Full Disclosure mailing list archives
Amazon’s Silk Browser on the Kindle Didn’t Use SSL for Google Search
From: Nightwatch Cybersecurity <research () nightwatchcybersecurity com>
Date: Thu, 21 Jul 2016 14:14:35 +0000
[Original here: https://wwws.nightwatchcybersecurity.com/2016/07/21/advisory-amazons-silk-browser-on-the-kindle-didnt-use-ssl-for-google-search/] Overview Amazon supplies the Silk Browser for their line of Kindle tablets. The browser includes a selection of three search engines, of which Google was setup without SSL. Furthermore, the browser prevented automatic redirection to the SSL version of Google’s main site when visiting it directly. Details Amazon’s provides the Silk browser, which is based on Google’s Chrome, for their line of Kindle Fire tablets. The Silk browser includes ability to select from three search engines (as shown in the screenshot below) – Google, Bing and Yahoo. Of these, when Google is selected, all searches via the browser’s omnibox are done without HTTPS resulting in ability of malicious third parties to monitor user’s search engine traffic. Furthermore, going to “http://www.google.com” which normally would redirect to the SSL version, stayed in HTTP mode and prevented redirection. All other Google international domains (like google.ru, google.fr, etc) automatically redirected to the SSL versions. The version we tested was v49.3.1, the vendor fixed the issue in v51.2.1. It is recommended that all users upgraded to the newest version of the Silk browser. Vendor Response Other than a generic response we received initially, there has been no further communication from the vendor. Timeline 2015-05-01: Both Amazon and Google notified via email 2015-05-02: Generic response from Amazon 2015-07-20: Verification of fix 2015-07-21: Public disclosure _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Amazon’s Silk Browser on the Kindle Didn’t Use SSL for Google Search Nightwatch Cybersecurity (Jul 25)