Skip to content

Zero-day: Bluetooth gap turns millions of headphones into listening stations

Technology
123 88 2
  • Now here's the amazing bit: imagine being able to do that without needing to carry an additional thing around.

    I guess I'm used to it. Besides, imagine not using a cable at all--even better?

  • I guess I'm used to it. Besides, imagine not using a cable at all--even better?

    I can insert a cable faster into my phone than most Bluetooth headphones connect. Audio quality also tends to be better with wired headphones and uses less of the battery power. A lot of the times a dedicated single use port is much better than a jack of all trades port.

  • The flaws, discovered by German cybersecurity firm ERNW and first reported by Heise Online, affect dozens of headphone models from brands such as Sony, JBL, Bose, and Marshall, with no comprehensive firmware fixes available yet.

    • Sony WH-1000XM4/5/6, WF-1000XM3/4/5, LinkBuds S, ULT Wear, CH-720N, C500, C510-GFP, XB910N
    • Marshall ACTON III, MAJOR V, MINOR IV, MOTIF II, STANMORE III, WOBURN III
    • JBL Live Buds 3, Endurance Race 2
    • Jabra Elite 8 Active
    • Bose QuietComfort Earbuds
    • Beyerdynamic Amiron 300
    • Jlab Epic Air Sport ANC
    • Teufel Airy TWS 2
    • MoerLabs EchoBeatz
    • Xiaomi Redmi Buds 5 Pro
    • earisMax Bluetooth Auracast Sender

    ERNW emphasizes that this is only a partial list.

    Source

    wf-1000XM3 connected, playing Cissy Strut

    Guess I'm lucky to have broken the mics on mine by accidentally throwing them in the wash?

  • I can insert a cable faster into my phone than most Bluetooth headphones connect. Audio quality also tends to be better with wired headphones and uses less of the battery power. A lot of the times a dedicated single use port is much better than a jack of all trades port.

    3.5mm is by far the better option for literally every reason headphones are designed for

    the only argument is when exercising, some people prefer to use wireless for the kinda of workouts they do

  • I mean, there were legitimate technical issues with the standard, especially on smartphones, which is where they really got pushed out. Most other devices do have headphones jacks. If I get a laptop, it's probably got a headphones jack. Radios will have headphones jacks. Get a mixer, it's got a headphones jack. I don't think that the standard is going to vanish anytime soon in general.

    I like headphones jacks. I have a ton of 1/8" and 1/4" devices and headphones that I happily use. But they weren't doing it for no reason.

    • From what I've read, the big, driving one that drove them out on smartphones was that the jack just takes up a lot more physical space in the phone than USB-C or Bluetooth. I'd rather just have a thicker phone, but a lot of people don't, and if you're going all over the phone trying to figure out what to eject to buy more space, that's gonna be a big target. For people who do want a jack on smartphones, which invariably have USB-C, you can get a similar effect to having a headphones jack by just leaving a small USB-C audio interface with a headphones jack on the end of your headphones (one with a passthrough USB-C port if you also want to use a USB-C port for other things).

    • A second issue was that the standard didn't have a way to provide power (there was a now-dead extension from many years back that is now dead, IIRC for MD players, that let a small amount of power be provided with an extra ring). That didn't matter for a long time, as long as your device could put out a strong enough signal to drive headphones of whatever impedance you had. But ANC has started to become popular now, and you need power for ANC. This is really the first time I think that there's a solid reason to want to power headphones.

    • The connection got shorted when plugging things in and out, which could result in loud sound on the membrane.

    • USB-C is designed so that the springy tensioning stuff that's there to keep the connection solid is on the (cheap, easy to replace) cord rather than the (expensive, hard to replace) device; I understand from past reading that this was a major reason that micro-USB replaced mini-USB. Instead of your device wearing out, the cord wears out. Not as much of an issue for headphones as mini-USB, but I think that it's probably fair to say that it's desirable to have the tensioning on the cord side.

    • On USB-C, the right part breaks. One irritation I have with USB-C is that it is...kind of flimsy. Like, it doesn't require that much force pushing on a plug sideways to damage a plug. However --- and I don't know if this was a design goal for USB-C, though I suspect it was --- my experience has been that if that happens, it's the plug on the (cheap, easy to replace) cord that gets damaged, not the device. I have a television with a headphones jack that I destroyed by tripping over a headphones cord once, because the headphones jack was nice and durable and let me tear components inside the television off. I've damaged several USB-C cables, but I've never damaged the device they're connected to while doing so.

