Skip to content

Zero-day: Bluetooth gap turns millions of headphones into listening stations

Technology
123 88 2
  • ... and this is why I don't use bluetooth on anything.

    I never have it enabled unless I am in the car driving and need driving directions or listening to music/podcasts. I prefer wired headphones, but manufacturers are making that difficult.

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    Alright now how do I test this out

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    What is that site asking me to agree to? No thanks

  • There's lots of money to be made by inserting a hardware back door in your product then later disclosing it as an unfixable vulnerability and force your customers to buy new hardware which has the same but different backdoor. Repeat.

    Thanks, I hate it. Vulnerable to your competitor red teaming it tho...

  • I mean, there were legitimate technical issues with the standard, especially on smartphones, which is where they really got pushed out. Most other devices do have headphones jacks. If I get a laptop, it's probably got a headphones jack. Radios will have headphones jacks. Get a mixer, it's got a headphones jack. I don't think that the standard is going to vanish anytime soon in general.

    I like headphones jacks. I have a ton of 1/8" and 1/4" devices and headphones that I happily use. But they weren't doing it for no reason.

    • From what I've read, the big, driving one that drove them out on smartphones was that the jack just takes up a lot more physical space in the phone than USB-C or Bluetooth. I'd rather just have a thicker phone, but a lot of people don't, and if you're going all over the phone trying to figure out what to eject to buy more space, that's gonna be a big target. For people who do want a jack on smartphones, which invariably have USB-C, you can get a similar effect to having a headphones jack by just leaving a small USB-C audio interface with a headphones jack on the end of your headphones (one with a passthrough USB-C port if you also want to use a USB-C port for other things).

    • A second issue was that the standard didn't have a way to provide power (there was a now-dead extension from many years back that is now dead, IIRC for MD players, that let a small amount of power be provided with an extra ring). That didn't matter for a long time, as long as your device could put out a strong enough signal to drive headphones of whatever impedance you had. But ANC has started to become popular now, and you need power for ANC. This is really the first time I think that there's a solid reason to want to power headphones.

    • The connection got shorted when plugging things in and out, which could result in loud sound on the membrane.

    • USB-C is designed so that the springy tensioning stuff that's there to keep the connection solid is on the (cheap, easy to replace) cord rather than the (expensive, hard to replace) device; I understand from past reading that this was a major reason that micro-USB replaced mini-USB. Instead of your device wearing out, the cord wears out. Not as much of an issue for headphones as mini-USB, but I think that it's probably fair to say that it's desirable to have the tensioning on the cord side.

    • On USB-C, the right part breaks. One irritation I have with USB-C is that it is...kind of flimsy. Like, it doesn't require that much force pushing on a plug sideways to damage a plug. However --- and I don't know if this was a design goal for USB-C, though I suspect it was --- my experience has been that if that happens, it's the plug on the (cheap, easy to replace) cord that gets damaged, not the device. I have a television with a headphones jack that I destroyed by tripping over a headphones cord once, because the headphones jack was nice and durable and let me tear components inside the television off. I've damaged several USB-C cables, but I've never damaged the device they're connected to while doing so.

    On an interesting note, the standard is extremely old, probably one of the oldest data standards in general use today; the 1/4" mono standard was from phone switchboards in the 1800s.

    EDIT: Also, one other perk of using USB-C instead of a built-in headphones jack on a smartphone is that if the DAC on your phone sucks, going the USB-C-audio-interface route means that you can use a different DAC. Can't really change the internal DAC. I don't know about other people, but last phone I had that did have an audio jack would let through a "wub wub wub" sound when I was charging it on USB off my car's 12V cigarette lighter adapter --- dirty power, but USB power is often really dirty. Was really obnoxious when feeding my car's stereo via its AUX port. That's very much fixable by putting some filtering on the DAC's power supply, maybe needs a capacitor on the thing, but the phone manufacturer didn't do it, maybe to save space or money. That's not something that I can go fix. I eventually worked around it by getting a battery-powered Bluetooth receiver that had a 1/8" headphones jack, cutting the phone's DAC out of the equation. The phone's internal DAC worked fine when the phone wasn't charging, but I wanted to have the phone plugged in for navigation stuff when I was driving.

