Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwnd Blaster: Hacking your PC using your speaker without ever touching it

blog.nns.ee

Post reply on HN
Print view View original

121–130 of 133 posts

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#121

Post by RobMurray »

zahlman wrote: post #28
hootz wrote: post #8

Earlier quoted context omitted.

Oh yeah, for some reason the companies with the highest risk products seem to be the ones that care less about security. Don't even get me started with "smart" bulbs and cameras that each individually connect to your local network and the Internet. You have 5 lightbulbs? That's 5 different devices you need to track, keep updated and trust the in the vendor firmware's security.

> "smart" bulbs Thankfully I don't think I've seen these for sale. What sensors would they have that could be exploited by an attacker?

wifi, bluetooth, and microphones. Yes microphones. I have a very cheap smart bulb with a mode that responds to music. That's not even unusual for smart bulbs.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#122

Post by RobMurray »

segmondy wrote: post #42
KurSix wrote: post #7

The fact that the author had to publish a third-party patch because the vendor didn't consider it a vulnerability is not a great look

Are you surprised? Great hack by the author, the impact could be huge if someone is targeted, but overall the impact is very minimal. The vendor can't be bothered. For you to be a victim, you have to own this device, and your attack has to know that and be within a close proximity. Remember that fight club quote? A = The number of speakers in the field. B = The probable rate of getting hacked. C = The average out-of-…

No need to issue a recall, they could just release a firmware update that disables unauthenticated firmware updates over BLE.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#123

Post by pbhjpbhj »

JdeBP wrote: post #89
NooneAtAll3 wrote: post #61

what ways are there to protect from malicious HID device?

My computers ignore USB HIDs other than the ones that I have explicitly permitted. Unfortunately, this is a major architectural revamp for many operating systems. The idea that every HID is automatically added to a keyboard/mouse 'multiplexer', that provides a single combined input stream, is a pervasive one.

Some sort of USB firewall? Something you can share?

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#124

Post by pbhjpbhj »

So presumably this is cured with device permissions, 'this device may only receive audio data; return confirmations', say. And those Lorraine would need to be at BIOS level, like enrolling devices into SecureBoot, because otherwise for keyboards and mouses you're left with a chicken-egg problem.

Or? There's other mitigations that OS already have in place?

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#125

Post by evilos »

debugnik wrote: post #119
evilos wrote: post #109

It's funny to see all the commenters who didn't read the article closely enough or at all. This is basically the bluetooth device equivalent of "left S3 bucket open to public". That said, really cool work. I honestly thought it would be harder to turn a usb connected device into an exploit vector. That it's as easy as emulating a keyboard that pops a local terminal and runs a malicious command is actually pretty funn…

I assume the malicious HID keyboard can press through the UAC prompt on its own, just like the user's actual one can.

That's a fantastic point haha, I've never tried it myself.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#126

Post by JdeBP »

pbhjpbhj wrote: post #123
JdeBP wrote: post #89

Earlier quoted context omitted.

My computers ignore USB HIDs other than the ones that I have explicitly permitted. Unfortunately, this is a major architectural revamp for many operating systems. The idea that every HID is automatically added to a keyboard/mouse 'multiplexer', that provides a single combined input stream, is a pervasive one.

Some sort of USB firewall? Something you can share?

No. The multiplexers are all turned off, and I have devd/udev rules that spawn my own userspace driver processes (as services, via service management) to attach to the individual USB devices. The driver services in turn use an autoconfiguration system to determine whether they should actually attach to the device whose name they are passed, and where they should pass input onwards to.

* https://jdebp.uk/Softwares/nosh/guide/user-virtual-terminal-...

* https://jdebp.uk/Softwares/nosh/guide/commands/user-vt-reali...

This is for a virtual terminal system. For X11 or Wayland, one would have to replicate the same idea in an appropriate form, and stop using the multiplexed devices.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#127

Post by hulitu »

rkagerer wrote: post #99

This is a well written article and easy to digest, worth a skim. In summary he figured out how to reflash arbitrary firmware on a Creative Sound Blaster Katana V2X soundbar via Bluetooth, without requiring any effective authentication or user interaction. The soundbar is plugged directly into its host computer via USB, so by adding a descriptor to its firmware he made it recognized as a keyboard. From there it was st…

> This is a well written article

But the headline is enshitified.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#128

Post by sebastiennight »

samtheDamned wrote: post #108
sebastiennight wrote: post #95

Earlier quoted context omitted.

> Regular bulbs are still much more common on store shelves, because why fix what isn't broken? TV manufacturers might want to differ.

If we could started teaching Morse Code in standard curriculum then in about 18 years or so we could finally subsidize smart lightbulbs with blinking ads for products and then we could stop selling pesky "dumb" bulbs.

You're underestimating the potential of subsidizing smart bulbs with data collection. Someone smart is getting paid a lot right now somewhere to figure this out.

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#129

Post by fsckboy »

Jolter wrote: post #103
fsckboy wrote: post #97

Earlier quoted context omitted.

where do you turn that off?

In the mobile app, it’s under Settings -> Manage history Not that hard to guess, right? ;)

oooh, i wouldn't dream of installing the app, i use browser only

Re: Pwnd Blaster: Hacking your PC using your speaker without ever touching it

#130

Post by semiquaver »

necovek wrote: post #96
semiquaver wrote: post #64

Earlier quoted context omitted.

In reality, even if they did recognize the severity of this problem, they likely view the cost to remediate it as prohibitive, as it would involve reworking their whole weird janky system. So better to pretend they don’t have to deal with security.

This is why governments need to — and are — stepping in with things loke Cyber Resilience Act in EU. If this product continues to sell in EU after Dec 2027, they will have an obligation to update.

Easy fix from the company’s point of view: make product lifecycles one year tops.
Post reply on HN