Flaws in how 17 models of headphones and speakers use Google’s one-tap Fast Pair Bluetooth protocol have left devices open to eavesdroppers and stalkers.
Link to see devices impacted: https://whisperpair.eu/
Did anyone else get a “page not found” error when trying to see the list of affected headphones?
Edit: spelling.
The website works on my end
I clicked on your link. Same thing. I’m using duck such go. Wonder if that’s why.
Affected*
Damn it. I knew that too. Thanks for pointing it out.
Placing a bet now: under 10% of vulnerable units will be patched within a year’s time.
I like your optimism.
the rest of the 90% of the devices are probably broken since they are so cheaply made and designed to snap or have garbage batteries that can’t hold a charge for more then 20 minutes .
My wired headphones dont have this issue, likely sound far better, require no batteries, and are user serviceable.
Guys, we peaked in 2012 (potentially earlier) as a race technologically, stop trying to create new grifts for billionaires.
We all laughed at the time, but The Matrix was right - civilization peaked in 1999.
I love not having to worry about charging my headphones. I had wireless for years but I went back to wired.
I don’t find this being an issue when I have to charge it maybe once a month. Not talking about IEMs of course.
My issue was needing them when they didn’t have a charge or had low charge, and not being able to charge them while using them.
I ended up getting one that could still be used when plugged in via usb (micro heh), just like wireless mice.
But either way, the sound quality, no matter how hard it tries, is crap compared to a good analogue headset.
“But that wire…”
- some techno gusher probably.
Sennheiser hd630 is amazing. I use my technics az80 at work to block noise and appreciate having no wires getting caught up on mechanical stuff.
Laughs in the archaic technology of the 3.5mm audio jack
All the more reason to use my IEMs… At least when I’m not flying.
laughs in 3.5mm
Laughs in 6.3 mm
But you need to be in close proximity (~15m max) to stalk a victim? You might as well just follow them around physically then. Perhaps when the victim is in a private location, eavesdrop on their conversation or locating their position within there, might be a possibility. But ear raping would, of course, constitute the most significant danger of all. Also WhisperPair, not WhisPair?
If you want to listen to their mic via bluetooth or whatever, yes. But there’s also this:
Some devices also support Google’s Find Hub network. This enables users to find their lost accessories using crowdsourced location reports from other Android devices. However, if an accessory has never been paired with an Android device, an attacker can add the accessory using their own Google account. This allows the attacker to track the user via the compromised accessory.
If the devices weren’t previously linked to a Google account … then a hacker could … also link it to their Google account.
This already severely limits the pool of potential victims; but still a more practical exploit indeed. It’s almost as if this BLE tracking is a feature, rather than an exploit. And if you want to be notified of a device following you around, one has to perpetually enable BLE on their smartphone. But of course, headphone jacks are a thing of the past, and wireless is clearly the future. :)
By all means call out if I’ve misunderstood, but the tracking vulnerability isn’t that BLE (by design) makes devices visible to everyone within range, it’s that by binding an unclaimed device to an account you gain the ability to look up that device via Google’s service, rather than needing to be nearby - you can simply ask Google to call on its global network to find “your” device. In other words, there’s nothing stopping me from setting an alert when a given BT device is nearby, that’s spot on, but I can’t fire up Google to look up that device when I’m not nearby, or look up its location history.
And yes needing to have never been connected to an Android device definitely reduces the victim pool, but (and to address the other reply) I’m guessing it’d mean devices that have only ever been connected to iOS, Linux, Windows etc aren’t “claimed” and can still be enrolled by the attacker. It’s not about default creds, only having used devices that don’t enrol with Google is enough, as it leaves the device available to claim.
3.5mm ftw and all that, but I doubt all the parents of teenagers with potentially vulnerable devices will have much luck convincing their kids to switch!
I understand you’ve read the comment as a single thing, mainly because it is. However, the BLE part is an additional piece of critique, which is not directly related to this specific exploit; neither is the tangent on the headphone jack “substitution”. It’s, indeed, this fast pairing feature, which is the subject of the discussed exploit; so you understood that correctly (or I misunderstood it too…).
I’m however of the opinion, BLE being a major attack vector, by design. These are IoT devices that, especially when “find my device” is enabled (which in many cases isn’t even optional: “turned off” iPhones for example), do announce themselves periodically to the surrounding mesh, allowing for the precise location of these devices; and therefore also the persons carrying them. If bad actors gain access, to for example Google’s Sensorvault (legally in the case of state-actors), or would find ways of building such databases themselves; then I’d argue you’re in serious waters. Is it a convenient feature, to help one relocate lost devices? Yes. But this nice-to-have, also comes with this serious downside, which I believe doesn’t even near justify the means. Rob Braxman has a decent video about the subject if you’re interested.
It’s not even a case of kids not wanting to switch, most devices don’t even come with 3.5mm jack connectors anymore…
Gotcha, and apologies for missing your point.
I agree 100%, the privacy and security tradeoffs are enormous and concerning.
No worries! :)
That’s literally any device. Goes all the way back to things like people setting up routers and not changing the default password so anyone else can get in. That’s just user error plain and simple.
