Romance, Historical, Contemporary, Paranormal, Young Adult, Book reviews, industry news, and commentary from a reader's point of view


Malicious Books?

Malicious Books?

It was only a matter of time before we had to worry about our books delivering more than a great story well told. We humans can be damned devious.

This Gizmodo article is pretty interesting, though a little thin on facts (see infra). Basically, it is possible to create a Kindle book with malicious code in the metadata. When a user views their list of titles under “Manage My Kindle” (now renamed to “Manage Your Content and Devices”) on Amazon, the code executes and a user could end up with a compromised Amazon account or worse, one imagines. If you are a Calibre user, read on and confirm you’re on a patched version.

A more thorough discussion by Benjamin Messler, the person who discovered the flaw, is here. Note that Calibre was also vulnerable, but the developer had it patched within 4 hours of being notified. Therefore, if you use Calibre and are not on version 1.80 or higher, you would be wise to update right now.

This flaw was pointed out to Amazon and patched nearly a year ago, but was reintroduced after a recent, subsequent update to the Manage Your Content pages. Amazon has re-patched the flaw, though they seem to have taken their sweet time about it. Third parties remain vulnerable.

This, May God Help Us, is a Cherry Tomato

I have additional thoughts on this.

First, about three or four months ago, there was a slew of sites that pointed to books on Google docs. I think there weren’t/aren’t actual books there, only malware. There’s been another spate of new pirate sites just recently, many of which appear to be registered to folks in China. Right. Stage set.

Pretend for a moment that you have discovered this Amazon vulnerability and have developed an exploit. Now, you must get this BookMalware (TM) into the hands of readers and onto a Kindle user’s Manage Your Device page. Or any other page similarly vulnerable.

A reader who obtains one of these malicious files and then sends it to their Kindle becomes vulnerable to an account hack, or some other Bookware (TM) attack. I mean sure, someone’s Amazon account credentials is a pretty juicy target, but I don’t see why malicious code would necessarily limit itself to grabbing credentials.

Because, you know, that MalBook (TM) is sitting there on a server and that title is probably stored in a database somewhere, and well, suppose instead of javascript, the code was something like this:

xkcd comic featuring SQL Injection

Little Bobby Tables, via xkcd


Just saying. There’s no evidence this happened or, even, that it would work. But hey.

Anyway, our MalBookWare (TM) developer must now get his product to users. You might well ask how. What leaps to mind is a website with malicious books just waiting for readers with Kindles. You must dangle the pretties and do everything you can to make your site look like there are loads of great books by great authors. All you have to deliver to the person on the other end is a mobi file with any old content, as long as the website makes it look like it’s a book by a favorite author.

Authors with services like Google Alerts, or Talkwalker alerts might start getting alerts like this:

Best Romance Ever: Number 3 in series pdf
My Book of Bible Stories and Prayers: AND My Book of Prayers
Best Romance Ever: Number 3 in series – Author, Suzie – PDF, EPUB, DOC Free Download EBook and Audiobook …

Anyone clicking on such a link, whether in an alert or through arriving at it after Googling for

Suzie Authors Best Romance Ever, Book 3, torrent

will be clicking a link (which I have altered so you can’t actually get there…) like the one below. . com/url?rct=j&sa=t&url =[removed]:// xxyebooks.[tld removed]/best-romance-ever-number-3-in-series_zqjr5.html&ct=ga&cd=CAEYACoUMTI5MjY0NTMzOTEwNzYyNjA4MDgyGRobert;('Drop Table Students;--sjg4gYzY0ZjI0ZjhjNzE5Y2I6Y29tOmVuOlVT&usg=AFQjCNGK5w9Tvxf3JSRA5DXs6q1JtSvZng

Ok, so I added the SQL injection just for kicks. Because it’s hilarious to SQL inject obfuscated code.

Anyhow, you see all that stuff after the number-3-in-series_zqjr5.html ? If the intent behind the link is bad, it could well be obfuscated code that will, eventually, get translated into a location that goes somewhere scary. Or not. Or a to a script that delivers a malicious payload. You won’t get a book. You’ll get malware. Or, maybe, a file with a MalBookWare (TM) title.

By the way
xxyebooks.[tld removed]:

Registrant Name:WU YOUPO
Registrant Organization:WU YOUPO
Registrant Street: LIJIAPOLU
Registrant City:SHANGHAI
Registrant State/Province:Shanghai
Registrant Postal Code:368742
Registrant Country:CN

Additional Observations

There has been a great deal of speculation and public comment among some of the authors I know or know of. Many are making a connection between Kindle Unlimited and an increase in piracy, and well, maybe. But I think that’s not what they’re seeing.

