Researchers disclose WhisperPair flaw that can expose Fast Pair headphones to eavesdropping
Summary
Researchers say WhisperPair lets attackers remotely hijack some Fast Pair audio devices for microphone access and location tracking. More than a dozen devices are affected; Google says Pixel Buds Pro 2 are patched, while other fixes may take longer.
Key points
- The KU Leuven researchers say the flaw affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus and Google.
- Affected devices may accept a Fast Pair connection request when they are not in pairing mode, allowing an attacker to force a connection through regular Bluetooth pairing.
- Researchers report a median takeover time of 10 seconds and a range of up to 14 meters.
- They say an attacker can interrupt or play audio and access the device microphone or track its location.
- Google says it is not aware of WhisperPair being exploited in the wild.
- Google says it issued a full patch for Pixel Buds Pro 2; updates for other affected accessories depend on their manufacturers. Researchers reportedly found a workaround for an earlier, partial phone update.
- The article recommends keeping the device’s companion app installed for firmware updates; a factory reset can force an attacker to repeat the hack.
Article Details
- Vulnerability Types
- Fast Pair pairing-mode validation failure allowing unauthorized Bluetooth pairing
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Install and keep the companion app available to receive firmware updates.
- Factory-reset the headphones if compromise is suspected; the article says this forces an attacker to redo the hack.
MITRE ATT&CK
Vendors
GooglePairing Bluetooth devices can be a pain, but Google Fast Pair makes it almost seamless.JBLThe bug affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.NothingThe bug affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.OnePlusThe bug affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.SonyThe bug affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.