| ▲ | miduil 4 hours ago | |||||||||||||||||||||||||||||||
Glad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active). Most vendors gave the security researchers either silent treatment or were slow, even after Airoha published fixes. Jabra was one of the positive outlier, Sony unfortunately negatively. What is exciting, even though the flaws are awful, that it is unlikely for current generation of those Airoha bluetooth headsets to change away from Aiorha's Bluetooth LE "RACE" protocol. This means there is great opportunity for Linux users to control their Bluetooth headsets, which for example is quite nice in an office setting to toggle "hearthrough" when toggling volume "mute" on your machine. RACE Reverse Engineered - CLI Tool: https://github.com/auracast-research/race-toolkit I feel like this should receive state-level attention, the remote audio surveillance of any headset can be a major threat. I wonder what the policies in countries official buildings are when it comes to Bluetooth audio devices, considering that Jabra is a major brand for conference speakers, I'd assume some actual espionage threats. | ||||||||||||||||||||||||||||||||
| ▲ | Namidairo 3 hours ago | parent | next [-] | |||||||||||||||||||||||||||||||
> Most vendors gave the security researchers either silent treatment or were slow, even after Airoha published fixes. Jabra was one of the positive outlier, Sony unfortunately negatively. While I don't recall Sony issuing an advisory, I believe the users of their app would have started getting update notifications since they (quietly) released firmware updates. > This means there is great opportunity for Linux users to control their Bluetooth headsets, which for example is quite nice in an office setting to toggle "hearthrough" when toggling volume "mute" on your machine. I think most vendors are using custom services with their own UUIDs for settings such as this. Regardless, I believe there are open client implementations for some of the more popular devices. Gadgetbridge comes to mind in regards to Android, not sure about any Linux equivalent. | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||
| ▲ | macintux 4 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
> Glad this submission is finally receiving upvotes. Speaking for myself, I have very little patience for technical videos, so I don't believe I've ever upvoted a YouTube submission. | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||
| ▲ | mi_lk 3 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
> This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, .. That doesn't sound very serious if they're exposed, is it? Can it be used to eavesdrop my conversation if I'm speaking through the headphone | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||
| ▲ | keepamovin 2 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
Finally, a coherent explanation of AirPods glitches ;) | ||||||||||||||||||||||||||||||||
| ▲ | IshKebab 3 hours ago | parent | prev | next [-] | |||||||||||||||||||||||||||||||
Is this an unintentional vulnerability or is it one of those "we left it open because it's easier and we hoped nobody would notice" kind of things. I mean can you just send a "update to this firmware" command completely unauthenticated and it's like "yep sure"? No signing or anything? | ||||||||||||||||||||||||||||||||
| ▲ | bgbntty2 3 hours ago | parent | prev [-] | |||||||||||||||||||||||||||||||
Remote audio surveillance probably be accomplished on wired headphones with TEMPEST [0]/Van Eck phreaking [1]. Not sure about which has a better range and which would be stealthier - TEMPEST or the Bluetooth attack. The Bluetooth attack just requires a laptop. Not sure if the TEMPEST attack would require a big antenna. | ||||||||||||||||||||||||||||||||