There are several problems with those conclusions. Foremost is the erroneous belief that every site that advertises pirated books is actually delivering pirated books. They are not. They are delivering malware or just stealing payment information. The ironic good news for authors is that books are the bait. If people didn’t want the books, they would not be effective bait.

This is not an endorsement of anything. It’s just an observation.

The rash of Google docs as a (probable) malware delivery method isn’t an increase in actual piracy. Neither are any efforts to exploit that Kindle vulnerability, and you can bet that there were/are sites out there where the bait is supposedly pirated books by popular authors. The user may even believe they got the book, but the payload is malware.

If I were a malware deliverer, I wouldn’t bother pirating a book and altering the contents. I’d make my own content, disguise it as a popular book by grabbing the Amazon feed so I can populate the metadata and links with the author name and book title, and deliver it to the user. By the time they click on the content in their Manage my Device and say, hey! where’s my book by Suzie Author, a server in China has their Amazon credentials. Or worse.

A few more observations

Clicking on links to what looks like a pirate site is risky business. The click itself can deliver malware. It’s important to recognize that and not, if one cares about such things, conflate the apparent purpose of a link with it’s actual purpose. I would suggest, though, that no one should be saying, well, they got what they deserved for trying to steal books. The last thing any author should want is readers who think books = malware.

Because epub3 and other book formats allow javascript, I would expect that the book as (more) sophisticated malware delivery method is only a matter of time. Someone, at some point, is going to deliberately do what Benjamin Messler did in order to prove to Amazon that they had a vulnerability.

Any developer worth his or her salt can extrapolate out to sneakier things to do. I suspect Amazon, Apple, and Google can secure their vendor environments. I’m not so sure about Barnes & Noble since they can’t even be bothered to take care of their Warrior Cat problem. Kobo seems to care more, so I’ll put them on the vendors who are careful list until they prove otherwise.

My point, really, is if you’re pirating, be suspicious. If you’re an author, well, not all those links are actual instances of pirated books, and you shouldn’t be clicking either.

GUEST OPINION: On Romance and Sacrifice by Zoey Brouthers

GUEST OPINION: On Romance and Sacrifice by Zoey Brouthers



Zoey Brouthers is an avid reader with degrees in Music who likes to have intelligent arguments. She has one self-published short story to her name and lots and lots of books on her shelves.

I love romance novels. There’s something for everyone, and with few exceptions, there’s always a happy ending. Whether you’re reading the groundbreaking tomes of Kathleen Woodiwiss or the ridiculously entertaining books of Katie Macalister, you can count on that happy ending. But there’s something else you can almost always count on that I find less agreeable: feminine sacrifice.

Don’t start freaking out, I don’t mean that old “virgin sacrifice” trope. No, I’m talking about something far more insidious. I’m talking about the sacrifices the heroine makes for the hero.

Sacrifice for love is rampant, not only in romance novels, but in movies, on television, and (of course) in society. There’s nothing wrong with the idea, and, in fact, many of its iterations. What I object to is the blatant inequality of the sacrifices made in romance novels. This is particularly true in older books, such as the aforementioned Woodiwiss’. Considering the time at which they were written, as well as the often historical settings, it really comes as no surprise, even if it does irk. The problem is that, though feminine sacrifice is less noticeable in modern contemporary romance, it is still there.

What really brought this to my attention was a recent re-reading of Linda Howard’s Sarah’s Child. While it is now removed from truly contemporaneous novels by a decade or three (it’s older than I am!), it’s got several references to feminism and equality of the sexes. But don’t worry, I’ll be bringing a more recent publication into play, too. Just bear with me.

In Sarah’s Child, Sarah has been in love with Rome for years, despite him being married to her best friend. Unfortunately, the best friend and Rome’s young sons die, leaving them both devastated. But after a few years, Rome and Sarah finally give in to their mutual attraction, and emotions happen. There’s sex and emotional growth; there are misunderstandings, fights, and resolutions; there’s a child; and, of course, there’s a happily ever after. Now let’s look at the quantifiable sacrifices made by the hero and heroine in order to achieve that happily ever after.

Sarah gives up her job, at the same company where Rome works, because they form a romantic relationship. She gives up her old, comfortably safe apartment to move into a new place with him once they’re married. She believes she’s given up the possibility of children, though she would take them in a heartbeat.

