Back to Search
Start Over
Reading between the Lines: An Extensive Evaluation of the Security and Privacy Implications of EPUB Reading Systems
- Source :
- IEEE Symposium on Security and Privacy
- Publication Year :
- 2021
- Publisher :
- IEEE, 2021.
-
Abstract
- In recent years, e-books have proven to be a very appealing alternative to physical books; nowadays, almost every written book is published in an electronic format next to its physical copy. In an attempt to promote consensus and to offer an alternative to emerging proprietary e-book formats, the Open eBook format was introduced, now known as the EPUB format. Building on existing web functionalities, this open format relies primarily on XHTML and CSS to construct e-books. As such, browser engines are often employed to render the contents of EPUBs. However, this implies that reading systems may face similar vulnerabilities as web browsers.In this paper, we report on a semi-automated evaluation of the security and privacy aspects of EPUB reading systems. This evaluation, which was performed on 97 EPUB reading systems covering seven platforms and five physical reading devices, revealed that almost none of the JavaScript-supporting reading systems sufficiently adhere to the EPUB specification’s security recommendations. Furthermore, our results indicate that 16 reading systems even allow an EPUB to leak information about the user’s file system, and in eight cases extract file contents. In addition to the semi-automated evaluation, we demonstrate that an attacker can launch even more potent attacks that may lead to a full compromise of a user’s system, by exploiting aspects specific to the implementation of reading systems used by millions of users. Finally, we investigate the root cause of the identified security and privacy issues, uncovering several flaws in both the implementation of EPUB reading system, as well as shortcomings of the EPUB specification.
- Subjects :
- File system
XHTML
Computer science
business.industry
media_common.quotation_subject
Open format
Construct (python library)
Root cause
computer.software_genre
World Wide Web
Reading (process)
Peer to peer computing
Electronic publishing
business
computer
media_common
computer.programming_language
Subjects
Details
- Database :
- OpenAIRE
- Journal :
- IEEE Symposium on Security and Privacy
- Accession number :
- edsair.doi.dedup.....189a4bb99e2eb3008981ccbe4f9cda4a