    On an interesting note, the standard is extremely old, probably one of the oldest data standards in general use today; the 1/4" mono standard was from phone switchboards in the 1800s.

    EDIT: Also, one other perk of using USB-C instead of a built-in headphones jack on a smartphone is that if the DAC on your phone sucks, going the USB-C-audio-interface route means that you can use a different DAC. Can't really change the internal DAC. I don't know about other people, but last phone I had that did have an audio jack would let through a "wub wub wub" sound when I was charging it on USB off my car's 12V cigarette lighter adapter --- dirty power, but USB power is often really dirty. Was really obnoxious when feeding my car's stereo via its AUX port. That's very much fixable by putting some filtering on the DAC's power supply, maybe needs a capacitor on the thing, but the phone manufacturer didn't do it, maybe to save space or money. That's not something that I can go fix. I eventually worked around it by getting a battery-powered Bluetooth receiver that had a 1/8" headphones jack, cutting the phone's DAC out of the equation. The phone's internal DAC worked fine when the phone wasn't charging, but I wanted to have the phone plugged in for navigation stuff when I was driving.

    What is ANC?

  • What is ANC?

    Active noise cancelling - noise cancelling that doesn't just rely on making a seal between your ears and the earbuds/headphones.

  • I’d rather just have a thicker phone, but a lot of people wouldn’t

    I think this is a case where the corporations were telling people what they wanted rather than people really asking for thinner phones. Same thing with bezels, I don't know anyone who asked for the screen to go all the way to the edge (or worse, curve around onto the sides). Apple and Samsung said 'this is what people want' when in fact it was what their marketing department wanted because they wouldn't be able to sell the iGalaxy N+1 if it was slightly thicker or heavier than the iGalaxy N.

    Fwiw, I want as much screen as possible. Why waste space?

  • Yeah. I have the previous version of the WH which seems not affected, but I also have the WF 3 which unfortunately seems to be.

    Many people have sony headphones with those chips.

    Yeah, ive got a pair of the WF 3 too, now ive gotta be watching this...

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    Imagine how much data could be collected from, say, a busy gym full of people with wireless headphones, or a hotel lobby

  • What is ANC?

    As @papertowels@mander.xyz said.

    Historically, if you were in a noisy environment, you could get closed-back, circumaural headphones --- headphones that fit around your ears and had a lot of sound-absorption padding --- to help soak up the sound. I still use decent non-ANC circumaural headphones at home.

    There are also some people who are more-willing to tolerate discomfort than I am who get in-ear buds, which block noise in their ear canal, and on top of that, fit ear protectors intended for industrial use, like 3M X5 Peltor ear protectors, which have even more passive sound absorption stuff than current circumaural headphones do, and are even larger.

    That sort of thing works well on higher frequency sound, but not as well on low-frequency stuff, like engine noise, large fans, stuff like that.

    ANC basically has microphones in your headphones, picks up on what sounds are showing up at your ear, and then tries to compute and play back a sound that produces destructive interference at your ear. That is, if you look at the sound waves, where the environmental sound is low pressure, it plays back high pressure signal, and when the environmental sound is high pressure, it plays back low pressure signal. It's not perfect, or it could make environmental sound totally inaudible. But high-end ANC headphones are pretty impressive these days. I have a pair of Sennheiser Momentum 4 headphones --- good, though not the best ANC out there in 2025, and I don't personally recommend these for other reasons --- and when they kick on, the headphones are designed to have the ANC fade in; same thing happens in reverse, fades out when you flip the ANC off. It sounds almost as if fans and the like around you are powering up and down when that happens, very eerie if you've never experienced it before. Even the sounds that it doesn't do so well on, like people talking, it significantly reduces in volume.

    And ANC does best with the other side of the spectrum, the side that passive sound absorption doesn't --- the low-frequency stuff, especially regular sounds like fans. So having both a lot of passive sound absorption and ANC on a given pair of headphones let the two work well together.

