Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bluetooth Headphone Jacking: A Key to Your Phone [video]

media.ccc.de

Post reply on HN
Print view View original

161–170 of 228 posts

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#161

Post by abeyer »

bgbntty2 wrote: post #37
miduil wrote: post #13

Glad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of…

Remote audio surveillance probably be accomplished on wired headphones with TEMPEST [0]/Van Eck phreaking [1]. Not sure about which has a better range and which would be stealthier - TEMPEST or the Bluetooth attack. The Bluetooth attack just requires a laptop. Not sure if the TEMPEST attack would require a big antenna. [0] https://en.wikipedia.org/wiki/Tempest_(codename) [1] https://en.wikipedia.org/wiki/Van_Eck_phre…

Even if the TEMPEST were easier, it's significantly less powerful, as it's not going to get you the ability to write malicious firmware to the audio device nor a persistent connection to the host device when the audio device isn't connected.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#163

Post by mrheosuper »

amelius wrote: post #73
dijit wrote: post #3

And everyone got mad at OpenBSD for refusing to develop bluetooth. It’s a messy standard and we shouldn’t be surprised that the race to the bottom has left some major gaps.. though Sony WH1000’s are premium tier hardware and they have no real excuses.. I always wondered how people could justify the growth of the bluetooth headphone market in such a way.. Everyone seems to use bluetooth headphones exclusively (in Swed…

Honestly, can't we just ditch BT and send audio over WiFi? One thing less to worry about.

and enjoy your precious 1 hour of listening time.

The whole tcp/ip, wifi stack is at least a magnitude more complex than bluetooth one, and the wifi radio generally consumes more power.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#164

Post by mrheosuper »

astrange wrote: post #128
p0w3n3d wrote: post #63

Earlier quoted context omitted.

3$ adapter will have low quality DAC

The DAC in Apple's $10 adapter is higher quality than most "audiophile" DACs because Apple has a larger R&D budget and is better at manufacturing than the entire audiophile industry combined. Same for Google's, though it's slightly less good iirc. They aren't perfect - the maximum volume and impedance are pretty low so you do need an amp to electrically drive insensitive headphones.

nah, they are on par with other $10 chinese DAC, which is quite achievement for Apple tbh. I guess Apple decided to not apply "Apple tax" to those dongle.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#165

Post by mrheosuper »

TheAceOfHearts wrote: post #8

Haven't watched the video yet, but I think this capability was leaked by VP Kamala Harris during her recent interview with the Late Night Show [0]. She stated she doesn't use wireless headphones because she's been in security meetings and knows they're not safe. [0] https://youtu.be/BD8Nf09z_38 (Timestamp 18:40)

I guess what she was trying to say is "Anything wireless is bad in term of security". We don't really know whether the bad guy already has technology to decode wireless protocol we are going to use, so it's best to assume they already have and reduce the attack surface for them.

There is little encryption being done by bluetooth, while wifi, many layers add their own encryption to the data.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#166

Post by mrheosuper »

aziaziazi wrote: post #62
watermelon0 wrote: post #25

Earlier quoted context omitted.

I'd assume that most people wouldn't want to get back to wired headphones. Transition period was definitely rough, but nowadays bluetooth headphones are substantially better than they were in the past, and it's quite freeing to not have to deal with wires. There are definitely benefits to wired headphones, such as better audio quality and no battery life to worry about, but for those cases there are USB-C DACs.

Brand new devices' batteries are awesome but wear off and need to be changed at some point, if A) the device is designed to let you do that and B) the battery is still in production. You don't really own a wireless headphone. You can see it as a rent, or an ownership that loose its capability when in use.

>A) the device is designed to let you do that

This is simply wrong. Apple airpod was not designed to replace battery(they use tons of glue), yet many repair shop still offer service to replace battery for them.

>B) the battery is still in production

The industry is kind of converging into using standard "coil cell" battery for their headphone

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#167

Post by avidiax »

mi_lk wrote: post #51
miduil wrote: post #47

Earlier quoted context omitted.

the session (or pairing key) means you can both connect to the headphone or impersonate it. It can toggle the hands-free mode and listen to whatever is being talked, you'd notice that it has switched to the mode though - but if you're headphones are powered on and you're not listening to in they can be used for eavesdropping. During the talk they both demonstrate listening to the microphone and also receiving a Whats…

presumably, even in hands-free mode the attacker needs to be very close to the speaker to hear it

If you have a Bluetooth analyzer (e.g. Ellisys), then the link key and a directional antenna is all you need to passively eavesdrop on a conversation at a distance.

Of course, even regular omnidirectional Bluetooth antennas are plenty to eavesdrop through a hotel room door, from the hallway outside a conference room, etc.

An attacker can also passively record all the packets in an area (Ellisys allows recording all channels at the same time), and then actively gather link keys using this attack at any time to decrypt the stored conversations.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#168

Post by avidiax »

IshKebab wrote: post #32
miduil wrote: post #13

Glad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of…

Is this an unintentional vulnerability or is it one of those "we left it open because it's easier and we hoped nobody would notice" kind of things. I mean can you just send a "update to this firmware" command completely unauthenticated and it's like "yep sure"? No signing or anything?

IMO, it's plausible that Airoha and the OEMs did not know about this. The tooling may have been written in a pseudo-secure manner, i.e. requiring pairing (on the client side) before attempting all the debugging/firmware update commands. The tools may simply assume that pairing is required or only list targets from those that are paired and connected, which gives the illusion that the air protocol requires this.

All it really takes is some engineer missing an if-statement to check that the connection is bonded before processing the packets.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#169

Post by avidiax »

bgbntty2 wrote: post #37
miduil wrote: post #13

Glad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of…

Remote audio surveillance probably be accomplished on wired headphones with TEMPEST [0]/Van Eck phreaking [1]. Not sure about which has a better range and which would be stealthier - TEMPEST or the Bluetooth attack. The Bluetooth attack just requires a laptop. Not sure if the TEMPEST attack would require a big antenna. [0] https://en.wikipedia.org/wiki/Tempest_(codename) [1] https://en.wikipedia.org/wiki/Van_Eck_phre…

I doubt that audio-spectrum RF/magnetic frequencies emanate strongly from wired headphones. They are simply not a long enough antenna at 200-3,000 Hz. Also, the loop area is quite low. The ground wire runs parallel to the L/R wires, so the only loop to receive is the magnetic coils in the headphones, which are small. Only near field would work, IMO.

Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]

#170

Post by avidiax »

willnix wrote: post #110
miduil wrote: post #13

Glad this submission is finally receiving upvotes. This was just shown at the 39C3 in Hamburg, few days back. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ... > Examples of…

One of the researchers here. Many people seem to prefer text to videos, which I sympathize with. So please excuse me hijacking the top comment with links to our blog post and white paper: Blog: https://insinuator.net/2025/12/bluetooth-headphone-jacking-f... Paper: https://ernw.de/en/publications.html

Did you look into whether the spoofed device can also be "upgraded" to be used as an HID device, like a mouse or keyboard? That upgrade would be several CVEs against the OS vendors.

That would make the attacks potentially silent, since the attacked could simulate keypresses to dismiss notifications, or can at least keep the target unable to respond by spamming home/back or pressing power and simulating a swipe to shutdown.

Post reply on HN