Google's Fast Pair Bluetooth protocol, designed to streamline device connections, has been found to be vulnerable to hacking and tracking by security researchers at Belgium's KU Leuven University. The protocol's flaws were exploited to create an "invisible man" that can hijack hundreds of millions of earbuds, headphones, and speakers.
The vulnerabilities were discovered in 17 audio accessories from 10 different companies, including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech, and Google. The hacking techniques, called "WhisperPair," allow anyone within Bluetooth range of these devices to pair with them and take control of their audio streams or phone conversations.
Researchers Sayon Duttagupta and Nikola AntonijeviΔ demonstrated the vulnerabilities in a video and found that they could hijack devices in under 15 seconds. They also discovered that some devices linked to Google accounts could be used to track users' locations using Google's Find Hub feature.
To exploit these vulnerabilities, hackers would need to obtain a Model ID value specific to the target device model. These IDs can be obtained by owning or purchasing a device of the same model as the target's or querying a publicly available Google API.
Google has acknowledged the findings and published a security advisory, working with researchers to fix the problem. However, many users may not update their devices' software due to the complexity of the process.
Device manufacturers have made updates available for affected devices, but installations are likely to be inconsistent. The researchers urge all users to update their vulnerable accessories and use this as an opportunity to remind themselves to update other internet-of-things devices.
The study highlights the need for device manufacturers to prioritize security when adding ease-of-use features. Convenience does not immediately mean less secure, and neglecting security in pursuit of convenience can have serious consequences.
The vulnerabilities were discovered in 17 audio accessories from 10 different companies, including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech, and Google. The hacking techniques, called "WhisperPair," allow anyone within Bluetooth range of these devices to pair with them and take control of their audio streams or phone conversations.
Researchers Sayon Duttagupta and Nikola AntonijeviΔ demonstrated the vulnerabilities in a video and found that they could hijack devices in under 15 seconds. They also discovered that some devices linked to Google accounts could be used to track users' locations using Google's Find Hub feature.
To exploit these vulnerabilities, hackers would need to obtain a Model ID value specific to the target device model. These IDs can be obtained by owning or purchasing a device of the same model as the target's or querying a publicly available Google API.
Google has acknowledged the findings and published a security advisory, working with researchers to fix the problem. However, many users may not update their devices' software due to the complexity of the process.
Device manufacturers have made updates available for affected devices, but installations are likely to be inconsistent. The researchers urge all users to update their vulnerable accessories and use this as an opportunity to remind themselves to update other internet-of-things devices.
The study highlights the need for device manufacturers to prioritize security when adding ease-of-use features. Convenience does not immediately mean less secure, and neglecting security in pursuit of convenience can have serious consequences.
like what?! So I'm using my AirPods to listen to music on the bus yesterday and I start noticing this weird sound coming from the other earbuds around me... turns out some hacker dude nearby was using them to hack into my audio stream 
like, how does that even work?! And now I'm reading about this "WhisperPair" protocol being vulnerable to hacking... crazy! 
OMG, you guys! I'm low-key freaked out about this 
for hackers. The fact that these vulnerabilities are so easily exploited is mind-blowing. Like, what's the point of having a secure protocol if it's just gonna be vulnerable to hacking? 
No thank you!
. Device manufacturers need to step up their game when it comes to prioritizing security over convenience 
.
, and we can all rest a little easier knowing our devices are a bit safer 
.
. And now they're using Google's Find Hub feature to track users' locations? It's like something straight out of a spy thriller movie! 
Anyway, I hope device manufacturers are paying attention and updating their devices ASAP... we can't keep living in fear of our smart accessories being taken over by hackers 
i cant believe google's fast pair bluetooth protocol was so vulnerable to hacking lol what a great excuse for device manufacturers to step up their game and prioritize security over convenience 
its like, we need to be safe online & offline 
. I'm talking like an "invisible man" here 
.
. The hackers can even track users' locations using Google's Find Hub feature 
, which is super scary. 
.
. Device manufacturers should prioritize security when adding ease-of-use features, or else it's gonna be a nightmare 
. I'm all for innovation and tech advancements, but not if it comes at the cost of our security 
. But seriously, this is a wake-up call for device manufacturers to prioritize security over convenience.
. Anyone else got an earbud or speaker that's vulnerable? We gotta stay vigilant! 
. I mean, who wants their personal data tracked by Google, right? And now that I know my earbuds were vulnerable, I'm gonna go update all my devices ASAP 
oh man, i'm getting a chill down my spine thinking about all these earbuds and headphones out there being vulnerable to hacking 
anyway, this is a good thing that security researchers are doing their part to expose these flaws and get them fixed 
.
. it's time for them to take responsibility for protecting our devices 
. in the meantime, we should all be on high alert and keep an eye out for suspicious activity 
OMG how long has this been out? 
I'm so sorry it took me ages to even see this thread... 
Anyway, just a thought - what's the deal with Google not just fixing these vulnerabilities from the start instead of waiting for security researchers to discover them? 
. I'm all for innovation and ease of use, but security needs to be top priority too 
.
. They're like the unsung heroes of the tech world 
.
. The fact that it takes under 15 seconds to hack into a device is just alarming 
. However, I'm not sure how many users will actually update their devices' software given the complexity of the process 
.
. I mean, imagine being able to hijack someone's phone conversation or take control of their audio stream... it gives me the chills 
. I mean, can't they just make updates easier to install? 
. And now I gotta worry about Google tracking me too? 