A (29:58)
All righty, folks. Up next, I've got a little story of the weekend, then an interview about Apple's next Vision Pro feature feature set. Well, we'll, we'll explain it when we get there. But let me go ahead and tell you about the story of the week that came across my desk and definitely caught my attention. It's a new report in Wired by Andy Greenberg and Lily Hay Newman reveals hundreds of millions of Bluetooth audio devices, earbuds, headphones, speakers from major brands like Sony, Google, JBL and Jabra are vulnerable to wireless hacking and tracking due to flaws in Google's Fast Pair protocol. Now researchers at Belgium's KU Leuven University have discovered that the very feature designed to make Bluetooth pairing seamless with a single tap has inadvertently left those devices open to attackers who can hijack audio streams, activate microphones for eavesdrop, and even track victims locations, all without the user's knowledge. The collection of vulnerabilities dubbed Whisper pair affects 17 audio accessories from 10 different companies. And while patches are being rolled out, researchers who worked on this say, look, most consumers are probably not going to install them. Yeah. So let's kind of break into the Whisper pair attack, how it works, what it does. The security researchers found these vulnerabilities and then together again calling them Whisper Pair. And it allows anyone that's within Bluetooth range, so about 50ft or closer, they can silently pair with the audio device and take control of them. So what does that mean when it comes to taking control over them? Well, you can take over disrupt audio streams and phone conversations. You can play audio that you choose. The victim's earbuds or the speakers at any volume. You can also this is pretty scary. Undetectably activate microphones to listen to the victim's surroundings and track the victim's location using Google's Find Hub feature. That one is a big issue for sure. The the reason why this is going on is because of Google's Fast Pair protocol course, designed for convenience. We're always looking at sort of convenience versus security and trying to find a balance there, which allows Bluetooth devices to connect with Android and Chrome OS devices just with one tap. But the protocol specification states that devices should not be able to pair with a new computer or phone while they're already paired to another. So the Fast Pair protocols spec says this is the case. Do not let it pair with another one. But the Researchers found that 17 devices ignored this requirement entirely, which gave anyone the ability to silently pair with a target device even when it's already connected to someone else's. So to execute the attack, the hacker only needs to be within Bluetooth range and have what's called a model ID value that's specific to the target device model. So not to the target device, but the device model. So these IDs are easy to obtain. First, they can be obtained by purchasing the same model of device. They can also be obtained by attempting to pair with a device because some of them will broadcast their model id. And they can also be obtained by querying a publicly available Google API that contains model IDs for all fast Pair devices. The researchers tested their technique using a little Raspberry PI 4 and attempted to pair with 25 different already paired fast pair devices from these 16 vendors. And the majority of all of these devices were vulnerable. The takeovers took about 10 to 15 seconds, and they did it at 46ft away. So, you know, rounding up to 50 there, that, on its own, again, is troubling. But if it's just a matter of being able to play audio right over the headphones or cut off somebody's audio, that's sort of just silly little pranks. It's listening in on the microphone and the big one, which is the location thing. Whisper Pair involves Google's Find Hub feature. So the Google Pixel Buds Pro 2 and 5 models of Sony earbuds and headphones had this vulnerability. If the devices weren't previously linked to a Google account because they were maybe used with an iPhone, and so they in that case don't have Google account linkage, then the hackers could use Whisper Pair to pair with the device and then link it to their own Google account, then all they have to do is open up FindHub and they would be able to track the location of this device wherever it goes. So, yeah, also not great. Here's where things stand in terms of the companies involved. Researchers identified vulnerable devices From Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech, and Google itself. Now Google, for its part, acknowledged the findings and said it had worked with researchers to fix their vulnerabilities. This is what the Google spokesperson said, quote, we worked with these researchers to fix these vulnerabilities and we have not seen evidence of any exploitation outside of this report's lab settings. We are constantly evaluating and enhancing Fast Pair and Find Hub security. That said, within hours of Google informing the researchers about a patch to prevent FindHub tracking, the researchers told Wired that they had already found a bypass and were still able to carry out their tracking technique. So to be clear, the patch, according to the researchers, did not actually fix the problem. As far as other vendors, Xiaomi said it's working with suppliers to roll out over the air updates to its earbuds. JBL said that it actually received security patches from Google and then will update the software via JBL apps, quote, over the next few weeks. This one kind of was like, okay, Logitech said it has integrated a firmware patch for upcoming production units. So what about the ones that are already out there? OnePlus said it's looking into the issue. And then Marshall, nothing is in the company. And Sony did not respond to WIRED's request for comment. Now again, the patch that was rolled out was able to be circumvented. Google may then roll out another patch that better fixes the problem, but it's still a matter of getting the patches installed on these devices. As one of the security researchers says, if you don't have the app from Sony, then you'll never know that there's a software update for your Sony headphones and then you'll still be vulnerable because most consumers are probably not thinking about updating their earbuds or their speakers or even know that that's part of it. And so it's one of these issues where this is a problem that's going to exist for who knows how long, you know, as long as people have these devices. I know for me, I love to get a new firmware update, so I'm always like, oh, let me go find whatever app is tied to these headphones and get that installed. But that's not the way that everybody is thinking about it. And as is the case with, I never would have thought about having my audio connected to an iPhone. And because I didn't connect it to an Android device, I didn't know that it could be linked to a Google account, for example. So then because I'm using it over here, I am making myself vulnerable to something on the other platform that's pretty, pretty upsetting as far as this goes. We don't see a way to turn Fast Pair off. So because of that, unless you install the patches and Google continues to work on the patches to make them truly fixed, this is an ongoing issue that people will be dealing with. The researchers have created a website that has a list of devices affected by Whisper Pair. Head there, check to see if your devices are vulnerable and then look for an update. And if you don't have an update, reach out to the manufacturer and tell them that you want an update and you want it now so that people are not accessing your microphone and and tracking your location or changing your music from something you want to listen to to something you don't want to listen to. That is the my story of the week this week. Let us move along next to this week's interview. Hey, so we're in the final stretch of the 2026 audience survey, and I don't know if you know this, but every time one of you fills out the survey, it gets a couple of degrees warmer here. We could use it if you haven't filled it out. This is the moment. The survey closes on January 31st. So head to TWiT TV Survey 26 because your feedback actually helps us improve every single one of our shows. Thanks so much for taking the time. Wait. Honestly, a few of you must have done it. It's getting a little warmer in here. Thank you. Survey 26 TWiT TV Survey 26 Apple's Vision Pro has, I think, for some time been searching for its killer feature ever since its launch. And is it possible that Spectrum Front Row might just be it? The feature lets you sit courtside at an NBA game. No plane ticket, no nosebleed seats, just you and the best view inside of your house, at least. ZDNet's Carry One recently strapped on the headset and watched a full Lakers game in VR to see if the experience lives up to the promise. Joining us today to talk about it is, in fact ZDNet's Carrie 1. Welcome to the show. Hello.
