Hacker News

Hacking your PC using your speaker without ever touching it

63 points by xx_ns 49 minutes ago | 13 comments

hootz 23 minutes ago

>Email from SingCERT stating vendor "do not consider this to be a vulnerability, as it does not present a cybersecurity risk."

So wirelessly writing custom firmware to someone else's device that is connected via USB to their computer without even needing to pair is not a security vulnerability. Yea.

Uncle_Brumpus 17 minutes ago

"You can just make it type words, what's the risk in that?"

Makes you wonder what other peripheral companies out there are also operating with seemingly no security team. There must be other vulnerabilities like this just waiting to be discovered.

My brother was awoken one morning at 2am because some neighborhood kids connected to his bluetooth speaker and blasted fart sounds on loop at max volume, and that's literally only the absolute tippy top of the malicious bluetooth use iceberg.

hootz 11 minutes ago

Oh yeah, for some reason the companies with the highest risk products seem to be the ones that care less about security. Don't even get me started with "smart" bulbs and cameras that each individually connect to your local network and the Internet. You have 5 lightbulbs? That's 5 different devices you need to track, keep updated and trust the in the vendor firmware's security.

rcxdude 6 minutes ago

Probably most of them. It's not exactly an area with a great focus on quality, let alone security.

xnickb 3 minutes ago

Yeah, but we already sold the device, so it's someone else's problem. Now if they were paying us a subscription fee..

KurSix 9 minutes ago

The vendor response is the more worrying part

3form 18 minutes ago

AND being able to further reprogram the device to gain control of the PC.

This is negligence of the highest kind.

brogapp 3 minutes ago

Thanks for sharing this. It’s a bit concerning that a consumer soundbar can receive unauthenticated firmware over BLE and then act like a BadUSB-style HID on the host. I’m not sure I agree with the vendor’s "no cybersecurity risk" assessment, considering how much access a trusted keyboard interface typically has.

217 38 minutes ago

Can't wait to see a video from a half sloppy channel about this on my youtube front page in roughly 4 business days

tarcon 6 minutes ago

I guess you can still be first to Linkedin and get all of the fame.

KurSix 11 minutes ago

The fact that the author had to publish a third-party patch because the vendor didn't consider it a vulnerability is not a great look

awedisee 6 minutes ago

Way cool. Thank you for sharing

bradley13 28 minutes ago

Good work, and fun to read.

It's crazy that companies just stick their head in the sand, when confronted with serious security issues.