Top
Best
New

Posted by AndrewDucker 1/1/2026

Bluetooth Headphone Jacking: A Key to Your Phone [video](media.ccc.de)
551 points | 223 commentspage 2
wojciii 1/1/2026|
This is probably going to make some state actors unhappy.
amelius 1/1/2026|
Probably a combination of happy and unhappy, depending on which state actor, and who knew about the exploit.
amelius 1/1/2026||
> We also demonstrate how a compromised Bluetooth peripheral can be abused to attack paired devices, like smartphones, due to their trust relationship with the peripheral.

Can't watch the video now. But I wonder to what extent they can take over a smartphone? Can they make a headphone look like a keyboard/mouse, for example?

Second question: can the whole problem be remedied by installing a firmware update?

bethekidyouwant 1/1/2026||
This is just a chip with debug mode left on and does not allow anyone to hijack audio stream or anything interesting. (Just in case anyone’s checking the comments because they don’t want to watch a long ass video and they notice all the comments are essentially off topic)
jogu 1/2/2026|
Sounds like you should have actually watched the “long ass video”.

It allows the pairing key to be exfiltrated from the compromised device and an external, attacker controlled device to perform any function the original device could. This includes retrieving the paired devices phone number, answering phone calls, and receiving the audio. They live demo hijacking a whatsapp account using this.

bethekidyouwant 1/2/2026||
Neat. It appears my headphones have to be in pairing mode. Which is a very short window, at which point the attacker can impersonate your device. this allows him to answer phone calls for you or make phone calls, but you would notice right away. It’s not like cloning the audio and eves dropping. so yeah it’s a nothing burger.
jogu 1/2/2026||
Some devices are/were only vulnerable during the initial pairing but a key point from this talk was that most of these devices were vulnerable during normal use.

The RACE protocol could be accessed even if the device isn’t in pairing mode. Then once you have a target device’s key you can carry out the attack at anytime, when they’d be unlikely to notice.

bethekidyouwant 1/2/2026||
If you have the target device key, you can impersonate the device later. But how do you get the device key in the real world? I would need to be in pairing mode for you to get it. Even if you did get it, then you can answer my calls if you are next to me, which in the real world is certainly noticeable.
JCattheATM 1/3/2026||
> I would need to be in pairing mode for you to get it.

No, that doesn't seem to be the case.

> then you can answer my calls if you are next to me, which in the real world is certainly noticeable.

You may not notice if the call was answered automatically and you didn't have your device on you, and the call could be forwarded with acceptable latency so the speech wouldn't be in earshot. Or these days you could use an AI to generate voice and it would sound realistic.

Just because something isn't likely to affect ordinary citizens doesn't mean it isn't possible.

pwagland 1/2/2026||
Is there a fuller list of headsets that are affected being maintained anywhere? I could not find it. Since most manufacturers tend to reuse components, we can expect that more Sony stuff is affected, and probably more JBL/Jabra/Bose/Marshall that they didn't have access to.

Based on their timeline, full credit to Beyerdynamic!

Partial credit to Airoha, they took a long time to initiate the communications, but once they did, they seemed to take it seriously.

No credit to Sony and Marshall, as they either didn't, or effectively didn't, respond.

Unknown credit to Bose, JBL, Jabril, EarisMax, MoerLabs, and Teufel, as they don't appear in the timeline.

brohee 1/1/2026||
You'd think Sony would have learned from the PSN debacle, but alas...

Now I need to setup to check if my headphones are still vulnerable...

karlzt 1/2/2026||
IMO anything related to Bluetooth should be destroyed.

https://www.bleepingcomputer.com/news/security/undocumented-...

epakai 1/1/2026||
Razer isn't mentioned, but I know they're using Airoha AB1571DN in Blackshark V3 Pro transmitter. Not sure what is on the headset end.

Don't see any mentions on their last firmware update, and I can't find older ones.

jogu 1/2/2026|
Important to note that usage of an Airoha chip doesn’t imply being vulnerable, so each device has to be checked individually.

It’s possible they weren’t vulnerable to begin with, it’s also possible they silently patched it.

raverbashing 1/1/2026||
Ah yes, the removal of headphone jacks, the gift that keeps on giving

Funny that there were always some people here pushing bt audio as "the future", whom I can only assume were the technically shallow but very opinionated people that would die on the smallest technical hills

watermelon0 1/1/2026||
I'd assume that most people wouldn't want to get back to wired headphones.

Transition period was definitely rough, but nowadays bluetooth headphones are substantially better than they were in the past, and it's quite freeing to not have to deal with wires.

There are definitely benefits to wired headphones, such as better audio quality and no battery life to worry about, but for those cases there are USB-C DACs.

throwaway81523 1/1/2026|||
I still use wired headphones. This bluetooth vulnerability makes me laugh.

https://biggaybunny.tumblr.com/post/166787080920/tech-enthus...

aziaziazi 1/1/2026|||
Brand new devices' batteries are awesome but wear off and need to be changed at some point, if A) the device is designed to let you do that and B) the battery is still in production.

