full-disclosure - [FD] Amazon’s Silk Browser on the Kindle Didn’t Use SSL for Google Search

Open Source and information security mailing list archives

Message-ID: <CAAyEnSPyyahXrqokUw2CJuwVA5RJbMBQuOCzbEHOgRae=NizTw@mail.gmail.com>
Date: Thu, 21 Jul 2016 14:14:35 +0000
From: Nightwatch Cybersecurity <research@...htwatchcybersecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] Amazon’s Silk Browser on the Kindle Didn’t Use SSL for Google Search

[Original here:
https://wwws.nightwatchcybersecurity.com/2016/07/21/advisory-amazons-silk-browser-on-the-kindle-didnt-use-ssl-for-google-search/]

Overview

Amazon supplies the Silk Browser for their line of Kindle tablets. The
browser includes a selection of three search engines, of which Google
was setup without SSL. Furthermore, the browser prevented automatic
redirection to the SSL version of Google’s main site when visiting it
directly.

Details

Amazon’s provides the Silk browser, which is based on Google’s Chrome,
for their line of Kindle Fire tablets. The Silk browser includes
ability to select from three search engines (as shown in the
screenshot below) – Google, Bing and Yahoo. Of these, when Google is
selected, all searches  via the browser’s omnibox are done without
HTTPS resulting in ability of malicious third parties to monitor
user’s search engine traffic. Furthermore, going to
“http://www.google.com” which normally would redirect to the SSL
version, stayed in HTTP mode and prevented redirection. All other
Google international domains (like google.ru, google.fr, etc)
automatically redirected to the SSL versions.

The version we tested was v49.3.1, the vendor fixed the issue in
v51.2.1. It is recommended that all users upgraded to the newest
version of the Silk browser.

Vendor Response

Other than a generic response we received initially, there has been no
further communication from the vendor.

Timeline

2015-05-01: Both Amazon and Google notified via email
2015-05-02: Generic response from Amazon
2015-07-20: Verification of fix
2015-07-21: Public disclosure

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives