Researchers Discover Vulnerability in Bluetooth Headphones That Can Take Control of Smartphones

Bluetooth Security Vulnerability Endangers Smartphones

Quick Overview

• Recent flaws in Bluetooth chips may jeopardize smartphones.
• Airoha SoC found in numerous headphones has been identified as vulnerable.
• Intruders could connect silently and listen in via microphones.
• The RACE protocol is susceptible to being exploited for memory dumping and key extraction.
• Devices from manufacturers like Sony and JBL are implicated.
• Airoha has issued a software update to rectify the problem.
• Users are urged to update their devices and eliminate outdated pairings.
• Individuals at high risk should contemplate using wired headphones.

Identifying the Vulnerability

Experts from Germany’s Enno Rey Netzwerke (ERNW) have identified serious flaws in a commonly used Bluetooth system-on-a-chip (SoC). This vulnerability permits potential intruders to indirectly compromise smartphones by leveraging Bluetooth Classic and Bluetooth Low Energy connections, assuming they are in close proximity.

Covert Connection and Eavesdropping

The detected vulnerabilities enable attackers to silently connect to Bluetooth headphones and activate their microphones without user approval. This presents a major risk as attackers may overhear conversations and gather confidential information.

Exploiting the RACE Protocol

An additional critical element of the vulnerability is the exposure of the Remote Access Control Engine (RACE) protocol utilized in Airoha chips. By having access to this protocol, attackers can dump the permanent flash memory of headphones and extract digital link keys, allowing for unauthorized Bluetooth connections.

Effects on Mobile Devices

Once the keys are extracted, attackers can manipulate mobile phones, deceiving them into thinking they are interacting with a legitimate Bluetooth device. This vulnerability also makes it possible for them to summon voice assistants like Siri and Google Assistant to send texts, initiate calls, and execute various tasks.

Extensive Range of Impacted Devices

The Airoha SoC is frequently found in devices from notable brands such as Sony and JBL, exposing a wide array of headphones to these vulnerabilities. In contrast, Apple’s AirPods, which use a proprietary Bluetooth SoC, remain unaffected.

Mitigation Strategies and Suggestions

Airoha has been alerted and has provided an updated software development kit (SDK) to alleviate these vulnerabilities. Users are highly encouraged to promptly update their devices and clear any old or redundant Bluetooth pairings to minimize the risk of infiltration.

Specific Advice for High-Risk Individuals

For those in delicate roles, such as journalists, diplomats, and politicians, ERNW researchers recommend the use of wired headphones as a safer alternative to prevent possible attacks.

Conclusion

This recently discovered Bluetooth vulnerability emphasizes the necessity for regular software updates and cautious usage of wireless devices. Given the extensive array of at-risk devices, proactive actions are essential for protecting personal and sensitive information.

Q: What is the main vulnerability that has been identified?

A: The vulnerability enables attackers to quietly connect to Bluetooth headphones and turn on their microphones, allowing for potential eavesdropping.

Q: Which devices are impacted by this vulnerability?

A: Devices incorporating the Airoha SoC, including headphones from brands such as Sony and JBL, are affected. Apple’s AirPods are not at risk.

Q: What steps can users take to safeguard themselves?

A: Users should update their devices to the latest software, remove old Bluetooth pairings, and consider using wired headphones if they are at heightened risk.

Q: How did the researchers respond to the vulnerability?

A: The researchers notified Airoha, which subsequently released an updated SDK to address the vulnerabilities.

Q: Can attackers directly access smartphones through this vulnerability?

A: Indirectly, yes. By taking advantage of the Bluetooth connection, attackers can interact with the smartphone as though it were a trusted device.

Q: What is the RACE protocol, and why is it important?

A: The RACE protocol facilitates firmware updates and diagnostics within Airoha chips. Its exposure permits attackers to access memory and extract keys for unauthorized entry.