10 ms·
Bluetooth Headphone Jacking: A Key to Your Phone [video]
- swores 10mo agoI don't have time right now to watch the video and will be coming back to do so later, but here's a couple of snippets from the text on that page that made me want to bother watching (either they're overhyping it, or it sounds interesting and significant) > The identified vulnerabilities may allow a complete device compromise. We demonstrate the immediate impact using a pair of current-generation headphones. We also demonstrate how a compromised Bluetooth peripheral can be abused to attack paired devices, like smartphones, due to their trust relationship with the peripheral. > This presentation will give an overview over the vulnerabilities and a demonstration and discussion of their impact. We also generalize these findings and discuss the impact of compromised Bluetooth peripherals in general. At the end, we briefly discuss the difficulties in the disclosure and patching process. Along with the talk, we will release tooling for users to check whether their devices are affected and for other researchers to continue looking into Airoha-based devices. [...] > It is important that headphone users are aware of the issues. In our opinion, some of the device manufacturers have done a bad job of informing their users about the potential threats and the available security updates. We also want to provide the technical details to understand the issues and enable other researchers to continue working with the platform. With the protocol it is possible to read and write firmware. This opens up the possibility to patch and potentially customize the firmware.
- Rygian 10mo agoHere's an excerpt from [1]: > Step 1: Connect (CVE-20700/20701) The attacker is in physical proximity and silently connects to a pair of headphones via BLE or Classic Bluetooth. > Step 2: Exfiltrate (CVE-20702) Using the unauthenticated connection, the attacker uses the RACE protocol to (partially) dump the flash memory of the headphones. > Step 3: Extract Inside that memory dump resides a connection table. This table includes the names and addresses of paired devices. More importantly, it also contains the Bluetooth Link Key. This is the cryptographic secret that a phone and headphones use to recognize and trust each other. > Note: Once the attacker has this key, they no longer need access to the headphones. > Step 4: Impersonate The attacker’s device now connects to the targets phone, pretending to be the trusted headphones. This involves spoofing the headphones Bluetooth address and using the extracted link-key. > Once connected to the phone the attacker can proceed to interact with it from the privileged position of a trusted peripheral. [1] https://news.ycombinator.com/item?id=46454740 https://news.ycombinator.com/item?id=46454740
- dijit 10mo agoAnd everyone got mad at OpenBSD for refusing to develop bluetooth. It’s a messy standard and we shouldn’t be surprised that the race to the bottom has left some major gaps.. though Sony WH1000’s are premium tier hardware and they have no real excuses.. I always wondered how people could justify the growth of the bluetooth headphone market in such a way.. Everyone seems to use bluetooth headphones exclusively (in Sweden at least), I’m guilty of buying into it too (I own both Airpods Pro’s and the affected Sony WH1000-XM5) but part of me has always known that bluetooth is just hacks on hacks… I allowed myself to be persuaded due to popularity. Scary. I was also trying to debug bluetooth “glitching audio” issues and tried to figure out signal strength as the first troubleshooting step: I discovered that people don’t even expose signal strength anymore… the introspection into what’s happening extends literally nowhere, including not showing signal strength… truly, the whole thing is cursed and I’m shocked it works for the masses the way it does.. can you imagine not displaying wifi signal strength?
- pyvpx 10mo agoSome of us kept using OpenBSD (longer than they should’ve?) because of that and a few other related decisions. So who is everyone, in your meaning?
- dijit 10mo agoIt comes up enough that I am comfortable saying that it feels like “everyone” to the OpenBSD devs. https://news.ycombinator.com/item?id=25950845 https://news.ycombinator.com/item?id=25950845 https://news.ycombinator.com/item?id=45798439 https://news.ycombinator.com/item?id=45798439 https://news.ycombinator.com/item?id=34667522 https://news.ycombinator.com/item?id=34667522 https://news.ycombinator.com/item?id=43144607 https://news.ycombinator.com/item?id=43144607
- antirez 10mo agoYou can't read English like if it was a declarative logical language. It is obviously an hyperbole to say "everyone". It means "a lot of people". So why they didn't say "a lot of people"? Language uses hyperboles to make a point stronger.
