Update Your Headphones Now: A Critical Flaw in Google Fast Pair May Allow Hackers to Track Your Location
A team of researchers has uncovered a significant vulnerability in Google's Fast Pair technology, which could enable attackers to track a victim's location by hacking their headphones or speakers. The flaw, dubbed WhisperPair, affects Bluetooth headphones from various brands that support Fast Pair, including Sony, Google, OnePlus, Nothing, Xiaomi, Marshall, Anker, Jabra, and Harman.
The issue lies in how some brands have implemented the Fast Pair protocol. When a phone or laptop initiates pairing, it sends a message to the headphones. If the headphones are not in pairing mode, they should reject the request. However, researchers found that vulnerable devices fail to reject these requests, allowing unauthorized parties to complete the pairing process without the user's consent.
To carry out the WhisperPair attack, a hacker needs just about 10 seconds within 14 meters of the Bluetooth device. Once they gain access, they have full control over it. They can adjust the volume, change tracks, or even record conversations. What's more alarming, if the earbuds support Google's Find Hub network, they can also track the user's location.
The researchers shared their findings with Google in August and received a $15,000 bounty. They published their study after a 150-day non-disclosure window. Google has confirmed that the flaw was due to improper implementation and recommended fixes to manufacturers in September. The company assures that it has not seen evidence of any exploitation outside of the lab setting.
Both Google and the researchers advise at-risk users to install the latest firmware update for their audio devices. They emphasize that the only way to prevent WhisperPair attacks is by performing a software update.
Which Earbuds and Headphones Are At Risk?
Researchers have provided a list of at-risk models. The following devices are labeled as 'vulnerable' and should be updated: Anker Soundcore Liberty 4 NC, Jabra Elite 8 Active, JBL Tune Beam, Marshall Motif II ANC, Nothing Ear (a), OnePlus Nord Buds 3 Pro, Pixel Buds Pro 2, Redmi Buds 5 Pro, Sony WH-1000XM6, and Sony WF-1000XM5.
Additionally, some headphones are also affected: Sony WH-1000XM5, Sony WH-CH720N, and Sony WH-1000XM4.