    Honestly I'd be happy with a phone sporting two USB C ports, one centered and one off to the side where the headphone jack used to be, both fully functional.

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    The site wants to share info with advertisers. I found this to be refreshingly honest.

    We and our up to 185 partners use cookies and tracking technologies. Some cookies and data processing are technically necessary, others help us to improve our offer and operate it economically...

    Anyway, can we get an archive link?

  • I mean, there were legitimate technical issues with the standard, especially on smartphones, which is where they really got pushed out. Most other devices do have headphones jacks. If I get a laptop, it's probably got a headphones jack. Radios will have headphones jacks. Get a mixer, it's got a headphones jack. I don't think that the standard is going to vanish anytime soon in general.

    I like headphones jacks. I have a ton of 1/8" and 1/4" devices and headphones that I happily use. But they weren't doing it for no reason.

    • From what I've read, the big, driving one that drove them out on smartphones was that the jack just takes up a lot more physical space in the phone than USB-C or Bluetooth. I'd rather just have a thicker phone, but a lot of people don't, and if you're going all over the phone trying to figure out what to eject to buy more space, that's gonna be a big target. For people who do want a jack on smartphones, which invariably have USB-C, you can get a similar effect to having a headphones jack by just leaving a small USB-C audio interface with a headphones jack on the end of your headphones (one with a passthrough USB-C port if you also want to use a USB-C port for other things).

    • A second issue was that the standard didn't have a way to provide power (there was a now-dead extension from many years back that is now dead, IIRC for MD players, that let a small amount of power be provided with an extra ring). That didn't matter for a long time, as long as your device could put out a strong enough signal to drive headphones of whatever impedance you had. But ANC has started to become popular now, and you need power for ANC. This is really the first time I think that there's a solid reason to want to power headphones.

    • The connection got shorted when plugging things in and out, which could result in loud sound on the membrane.

    • USB-C is designed so that the springy tensioning stuff that's there to keep the connection solid is on the (cheap, easy to replace) cord rather than the (expensive, hard to replace) device; I understand from past reading that this was a major reason that micro-USB replaced mini-USB. Instead of your device wearing out, the cord wears out. Not as much of an issue for headphones as mini-USB, but I think that it's probably fair to say that it's desirable to have the tensioning on the cord side.

    • On USB-C, the right part breaks. One irritation I have with USB-C is that it is...kind of flimsy. Like, it doesn't require that much force pushing on a plug sideways to damage a plug. However --- and I don't know if this was a design goal for USB-C, though I suspect it was --- my experience has been that if that happens, it's the plug on the (cheap, easy to replace) cord that gets damaged, not the device. I have a television with a headphones jack that I destroyed by tripping over a headphones cord once, because the headphones jack was nice and durable and let me tear components inside the television off. I've damaged several USB-C cables, but I've never damaged the device they're connected to while doing so.

    On an interesting note, the standard is extremely old, probably one of the oldest data standards in general use today; the 1/4" mono standard was from phone switchboards in the 1800s.

    EDIT: Also, one other perk of using USB-C instead of a built-in headphones jack on a smartphone is that if the DAC on your phone sucks, going the USB-C-audio-interface route means that you can use a different DAC. Can't really change the internal DAC. I don't know about other people, but last phone I had that did have an audio jack would let through a "wub wub wub" sound when I was charging it on USB off my car's 12V cigarette lighter adapter --- dirty power, but USB power is often really dirty. Was really obnoxious when feeding my car's stereo via its AUX port. That's very much fixable by putting some filtering on the DAC's power supply, maybe needs a capacitor on the thing, but the phone manufacturer didn't do it, maybe to save space or money. That's not something that I can go fix. I eventually worked around it by getting a battery-powered Bluetooth receiver that had a 1/8" headphones jack, cutting the phone's DAC out of the equation. The phone's internal DAC worked fine when the phone wasn't charging, but I wanted to have the phone plugged in for navigation stuff when I was driving.