    People often use cell phones in noisy environments, with a lot of people around, and ANC makes it a lot easier to hear music or whatever without background sound interfering. I think that it's very likely that people will, long term, mostly wind up using headphones with ANC (short of moving to something more elaborate like a direct brain interface or something). It's not really all that important if you're in a quiet environment, and I don't bother using ANC headphones on my desktop at home. But if you're in random environments --- waiting a grocery store line, in a restaurant with music playing over the restaurant's speakers, on an airplane with the drone of the airplane engines, whatever --- it really helps to reduce that background sound. ANC isn't that new. I think that I remember it mostly being billed as useful for airplane engine noise back when, which they're a good fit for. But it's gotten considerably better over the years. For me, in 2025, good ANC is something that I really want to have for smartphone use.

    The problem is that in order to do ANC, you need at least a microphone, preferably an array, and somewhere you need to have a model of the sound transmission through the headphones and be running signal processing on the input sound to generate that output sound. In theory, you could do it on an attached computer if you had a fast data interface, but in practice, ANC-capable headphones are sold as self-contained units that handle all that themselves. So you gotta power the little computer in the headphones. That means that you probably have batteries and at least for full size headphones (rather than earbuds) you might as well stick a USB interface on them to charge them, even if the user is using Bluetooth for wireless connectivity. And if you've done that, it isn't much more circuitry to just let the headphones act as USB headphones, so in general, ANC headphones tend to also be USB-capable. My Momentum 4 headphones have all of Bluetooth, USB-C, and a traditional headphones interface, but...I just haven't really wound up using the headphones interface if I have the other options available on a given device. Might be convenient if I were using some device that only had headphones output. shrugs

  • Fwiw, I want as much screen as possible. Why waste space?

    Wouldn’t it be nice to have all that screen space and a headphone jack and higher capacity battery tho? You can have all that and more

  • Fwiw, I want as much screen as possible. Why waste space?

    Wouldn’t it be nice to have all that screen space and a headphone jack and higher capacity battery tho? You can have all that and more

  • Fwiw, I want as much screen as possible. Why waste space?

    I'm not saying to waste space... but when manufacturers start a pissing match among themselves and say that it's because it's what the customers want, we end up with shit. Why does anyone need a screen that curves around the edge of the phone? What purpose does this serve? Who actually asked for this?

    I would give up some of my screen area to have forward facing speakers. I want a thicker phone that has better battery life. I also want to be able to swap out my battery. Oh, and I don't want the entire thing encased in glass. If we're so concerned about phone size then they should stop designing them so that a case is required.

  • 73 Stimmen
    13 Beiträge
    5 Aufrufe
    F
    They have a tiny version that is listed as 1000 on their website, plus the simulation is FOSS
  • 430 Stimmen
    42 Beiträge
    8 Aufrufe
    B
    I'm not sure who you're referencing to, but I'm assuming you're not referring to me, because I despise the IDF
  • 27 Stimmen
    5 Beiträge
    10 Aufrufe
    A
    it's only meant for temporary situations, 10 total days per year. I guess the idea is you'd use loaner PCs to access this while getting repairs done or before you've gotten a new PC. but yeah i kinda doubt there's a huge market for this kind of service.
  • 469 Stimmen
    28 Beiträge
    14 Aufrufe
    C
    Corrupted politicians and greedy people don't want you know about this one neat truck to fix climate crisis.... Oh, too late.
  • Napster/BitTorrent for machine learning?

    Technology technology
    3
    1
    27 Stimmen
    3 Beiträge
    12 Aufrufe
    G
    What would a use case look like? I assume that the latency will make it impractical to train something that's LLM-sized. But even for something small, wouldn't a data center be more efficient?
  • Why doesn't Nvidia have more competition?