- p0w3n3d 10mo agoMeanwhile all the phones dropping jack because Apple started it. Official reason is to "waterproof phones"
- CharlesW 10mo agoThe official reason was, famously and ridiculously, "courage". Apple further explained that space is at a premium, listed the many things competing for that space, and noted that a large, single-purpose legacy connector no longer made sense. A lot of Apple's strategic choices are driven by products that take 5, 10, or sometimes 20 years to realize. For example, the forthcoming foldable iPhone (and the proving ground for many related decisions, the iPhone Air) was on roadmaps literally a decade before a decision like this reverberates through released products. Putting a high-quality DAC in a dongle wasn't a terrible solution (many phones with analog jacks have poor ones), and today hundreds of headphones¹ courageously have native USB-C support. ¹ https://www.bhphotovideo.com/c/products/usb-c-headphones/ci/59912?sort=PRICE_LOW_TO_HIGH https://www.bhphotovideo.com/c/products/usb-c-headphones/ci/...
- realusername 10mo agoApple is very late to the foldable phones now, not sure that's the best example
- CharlesW 10mo agoRegardless, the point of mentioning it is that Apple commonly makes decisions that can seem bizarre to people who don't consider systemic and longer-term reasons why they might've been made. Another micro-example of this that comes to mind is Tahoe's mostly-reviled chonky window borders, which along with many other gradual UX changes over years, absolutely foreshadow touchscreen Macbooks.
- realusername 10mo agoThey've also been late sometimes and had to change by force their assumptions, the first app store in iOS was cydia and a lot of what we consider modern iOS design was copied over from the jailbreaking community.
- raverbashing 10mo agoAh yes, the removal of headphone jacks, the gift that keeps on giving Funny that there were always some people here pushing bt audio as "the future", whom I can only assume were the technically shallow but very opinionated people that would die on the smallest technical hills
- NoiseBert69 10mo agoThanks god the headphone jacks died in smartphones. I switched to USB-C soundcard cables which are dirt cheap and survive much much more plug-unplug-cycles. They easily can be replaced.
- raverbashing 10mo agoThe epidemic of people not wearing headphones has been directly caused by the lack of headphone jacks
- ffguhv 10mo agoLOL. People not using headphones in public are narcissistic a-holes, but they’ve been doing it since *long* before headphone jacks went missing from smartphones.
- conception 10mo agoIt’s even noted as a problem in the beloved, acclaimed piece of cinema - Star Trek IV : The Voyage Home.
- j1elo 10mo agoA couple days ago there was a bit of a conversation about this, you might find it interesting. It seems this feeling (to the point of calling it an "epidemic"!) might be caused by the known bias of thinking that earlier times were better: https://news.ycombinator.com/item?id=46424228 https://news.ycombinator.com/item?id=46424228
- deleted 10mo ago
- TheAceOfHearts 10mo agoHaven't watched the video yet, but I think this capability was leaked by VP Kamala Harris during her recent interview with the Late Night Show [0]. She stated she doesn't use wireless headphones because she's been in security meetings and knows they're not safe. [0] https://youtu.be/BD8Nf09z_38 https://youtu.be/BD8Nf09z_38 (Timestamp 18:40)
- denysvitali 10mo agoDisclaimer: This comment is not intended to be political - I don't care about the specific party she's part of. Out of all the people I would trust on the matter, Kamala Harris doesn't certainly end up at the top of my list, for reasons such as this one: https://youtu.be/O2SLyBL2kdM?si=Zq-EN8zxj4Y_UCwI https://youtu.be/O2SLyBL2kdM?si=Zq-EN8zxj4Y_UCwI You also don't need to be in classified meetings to understand that Bluetooth/ BLE (and specifically the way most vendors implement the spec) is not as secure as other more battle-tested technologies
- janez2 10mo agoyou have a tracking "si=..." parameter in the youtube link
- denysvitali 10mo agoToo late to edit. I missed that, sorry!
- dijit 10mo agoI think many people would be justified in making the argument that bluetooth has existed for at least 20 years and thus is the established battle tested protocol.
- denysvitali 10mo agoYeah, but Bluetooth spec changed a lot over the years (3000+ pages) and the certification price is rather expensive. There's an interesting article from Wired [1] about this, although some interesting comments from the engineers working on BT stacks are far more interesting. It seems like most of the manufacturers do not create spec-compliant devices, and that the tests from the certification are just poor. I'd love to hear more from an expert on the topic, but this looks to be the consensus. [1]: https://archive.ph/6201V https://archive.ph/6201V
- miduil 10mo agoGlad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active). Most vendors gave the security researchers either silent treatment or were slow, even after Airoha published fixes. Jabra was one of the positive outlier, Sony unfortunately negatively. What is exciting, even though the flaws are awful, that it is unlikely for current generation of those Airoha bluetooth headsets to change away from Aiorha's Bluetooth LE "RACE" protocol. This means there is great opportunity for Linux users to control their Bluetooth headsets, which for example is quite nice in an office setting to toggle "hearthrough" when toggling volume "mute" on your machine. RACE Reverse Engineered - CLI Tool: https://github.com/auracast-research/race-toolkit https://github.com/auracast-research/race-toolkit I feel like this should receive state-level attention, the remote audio surveillance of any headset can be a major threat. I wonder what the policies in countries official buildings are when it comes to Bluetooth audio devices, considering that Jabra is a major brand for conference speakers, I'd assume some actual espionage threats.