    I know someone who works somewhat high up at Apple and he told me another reason was that they really wanted to improve the water proofing.

  • I never have it enabled unless I am in the car driving and need driving directions or listening to music/podcasts. I prefer wired headphones, but manufacturers are making that difficult.

    Because they can't sell you more Bluetooth crap if they give you a choice.

    Stop buying no-Jack phones.

  • What is that site asking me to agree to? No thanks

    GDPR. First time opening a European website? German ones like this are particularly transparent (by law, not choice).

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    Sounds like the attack scenario is very sophisticated and targeted, and only works within the range of Bluetooth low energy (BLE) connectivity, so 10-15 meters under best circumstances. At that point they might as well eavesdrop on my calls in person.

  • The site wants to share info with advertisers. I found this to be refreshingly honest.

    We and our up to 185 partners use cookies and tracking technologies. Some cookies and data processing are technically necessary, others help us to improve our offer and operate it economically...

    Anyway, can we get an archive link?

    It’s strange to think about how complicit the public has become with this. You mean to tell me that 185 separate connections to other companies are required for me to… read an article?

  • I know someone who works somewhat high up at Apple and he told me another reason was that they really wanted to improve the water proofing.

    That's just gaslighting. Other phones had audio jacks, water protection, and you didn't have to hold them funny.

    My bro is a huge apple kool-aid guy and he spouts their dogma word-for-word.

  • It’s strange to think about how complicit the public has become with this. You mean to tell me that 185 separate connections to other companies are required for me to… read an article?

    Well yeah, they have to hoard your advertising data somehow. How else can they advertise things that you don't need to buy?

  • you can just permanently connect your headphones to your dongle

    No. Fuck that. My PC has a headphone jack, and I use it. I don't have a bunch of extra USB-C ports on the front of my computer. Modern phones have plenty of spaces for headphone jacks. They could put it there, they just don't want to.

    I used a USB connection through my KVM to connect to one computer or the next. But it's just something to plug my headphones into the 3.5mm jack.

    Since it never gets unplugged, it doesn't get lost; unlike all those "just have this snowflake dongle in one of all of your stuff so it can get lost monthly and you can buy another" people.

    Again: my startac 7800 had a jack and it was tiny. Apple and Samsung have NO EXCUSE.

  • Or public transit. Or public parks. Or grocery stores.

    Yesss. Find that sploit and please let it never be fixable. I didn't download a copy of The Wheels On The Bus for nothing.

  • Sounds like the attack scenario is very sophisticated and targeted, and only works within the range of Bluetooth low energy (BLE) connectivity, so 10-15 meters under best circumstances. At that point they might as well eavesdrop on my calls in person.

    Directional antennas exist and are very inexpensive

  • The site wants to share info with advertisers. I found this to be refreshingly honest.

    We and our up to 185 partners use cookies and tracking technologies. Some cookies and data processing are technically necessary, others help us to improve our offer and operate it economically...

    Anyway, can we get an archive link?

    Instead of hacking Bluetooth, sounds more effective to be an "advertising partner".

  • The site wants to share info with advertisers. I found this to be refreshingly honest.

    We and our up to 185 partners use cookies and tracking technologies. Some cookies and data processing are technically necessary, others help us to improve our offer and operate it economically...

    Anyway, can we get an archive link?

    You can get/make your own archive link by going to archive.ph and entering the article's URL.

    Here's the link for this one: https://archive.ph/wUAQn

  • The Bluetooth chipset installed in popular models from major manufacturers is vulnerable. Hackers could use it to initiate calls and eavesdrop on devices.

    Source

    Archive link: archive.ph/wUAQn

  • Sounds like the attack scenario is very sophisticated and targeted, and only works within the range of Bluetooth low energy (BLE) connectivity, so 10-15 meters under best circumstances. At that point they might as well eavesdrop on my calls in person.