Rome, on the other hand, sacrifices…his widower/bachelor status.

There’s good news, though! Sarah’s first sacrifice, her job, wasn’t really one. She states, in her thoughts and to Rome, that she’s been thinking of quitting anyway, and has no intention of remaining jobless. And, happily, she sees that through. She ends up owning her own business, through which she develops new (wonderful) friendships. It makes her happy, though it alternately impresses and annoys her husband. Mostly annoys.

Her second sacrifice is less easily brushed aside. Sarah is a very private person who needs to feel safe and stable, particularly in her own home. Upon moving into their wedded home, she has a minor breakdown because she can’t find anything. Even though it’s all her old stuff (presumably), the layout is different, and it freaks her out. Admittedly, this is a normal concern for anyone moving into a new place, one that can be resolved by time, but for Sarah it’s more. She’s temporarily lost some of her peace of mind. However, because it is temporary, we can wave off this second sacrifice with a sigh of relief.

The final sacrifice she makes is problematic because, as indicated by the title, a child happens anyway. But – and this is a big but – her pregnancy is an accident. Had she recovered her brains a little quicker after being seriously ill, she would not have chosen to risk her relationship with Rome by possibly becoming pregnant. She had already made the decision to give up on having children until Rome might change his mind, but with very little hope that he would.

So, despite wanting children herself and hoping that someday Rome will want them, too, she sacrifices that option in order to have any sort of romantic relationship with him. If they hadn’t accidentally gotten pregnant, that sacrifice would have been lasting.

As for Rome, he loses nothing. Not. A. Thing. At least, nothing he’s not better off letting go. True, he gives up being a single man, able to sleep with a different woman every night, but is that really a sacrifice? For some men it might be, but not for Rome. Because we get his perspective as often as not, we know that Rome prefers “domesticity.” He likes being married and focusing all his sexual attention on one woman. That vaunted bachelorhood? He could take it or leave it. And he does leave it, without a second glance.

You could argue that Rome makes emotional sacrifices to be with Sarah, but I think not. All of the emotions and feelings he lets go of are negative: grief, anger, guilt, pain, selfishness. What he’s actually doing is finally working through the loss of his wife and sons, releasing himself from negative emotional shackles so that he’s free to form (and, incidentally, remember) positive emotional ties. As wonderful as that is, it is not sacrifice.

In the end, the only reason you might be able to argue that neither the hero nor heroine sacrifices anything is that accidental pregnancy. Keyword: accidental. That makes all the difference.

Well, that, and that Sarah does choose to give up her job, her security, and the possibility of children. Each of those is her choice, and that is the saving grace. And, if we can trust in the depth of her love (it’s a romance novel, of course we can), even if she and Rome had never had children, she would not regret loving him. If the author hadn’t done such a good job of showing Sarah consciously choosing her path, it would be a different story. Pun intended.

Okay, that was one book from the eighties. Feminine sacrifice tally: one. Let’s have a look at something a little more recent, shall we?

In JR Ward’s novel Dark Lover, vampires are the name of the game. Leaving out many of the details that separate Ward’s vampires from other authors’ (and the logical/biological issues with which her world is riddled), the plot goes something like this: Wrath, sort of abdicated, almost-blind king of the vampires, sort of promises to help a friend’s half-human daughter (Beth, the heroine) through her transition from human to vampire. They fall in love. If I remember correctly, he then takes responsibility and ascends the throne. There’s a whole lot more that happens, of course, but that’s the bare-bones version. So what do Wrath and Beth each sacrifice in order to be together?

Not necessarily in chronological order, Beth gives up her job, her human friends/contacts, and her independence. She keeps her cat. Wrath gives up some of his prejudice against humans, his abdicatin’ ways, and almost his life.

All right, now we’re cookin’ with gas! Three to three, much better than the ratio from Sarah’s Child. One at a time, though, one at a time.

First: the job. Beth is a reporter at the local newspaper and, though kept from much success by her sexist boss, loves her work. As soon as she goes vampire, though, pfft! It’s too dangerous for a lady vamp to be out in the world where lessers (undead bad guys) can find her! While that’s true enough, Beth doesn’t replace her old job in the human world with a new one in the vampire world. She just…sits at home all day, petting the cat?

The Beth we get to know in the beginning wouldn’t stand that for long. She’s had a lot of shocks in a short amount of time, though, so we’ll let her have her peaceful work-free time, for a time. But the book ends without resolving this character issue. It is the first in a series, so it is conceivable that something changes later[1]. For the purposes of this article, though, we’ll stick with it being a sacrifice.