- keepamovin 10mo agoFinally, a coherent explanation of AirPods glitches ;)
- macintux 10mo ago> Glad this submission is finally receiving upvotes. Speaking for myself, I have very little patience for technical videos, so I don't believe I've ever upvoted a YouTube submission.
- andai 10mo agoI would read it if it was an article of identical length! One second thought I think this is called a transcript... --- Edit: Auto-Transcript! (No timestamps, sorry) https://jsbin.com/jiqihuveci/edit?html,output https://jsbin.com/jiqihuveci/edit?html,output
- smallstepforman 10mo agoMost audiophiles ignore bluetooth headphones due to sound quality + latency, so we (audiophiles) stick to wired at home and we also have dedicated headphone amps since the pissy sound card D/A convertors are incredibly bad. Bluetooth only when I’m doing yard work. Sadly, modern music is tuned to crappy headphones, crappy car systems, crappy speakers … I miss the 80’s audiophile obsession, the equipment had heart, and mixing and mastering was generations ahead of current (mainstream) music production.
- dmd 10mo agoWhat does audio have to do with this post?
- petit_robert 10mo agoGP seems to mean that if people cared about audio quality, they would not use bluetooth in the first place? Audiophiles tend to have firm stances on what is acceptable or not, I find.
- K0balt 10mo agoThere are also some amazing cables available in the space. Especially the digital cables, they are really amazing.
- brohee 10mo agoA friend worked in an audiophile shop during his physics master and he'd swear the customer base was the most gullible bunch he ever saw... And mostly unswayable by rational arguments. In any case someone ought to shear the sheep....
- calmworm 10mo agoI suspect some of that disconnect is because hearing itself isn’t standardized. Differences in frequency perception, hearing loss, and training can make two people genuinely hear different things.
- wojciii 10mo agoThis is probably going to make some state actors unhappy.
- amelius 10mo agoProbably a combination of happy and unhappy, depending on which state actor, and who knew about the exploit.
- Alifatisk 10mo agoA bit irritating to see people ruining the demo by calling the phone number
- peterpost2 10mo agoShame on Airoha. Terrible security pracices.
- brohee 10mo agoYou'd think Sony would have learned from the PSN debacle, but alas... Now I need to setup to check if my headphones are still vulnerable...
- bethekidyouwant 10mo agoThis is just a chip with debug mode left on and does not allow anyone to hijack audio stream or anything interesting. (Just in case anyone’s checking the comments because they don’t want to watch a long ass video and they notice all the comments are essentially off topic)
- jogu 10mo agoSounds like you should have actually watched the “long ass video”. It allows the pairing key to be exfiltrated from the compromised device and an external, attacker controlled device to perform any function the original device could. This includes retrieving the paired devices phone number, answering phone calls, and receiving the audio. They live demo hijacking a whatsapp account using this.
- bethekidyouwant 10mo agoNeat. It appears my headphones have to be in pairing mode. Which is a very short window, at which point the attacker can impersonate your device. this allows him to answer phone calls for you or make phone calls, but you would notice right away. It’s not like cloning the audio and eves dropping. so yeah it’s a nothing burger.
- jogu 10mo agoSome devices are/were only vulnerable during the initial pairing but a key point from this talk was that most of these devices were vulnerable during normal use. The RACE protocol could be accessed even if the device isn’t in pairing mode. Then once you have a target device’s key you can carry out the attack at anytime, when they’d be unlikely to notice.
- bethekidyouwant 10mo agoIf you have the target device key, you can impersonate the device later. But how do you get the device key in the real world? I would need to be in pairing mode for you to get it. Even if you did get it, then you can answer my calls if you are next to me, which in the real world is certainly noticeable.
- amelius 10mo ago> We also demonstrate how a compromised Bluetooth peripheral can be abused to attack paired devices, like smartphones, due to their trust relationship with the peripheral. Can't watch the video now. But I wonder to what extent they can take over a smartphone? Can they make a headphone look like a keyboard/mouse, for example? Second question: can the whole problem be remedied by installing a firmware update?