    Technology technology
    22
    1
    33 Stimmen
    22 Beiträge
    15 Aufrufe
    B
    It’s funny how the article asks the question, but completely fails to answer it. About 15 years ago, Nvidia discovered there was a demand for compute in datacenters that could be met with powerful GPU’s, and they were quick to respond to it, and they had the resources to focus on it strongly, because of their huge success and high profitability in the GPU market. AMD also saw the market, and wanted to pursue it, but just over a decade ago where it began to clearly show the high potential for profitability, AMD was near bankrupt, and was very hard pressed to finance developments on GPU and compute in datacenters. AMD really tried the best they could, and was moderately successful from a technology perspective, but Nvidia already had a head start, and the proprietary development system CUDA was already an established standard that was very hard to penetrate. Intel simply fumbled the ball from start to finish. After a decade of trying to push ARM down from having the mobile crown by far, investing billions or actually the equivalent of ARM’s total revenue. They never managed to catch up to ARM despite they had the better production process at the time. This was the main focus of Intel, and Intel believed that GPU would never be more than a niche product. So when intel tried to compete on compute for datacenters, they tried to do it with X86 chips, One of their most bold efforts was to build a monstrosity of a cluster of Celeron chips, which of course performed laughably bad compared to Nvidia! Because as it turns out, the way forward at least for now, is indeed the massively parralel compute capability of a GPU, which Nvidia has refined for decades, only with (inferior) competition from AMD. But despite the lack of competition, Nvidia did not slow down, in fact with increased profits, they only grew bolder in their efforts. Making it even harder to catch up. Now AMD has had more money to compete for a while, and they do have some decent compute units, but Nvidia remains ahead and the CUDA problem is still there, so for AMD to really compete with Nvidia, they have to be better to attract customers. That’s a very tall order against Nvidia that simply seems to never stop progressing. So the only other option for AMD is to sell a bit cheaper. Which I suppose they have to. AMD and Intel were the obvious competitors, everybody else is coming from even further behind. But if I had to make a bet, it would be on Huawei. Huawei has some crazy good developers, and Trump is basically forcing them to figure it out themselves, because he is blocking Huawei and China in general from using both AMD and Nvidia AI chips. And the chips will probably be made by Chinese SMIC, because they are also prevented from using advanced production in the west, most notably TSMC. China will prevail, because it’s become a national project, of both prestige and necessity, and they have a massive talent mass and resources, so nothing can stop it now. IMO USA would clearly have been better off allowing China to use American chips. Now China will soon compete directly on both production and design too.
  • Apple Eyes Move to AI Search, Ending Era Defined by Google

    Technology technology
    2
    10 Stimmen
    2 Beiträge
    9 Aufrufe
    ohshit604@sh.itjust.worksO
    It’s infuriating that Safari/Apple only allows me to choose from five different search engines. I self-host my own SearXNG instance and have to use a third-party extension to redirect my queries.
  • Microsoft's AI Secretly Copying All Your Private Messages

    Technology technology
    4
    1
    0 Stimmen
    4 Beiträge
    12 Aufrufe
    S
    Forgive me for not explaining better. Here are the terms potentially needing explanation. Provisioning in this case is initial system setup, the kind of stuff you would do manually after a fresh install, but usually implies a regimented and repeatable process. Virtual Machine (VM) snapshots are like a save state in a game, and are often used to reset a virtual machine to a particular known-working condition. Preboot Execution Environment (PXE, aka ‘network boot’) is a network adapter feature that lets you boot a physical machine from a hosted network image rather than the usual installation on locally attached storage. It’s probably tucked away in your BIOS settings, but many computers have the feature since it’s a common requirement in commercial deployments. As with the VM snapshot described above, a PXE image is typically a known-working state that resets on each boot. Non-virtualized means not using hardware virtualization, and I meant specifically not running inside a virtual machine. Local-only means without a network or just not booting from a network-hosted image. Telemetry refers to data collecting functionality. Most software has it. Windows has a lot. Telemetry isn’t necessarily bad since it can, for example, help reveal and resolve bugs and usability problems, but it is easily (and has often been) abused by data-hungry corporations like MS, so disabling it is an advisable precaution. MS = Microsoft OSS = Open Source Software Group policies are administrative settings in Windows that control standards (for stuff like security, power management, licensing, file system and settings access, etc.) for user groups on a machine or network. Most users stick with the defaults but you can edit these yourself for a greater degree of control. Docker lets you run software inside “containers” to isolate them from the rest of the environment, exposing and/or virtualizing just the resources they need to run, and Compose is a related tool for defining one or more of these containers, how they interact, etc. To my knowledge there is no one-to-one equivalent for Windows. Obviously, many of these concepts relate to IT work, as are the use-cases I had in mind, but the software is simple enough for the average user if you just pick one of the premade playbooks. (The Atlas playbook is popular among gamers, for example.) Edit: added explanations for docker and telemetry