Hackers Can Hijack Earbuds to Spy

“The attacker now owns this device and can basically do whatever he wants with it.”

“Yes, we want to make our life easier and make our devices function more seamlessly. Convenience doesn’t immediately mean less secure. But in pursuit of convenience, we should not neglect security.”

“You’re walking down the street with your headphones on, you’re listening to some music. In less than 15 seconds, we can hijack your device. Which means that I can turn on the microphone and listen to your ambient sound. I can inject audio. I can track your location.”

“We are constantly evaluating and enhancing Fast Pair and Find Hub security.”

“Xiaomi has been in communication with Google and other relevant parties and working with suppliers to roll out [over-the-air] updates. We have confirmed internally that the issue you referenced was caused by a non-standard configuration by chip suppliers in relation to the Google Fast Pair protocol.”

“Google has advised JBL about potential security vulnerabilities that could impact devices including headphones and speakers. We have received the security patches from Google and the software will be updated via JBL apps over the next few weeks.”