You don't really own a wireless headphone. You can see it as a rent, or an ownership that loose its capability when in use.

cyberrock 1/1/2026|||
It's not like wired earbuds/headphones are invincible either. I've had a few wired ones lost due to cable damage, which constitutes more casualties than my wireless inventory, including noticeable charge loss. Of course, there are a lot more cheap wired options with replaceable cables now, thanks to Moondrop and gang.

I really wish the debate was more than jack vs Bluetooth, and more wired fans would consider supporting devices with multiple USB-C ports. Yeah, Sony still puts a jack on Xperias, but most audiophiles note that it's driven by Snapdragon's mediocre integrated DAC, possibly because Sony doesn't want it to compete with Walkmans. Yeah, Valve puts a jack on the Steam Deck, but SD OLED's jack has interference issues that users need to fix with electrical tape or loosening screws. If these devices had two USB ports, then it would be easy to use a better DAC with no interference issues (while also charging with a cable attached to the other port). Having a second USB port would increase device life, and tie wired earbuds/headphones to a more durable standard that's actively developed and backed by legislation. We know this is possible for phones because ASUS ROG Phone has 2 USB ports.

mrheosuper 1/2/2026||||
>A) the device is designed to let you do that

This is simply wrong. Apple airpod was not designed to replace battery(they use tons of glue), yet many repair shop still offer service to replace battery for them.

>B) the battery is still in production

The industry is kind of converging into using standard "coil cell" battery for their headphone

kccqzy 1/1/2026||||
The word you are looking for is not “rent” but depreciation.
krick 1/2/2026|||
Sure, but I am totally willing to make that tradeoff, and when my earbuds die, I buy new wireless earbuds, not permanently switch to some wired headphones I have lying around (mostly just in case, to not be left hanging if my earbuds suddenly die). I didn't know that before I started using wireless stuff, but now I do. Because, you know, I can change my T-shirt, maybe even take a shower, and start cooking something in the kitchen without pausing that audiobook, all while my phone is charging in another room.

I am even cautiously aware that people have lost their hearing, because damn LiOH exploded in their ear. That's much scarier than knowing I will have to buy new earbuds in a couple of years. Didn't stop me using them either.

NoiseBert69 1/1/2026||
Thanks god the headphone jacks died in smartphones.

I switched to USB-C soundcard cables which are dirt cheap and survive much much more plug-unplug-cycles. They easily can be replaced.

raverbashing 1/1/2026|||
The epidemic of people not wearing headphones has been directly caused by the lack of headphone jacks
Findecanor 1/1/2026|||
I find that people speaking very loudly into their wireless headsets wherever they are and whomever they are with is a bigger nuisance.

When you speak to someone in person, you'd adjust the volume of your voice to the room and the recipient without thinking about doing it. The engineers who built the analogue phone system were aware of this effect, and made it so that you heard yourself in the handset's speaker. The engineers who designed the cell phone standards decided to ignore this so they could do more echo-cancellation.

It is not a big problem when people are speaking into a slate-shaped cell phone, but when people wear headphones that attenuates their own voice, they hear themselves less and speak extra loudly to compensate.

j1elo 1/1/2026||||
A couple days ago there was a bit of a conversation about this, you might find it interesting. It seems this feeling (to the point of calling it an "epidemic"!) might be caused by the known bias of thinking that earlier times were better:

https://news.ycombinator.com/item?id=46424228

aidenn0 1/2/2026||||
I see more people with headphones now that BT headphones are everywhere...
ffguhv 1/1/2026|||
LOL. People not using headphones in public are narcissistic a-holes, but they’ve been doing it since *long* before headphone jacks went missing from smartphones.
conception 1/1/2026||
It’s even noted as a problem in the beloved, acclaimed piece of cinema - Star Trek IV : The Voyage Home.
Lammy 1/2/2026|||
USB-C is creepy in its own way, because it lets the host computer uniquely identify each pair of headphones. Even my USB-C-to-3.5mm adapter has a USB descriptor field whose key is a UUID and whose value is the adapter's manufacture time in an ISO timestamp down to the second it got programmed at the factory.
sva_ 1/1/2026||
I previously posted the repo here:

https://news.ycombinator.com/item?id=46406310

jader201 1/1/2026|
Why not just link to the repo directly? That post only has one comment.

Here’s the repo (to save everyone a click):

https://github.com/auracast-research/race-toolkit

sva_ 1/2/2026||
It is somewhat of a custom that the person who posts about a thing first gets the Karma, but it is seldom respected, and I won't beg for it. But I do sometimes hint at it.
pabs3 1/4/2026|
Wonder if anyone is going to replace the proprietary buggy firmware with libre firmware.
More comments...