Second: friends. This one is trickier, because while Beth does lose a few friends (namely the good cop, José), she also gains the whole Black Dagger Brotherhood, their awesome butler Fritz, and she gets to keep Butch, a human ex-cop. (The lack of female friends on either side of the equation is fodder for a whole other article.) Because she gains more than she loses, we can toss this particular sacrifice out the window.

Third: independence. Beth’s independence is sacrificed in multiple ways, some more aggravatingly than others. For one thing, in addition to losing her job, she also loses her home. Again, this is due to the lessers that threaten, mostly. Of course, in order to be with Wrath, she’d have to move out anyway, considering vampires are a secret from mankind and he’s not exactly subtle, with his massive bod, tattoos, widow’s peak, attitude, and fangs. But, much like the friends “sacrifice,” Beth trades up. Instead of a ratty apartment, she gets at least one mansion, left to her by her late vampire father. They’re in her name, or at least belong to her, so she could conceivably kick out everyone else and retain that level of independence.

Even if the home situation isn’t much of an issue, the fact that Beth can’t step a foot outside the house without a male escort is. While she is still pre-transition she can get away with it, but once she goes full-on vampire, no way. It’s explained that vampire females are precious, lessers are out to get them, they have to stay hidden from humans, blah, blah, blah. What’s really being said is that vampire males don’t trust their females (at least Beth) to be smart and careful. So she ends up staying at home, worrying about her man – excuse me, male – who’s off fighting, with nothing to keep her busy except the housework she can’t do without sending the servants into spasms. And watch TV. The women of this series watch a lot of TV.

Now let’s examine Wrath’s sacrifices. The first: prejudice. Hmmm. Do I really need to say anything about this? I feel like I covered the “letting go of negative stuff is not sacrifice” thing with Rome. It might be difficult, it might effect change (no, duh), but it’s nothing he’s not better off without. One sacrifice down[2]!

The second: his freedom from kingly responsibilities. Wrath is the hereditary king of the vampires, but he refuses to officially take up the position because reasons. The one I remember most strongly is that he prefers to be out in the field, killing lessers, to dealing with the glymera (vampire high society). Who can blame him? The glymera are pretentious pains-in-the-butt. But they’re not the only vampires, just the wealthy and (en)titled ones.

That’s the reason Wrath gives for ignoring the throne, but the real reason is that he’s afraid. Afraid he won’t do a good job, afraid it will emasculate him, afraid he won’t be able to go out and fight anymore, afraid to take on the problems of vampire society, which are legion. And what do we say about letting go of a negative emotion like fear? All together now: it is not a sacrifice.

The biggest kicker against this particular “sacrifice” is this: Wrath does not give up going into the field when he takes the throne. True, he goes out less often, but he does still fight and kill lessers on a regular basis. He loses nothing (except, perhaps, some patience) by shouldering his royal responsibilities.

His final sacrifice, however, is real: his life. Don’t worry, he doesn’t actually die, but he comes close, which counts. When Beth is captured by lessers (because they get lucky, not because she does anything stupid), Wrath flies to her rescue, getting shot in the process. It takes the vampire equivalent of a blood transfusion to keep him from dying. He nearly sacrifices all to save his beloved, a time-honored tradition of alpha-maleness. Even if it is a little cliché, it’s still a mark in his favor, leaving the sacrifice score at two to one.

Dark Lover’s ultimate feminine sacrifice tally: one. The same score as Sarah’s Child, a book from the eighties with an already uneven sacrifice count. At first glance, the hero and heroine of Dark Lover appear to stand on equal ground in terms of sacrifices for love, but in the end, the heroine sacrifices more.

Because this article’s grown longer than I intended, I won’t examine other novels here, though there are many examples to be had. But I will say that there are authors out there who do an excellent job of creating lovers who sacrifice equally. For example, Nalini Singh and Jennifer Crusie, though writing completely different types of romance novels, know how to balance the equation. Sometimes, that means that neither heroine nor hero truly sacrifices anything. Compromise, yes; sacrifice, no. Frankly, I’ll take that over unequal sacrifice any day. What do you think?


[1] SPOILER: it sort of does and sort of doesn’t. She helps Wrath with royal paperwork. She’s a glorified secretary, and even then, Saxton (a male) takes over.

[2] Side note: it’s not very lasting, either. Through the whole series, vamps refer to humans as “rats without tails,” which I guess is supposed to be uncomplimentary, despite rats being rather intelligent survivors, even without their tails.