- jbverschoor 10mo agoWhat about B bluetooth keyboards and touchid
- sva_ 10mo agoI previously posted the repo here: https://news.ycombinator.com/item?id=46406310 https://news.ycombinator.com/item?id=46406310
- jader201 10mo agoWhy not just link to the repo directly? That post only has one comment. Here’s the repo (to save everyone a click): https://github.com/auracast-research/race-toolkit https://github.com/auracast-research/race-toolkit
- sva_ 10mo agoIt is somewhat of a custom that the person who posts about a thing first gets the Karma, but it is seldom respected, and I won't beg for it. But I do sometimes hint at it.
- unsettledturtle 10mo agochecking my understanding: this vuln is in the firmware for specific airoha chipsets; e.g. if a bluetooth device is listed as using a qualcomm chipset then it's unaffected by this specific vuln? ... though I wouldn't be surprised if we see a burst of similar disclosures for other manufacturers in the next year or so
- willnix 10mo agoYour understanding is correct :)
- explodes 10mo agoFor other mobile users: https://www.cvefind.com/en/cve/CVE-2025-20700.html https://www.cvefind.com/en/cve/CVE-2025-20700.html https://www.cvefind.com/en/cve/CVE-2025-20701.html https://www.cvefind.com/en/cve/CVE-2025-20701.html https://www.cvefind.com/en/cve/CVE-2025-20702.html https://www.cvefind.com/en/cve/CVE-2025-20702.html
- zaptheimpaler 10mo agoI couldn't find anything from Sony confirming that these specific vulnerabilities had been patched, so i tried to reproduce the steps from the whitepaper using nRF Connect [1] with my Sony WH-1000XM4 on the latest firmware version. There was no response to the Get Build Version command, and the Read Flash command returned an error. So tentatively (with false negatives possible), it seems to have been patched on Sony devices. I don't have a linux box with bluetooth handy ATM so I didn't try using the race-toolkit directly. [1] https://static.ernw.de/whitepaper/ERNW_White_Paper_74_1.0.pdf https://static.ernw.de/whitepaper/ERNW_White_Paper_74_1.0.pd...
- cloudfudge 10mo agoI didn't see a summary in here so based on my reading: * Certain headset devices from varying vendors have crappy BT security over both bluetooth classic and BLE * They implement a custom protocol called RACE which can do certain things with no authentication at all * One of the things RACE lets you do is read arbitrary memory and exfiltrate keys needed to impersonate the vulnerable device with your already-paired phone * Once you're impersonating the vulnerable device you can do all sorts of things on the paired phone like place/accept calls, listen on the microphone, etc. This is pretty bad and you can easily see this being used to bypass other layers of auth like SMS verification or "have a robot call me and read me a code." It also makes me wonder if a spoofed device could appear as a HID device (e.g. a keyboard), but it's unclear whether the link key compromise works for new device classes. So the way to mitigate this is to be certain you don't have one of the vulnerable peripherals or to disable BT. Note that the list of device models sounds *far* from complete because it's a chipset issue. Which makes me wonder if there are cars out there using this chipset and exposing the same vulns. I'd be very interested if anyone has a source on whether any cars use these chipsets.
- epakai 10mo agoRazer isn't mentioned, but I know they're using Airoha AB1571DN in Blackshark V3 Pro transmitter. Not sure what is on the headset end. Don't see any mentions on their last firmware update, and I can't find older ones.
- jogu 10mo agoImportant to note that usage of an Airoha chip doesn’t imply being vulnerable, so each device has to be checked individually. It’s possible they weren’t vulnerable to begin with, it’s also possible they silently patched it.
- karlzt 10mo agoIMO anything related to Bluetooth should be destroyed. https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/ https://www.bleepingcomputer.com/news/security/undocumented-...
- krick 10mo agoOk, so TL;DR: there's nothing that can be done about it? Just hoping that nobody (like not a single random person, eh) around me knows about that?
- jogu 10mo agoIt can be fixed if the manufacturer releases a firmware update for the affected devices.
- pwagland 10mo agoIs there a fuller list of headsets that are affected being maintained anywhere? I could not find it. Since most manufacturers tend to reuse components, we can expect that more Sony stuff is affected, and probably more JBL/Jabra/Bose/Marshall that they didn't have access to. Based on their timeline, full credit to Beyerdynamic! Partial credit to Airoha, they took a long time to initiate the communications, but once they did, they seemed to take it seriously. No credit to Sony and Marshall, as they either didn't, or effectively didn't, respond. Unknown credit to Bose, JBL, Jabril, EarisMax, MoerLabs, and Teufel, as they don't appear in the timeline.
- pabs3 10mo agoWonder if anyone is going to replace the proprietary buggy firmware with libre firmware.