker at Thales’s Thalium unit, demonstrated at Black Hat Europe that a crafted malicious ebook could exploit vulnerabilities in Kindle audiobook-processing software and the on‑screen keyboard to execute code and steal Amazon session cookies, potentially exposing credit‑card details, other devices on a user’s Amazon account and local networks. He alerted Amazon, which classified the flaws as critical, issued automatic patches to affected devices and paid a $20,000 bug bounty (donated to charity); security experts said the attack highlights how overlooked IoT endpoints can serve as entry points. The incident reinforces persistent consumer-device security risks but also shows Amazon’s ability to remediate quickly, limiting immediate financial impact while keeping reputational and systemic security risks relevant for investors.

Analysis

Valentino Ricotta, an engineering analyst at Thales’ Thalium research unit, demonstrated at Black Hat Europe that a crafted malicious ebook could exploit flaws in Kindle audiobook-processing software and the onscreen keyboard to execute code and exfiltrate Amazon session cookies, potentially granting an attacker access to linked account data including one-click credit‑card purchases and other devices on the account. Ricotta said the attack can succeed via side‑loaded books copied over USB from third‑party sites; he reported the critical flaws to Amazon, which issued automatic updates, classified the issues as critical and paid a $20,000 (≈£15,000) bug bounty that was donated to charity. Security academics cited by the article (Alan Woodward, George Loukas) framed the event as a sophisticated example of how overlooked IoT endpoints can become hidden attack routes, noting prior Kindle ebook exploits in 2021 and the broader risk posed by devices that run software and remain connected to back‑end services. Market signals in the brief characterization show a mildly negative sentiment but limited immediate market impact because Amazon patched devices automatically, leaving reputational and systemic cybersecurity risk as the primary ongoing investor concern.

Key Decisions for Investors

• For holders of Amazon stock: maintain exposure but monitor disclosure timelines, patch adoption rates and any customer-impact metrics that could affect churn or regulatory scrutiny, since Amazon’s rapid automatic remediation limits immediate financial risk
• For investors in consumer electronics and IoT OEMs: reassess portfolio exposure to companies with large installed bases of lightly patched devices and prioritise suppliers that publish robust firmware update practices and active bug‑bounty programs
• Consider modest overweight to cybersecurity services and firmware‑security vendors that address device hardening and monitoring, and use hedges for consumer tech positions until telemetry confirms broad deployment of fixes and no follow‑on exploits emerge