Hackers Can Hijack Millions of Wireless Headphones and Speakers, Leaving Them Open to Eavesdropping and Tracking. A group of researchers from Belgium's KU Leuven University Computer Security and Industrial Cryptography group has discovered that 17 models of headphones and speakers use Google's one-tap Fast Pair Bluetooth protocol in a way that leaves them open to eavesdroppers and stalkers.
The vulnerabilities, collectively known as WhisperPair, allow hackers to silently pair with affected devices even if they're already paired. This can be done by obtaining a unique Model ID value specific to the target device model or by querying a publicly available Google API for every possible Model ID.
Using this technique, an attacker would need only to be within Bluetooth range and then carry out a takeover in under 15 seconds. The hacked devices can then be used to listen to the victim's surroundings, play their own audio through the victim's earbuds or speakers at any volume they choose, or even use Google's Find Hub feature to track the target user's movements.
The problem lies with Google's Fast Pair protocol, which was designed for ultra-convenient connections. While it offers ease of use, it does so at the cost of security. The researchers say that this is a classic case of "convenience doesn't immediately mean less secure".
Device manufacturers were found to have certified their products as passing Google's requirements even though they contained dangerous flaws. This highlights the need for device manufacturers to prioritize security when adding ease-of-use features.
Google has published a security advisory and made updates available to fix these vulnerabilities, but many users may not be aware of or update their devices due to the complexity of the process.
The researchers are urging all users to update their vulnerable accessories, as the patch installations will likely be inconsistent. The website created by the researchers provides a searchable list of affected devices.
The vulnerabilities, collectively known as WhisperPair, allow hackers to silently pair with affected devices even if they're already paired. This can be done by obtaining a unique Model ID value specific to the target device model or by querying a publicly available Google API for every possible Model ID.
Using this technique, an attacker would need only to be within Bluetooth range and then carry out a takeover in under 15 seconds. The hacked devices can then be used to listen to the victim's surroundings, play their own audio through the victim's earbuds or speakers at any volume they choose, or even use Google's Find Hub feature to track the target user's movements.
The problem lies with Google's Fast Pair protocol, which was designed for ultra-convenient connections. While it offers ease of use, it does so at the cost of security. The researchers say that this is a classic case of "convenience doesn't immediately mean less secure".
Device manufacturers were found to have certified their products as passing Google's requirements even though they contained dangerous flaws. This highlights the need for device manufacturers to prioritize security when adding ease-of-use features.
Google has published a security advisory and made updates available to fix these vulnerabilities, but many users may not be aware of or update their devices due to the complexity of the process.
The researchers are urging all users to update their vulnerable accessories, as the patch installations will likely be inconsistent. The website created by the researchers provides a searchable list of affected devices.
they can b hijacked by hackers 4 eavesdropping & tracking! i mean, who wants some stranger listening 2 ur private convo or trackin ur moves 
anyhoo, it's like google's fast pair protocol is all about convenience but 4get security 
i feel bad 4 device manufacturers too, they certified their products w/ flawed security, that's just not cool 
so yeah, update ur stuff ASAP, google's got a sec advisory out, but ppl might be lazy 2 do it 
check out the website made by those Belgian researchers, it's got a list of affected devices, stay safe! 
OMG, just got my headphones hacked 
! I mean, I'm not surprised tbh - those fast pairing techs can be super convenient, but not at the cost of our privacies, right? 
So, device manufacturers need to step up their security game and Google needs to patch this ASAP! 
. Can't wait for the patch installation process to be super easy tho... that would be a game changer! 
I'm low-key freaking out about this 
... so basically these hackers can just hijack your wireless headphones and speakers like they're their own 
. And device manufacturers are like "oh, our products passed the test"... but what does that even mean? 
It's time for them to step up their security game.
... now we just gotta hope people update their stuff before it's too late 
. If you got one of these vulnerable headphones or speakers, check the list on that researcher website ASAP! 
. They're so convenient, but now they're basically vulnerable to hackers who can just snoop on us or track our movements 
. It's crazy that device manufacturers just certified these products without considering the security aspect of things 
.
. The researchers are saying that device manufacturers should prioritize security over convenience, and honestly, I think they should just go back to the old days when we didn't have all these fancy Bluetooth gadgets 
.
. But in the meantime, let's all just be careful about what we're using and who we're giving access to our personal stuff 
.
. What's going on with device manufacturers not prioritizing security? They should've known better! Thankfully Google's got a security advisory out and we just need to keep an eye on those updates 
anyway, the good news is that google's already released a patch and made updates available... but idk how many ppl are gonna bother updating their devices 
. What's even crazier is that device manufacturers were like "yeah, this is cool" even though it was super insecure 
.
Not me, that's for sure. I'll be sticking to my trusty old wired headphones from now on 
.
. We need to stay vigilant and prioritize our online safety in this digital age 
.