PSA: Don't use the app KDEasy to manage your books. It steals info about you.

Another day, another security PSA.

I went searching for an app to manage collections on my Kindle Touch. Found one called KDeasy that looked well designed.

I plugged in my kindle and the app told me it was going to install a script on my kindle to help manage collections, and that I needed to tell my kindle to update with the script on it. That seemed a bit shady.

I looked at the script that it stuck on my kindle and found this as part of it:

get_info() {
  if [ ! -f /var/local/java/prefs/reginfo ]; then
    reg=NO
  else
    reg=`cat /var/local/java/prefs/reginfo | grep deviceEmailAddress`
  fi
  if [ -f /etc/uks/pubdevkey01.pem ]; then
    jb=YES
  else
    jb=NO
  fi
  freestore=`lipc-get-prop com.lab126.volumd userstoreFreeSpace`
  allstore=`lipc-get-prop com.lab126.volumd userstoreTotalSpace`
  ip=`ifconfig wlan0 | grep 'inet addr'`
  mac=`cat /proc/mac_addr`
  version=`cat /etc/prettyversion.txt`
  echo $reg > $1
  echo $jb >> $1
  echo $freestore >> $1
  echo $allstore >> $1
  echo $ip >> $1
  echo $mac >> $1
  echo $version >> $1
}

It gathers your email address, jailbreak status, free storage space amount, total storage space amount, ip address, mac address, and version and saves it to a file at /mnt/us/system/info on the device. There are then a few other scripts it runs, and it seems like the windows application then reads this file and sends the information off elsewhere.

So yeah, careful what you use to manage your kindle. You might end up in a poor situation.