Security researchers have uncovered a trio of security flaws in Amazon’s Fire Phone that left users open to dangerous “man-in-the-middle” cyber attacks.
The vulnerabilities were spotted and disclosed by Bernard Wagner, MRW Labs researcher, in two threat advisories.
The two most serious Fire Phone vulnerabilities affect a piece of software called a “Certinstaller”. The Certinstaller is used to install digital certificates, which act as a signature for applications and programmes assuring devices software is safe to install.
The installer flaws are dangerous as they can reportedly be exploited to install bogus code that lets hackers mount a special man-in-the-middle cyber attack.
“The CertInstaller package on the Amazon Fire Phone allows applications to install certificates without interaction with the user,” explained Wagner in the advisory.
“Although the application’s name is identical to the base Android package, the source code has been modified specifically for the Amazon Fire Phone. Successful exploitation of the vulnerability would allow an attacker to man-in-the-middle encrypted traffic.”
Man in the middle attacks are a commonly used tactic by both criminals and intelligence agencies.
The tactic sees the attacker hijack control of data from a device mid-transit and redirect it to a site or server owned by the hackers.
Once hijacked the attacker can then mount a variety of actions, including forcing the victim to visit a malicious site and download malware or siphon data from the user for intelligence gathering purposes.
It is currently unclear if the vulnerabilities were actively exploited by hackers before Amazon patched them May 1, when it released the FireOS 4.6.1 update, a full five months after Wagner claims to have privately reported the flaws to it.
Amazon had not replied to Business Insider’s request for comment if the flaws have been targeted by hackers at the time of publishing.
In the past, numerous government and criminal groups have used the certificate flaws to spy on smart device and web service users.
The vulnerability reportedly lets hackers install and uninstall applications, bypass the lock screens and steal information from devices with the developer USB debugging option enabled. The flaw was also fixed during the Fire OS 4.6.1 update.