I was able to totally remotely, over the air, upload a custom firmware to my speaker which I hadn’t paired with, which would reboot, flash the custom firmware, and after rebooting type in the command echo pwned and execute it.
So an attacker can hack someone else's speaker, turn it into a keyboard to the paired PC, and from there attack the paired PC.
"Without being touched" seems unnecessary. That's one possible definition for computers: completing tasks that do not require manual intervention. Automation.
BTW the real culprit here isn’t the USB connection but Creative’s proprietary but totally unprotected transfer protocol that allows third parties to communicate with the device both ways, even load new firmware. No code signing there, either.
I miss when Creative Labs meant you were buying a top notch sound card.
It's just crazy how many Bluetooth devices have broken (or completely absent) authentication and pairing security.
It's very difficult to tell when they're encrypted, too. Your Bluetooth keyboard and mouse could be broadcasting everything keystroke and click unencrypted to anyone within 100m or so.
And that's just the accessories. There have been tons of exploits of phone and computer firmware over the years as well. Security is an afterthought at best with Bluetooth.
$300 for a PC speaker? Madness.
Tittel is misleading as this a variant of BadUSB where a device act as keyboard device.
And i agree and prefer that user is able to replace firmware.
top 3 comments