Amazon tries to keep security bugs secret.
Vulnerabilities Not a Severe Danger
Version 4.6.1 for Fire OS was released this May. This OS is used on the Fire Phone. Since its release Amazon has been quiet on informing about any bugs related to the Android-based operating system. The company’s main focus was, of course, the new features, as well as its improved functionality. This, however, does not mean that its developers have not been busy looking for and fixing bugs on the system. At least three security weaknesses have been fixed since the release of the new OS. The risk they posed for users were estimated to be low to medium. All of these risks were discovered by MWR, a security consultancy company.
ADB Connection Vulnerability
This is a low level vulnerability, which means that it is highly unlikely that users have been affected by it. This security oversight can only be exploited if USB debugging is enabled on your device, which is not the case for most users.
Android Debug Bridge (ADB), a command line that can help users when debugging or developing, grants users access to data on the device, as well as access to functionality. It is very unlikely that average users will have USB debugging turned on. But if that were the case, then attackers would be able to install and uninstall any applications on the device, access a high privilege shell, bypass the lock screen, and steal data and settings from the device.
Installation of TLS Certificates
The other two oversights are deemed as a medium level threat for users. Both of them have to do with the installation of TLS certificates, which can happen without users having to do anything with the process. When a TLS certificate is installed, however, a notification will be prompted. This is an evident sign that the device has been compromised. If you get a notification out of the blue saying “Certificate Installed”, then you should take action at once and get rid of that certificate. There is a possibility that there already is some malicious app on your device, so you have to check for that, as well, and remove it if it is present.
What makes these vulnerabilities more severe is the fact that they open up the opportunity for man-in-the-middle attacks. This means that hackers can intercept encrypted that that you transfer when interacting with your applications.
There is a way through which this can be avoided – certificate pinning. This is a validation mechanism that has the certificate validation data bundled in the app. And if any information from the server somehow does not correlate, then the connection is aborted. However, if the encrypted traffic does not use certificate pinning, then it can be snatched via man-in-the-middle attack.
The Update
The only way to fix these issues is to install the new patch. We recommend doing this as soon as possible if you want the issues to be resolved.