    Honey i got to go there is a man outside our window with a lapton and an radio antenna
    "Ignore the man outside your window and just read off your credit card number

  • Google kills the fact-checking snippet

    Technology technology
    5
    86 Stimmen
    5 Beiträge
    0 Aufrufe
    P
    Mbfc is ok but is itself biased towards Western and Pro-Israel content.
  • French city of Lyon ditching Microsoft for FOSS

    Technology technology
    17
    1
    491 Stimmen
    17 Beiträge
    9 Aufrufe
    K
    The important thing is that the doomsday device runs Linux
  • Using Signal groups for activism

    Technology technology
    37
    1
    204 Stimmen
    37 Beiträge
    43 Aufrufe
    ulrich@feddit.orgU
    You're using a messaging app that was built with the express intent of being private and encrypted. Yes. You're asking why you can't have a right to privacy when you use your real name as your display handle in order to hide your phone number. I didn't ask anything. I stated it definitively. If you then use personal details as your screen name, you can't get mad at the app for not hiding your personal details. I've already explained this. I am not mad. I am telling you why it's a bad product for activism. Chatting with your friends and clients isn't what this app is for. That's...exactly what it's for. And I don't know where you got the idea that it's not. It's absurd. Certainly Snowden never said anything of the sort. Signal themselves never said anything of the sort. There are other apps for that. Of course there are. They're varying degrees of not private, secure, or easy to use.
  • Sierpinski triangle programs by 5 AI models

    Technology technology
    7
    1
    15 Stimmen
    7 Beiträge
    10 Aufrufe
    M
    oh, wow! that's so cool!
  • 834 Stimmen
    83 Beiträge
    5 Aufrufe
    sommerset@thelemmy.clubS
    Which big companies lose money? Frontier or other companies? People switch where? To frontier or away from frontier? Who has faster internet? Frontier or frontier competitors? What does it matter that there are leftists and centrists in the state? How does this have anything to do with the comment u writing about?
  • Honda successfully launched and landed its own reusable rocket

    Technology technology
    170
    1
    1k Stimmen
    170 Beiträge
    42 Aufrufe
    gerryflap@feddit.nlG
    Call me an optimist, but I still hold the hope that we can one day do better as humanity than we do now. Humanity has become a "better" species throughout its existence overall. Even a hundred years ago we were much more horrible and brutal than we are now. The current trend is not great, with climate change and far-right grifters taking control. But I hold hope that in the end this is but a blip on the radar. Horrible for us now, but in the grand scheme of things not something that will end humanity. It might in the worst case set us back a few hundred years.
  • 106 Stimmen
    25 Beiträge
    12 Aufrufe
    tryenjer@lemmy.worldT
    In short, we will need an open-source alternative to these implants, of course.
  • Microsoft Bans Employees From Using DeepSeek App

    Technology technology
    11
    1
    121 Stimmen
    11 Beiträge
    11 Aufrufe
    L
    (Premise - suppose I accept that there is such a definable thing as capitalism) I'm not sure why you feel the need to state this in a discussion that already assumes it as a necessary precondition of, but, uh, you do you. People blaming capitalism for everything then build a country that imports grain, while before them and after them it’s among the largest exporters on the planet (if we combine Russia and Ukraine for the “after” metric, no pun intended). ...what? What does this have to do with literally anything, much less my comment about innovation/competition? Even setting aside the wild-assed assumptions you're making about me criticizing capitalism means I 'blame [it] for everything', this tirade you've launched into, presumably about Ukraine and the USSR, has no bearing on anything even tangentially related to this conversation. People praising capitalism create conditions in which there’s no reason to praise it. Like, it’s competitive - they kill competitiveness with patents, IP, very complex legal systems. It’s self-regulating and self-optimizing - they make regulations and do bailouts preventing sick companies from dying, make laws after their interests, then reactively make regulations to make conditions with them existing bearable, which have a side effect of killing smaller companies. Please allow me to reiterate: ...what? Capitalists didn't build literally any of those things, governments did, and capitalists have been trying to escape, subvert, or dismantle those systems at every turn, so this... vain, confusing attempt to pin a medal on capitalism's chest for restraining itself is not only wrong, it fails to understand basic facts about history. It's the opposite of self-regulating because it actively seeks to dismantle regulations (environmental, labor, wage, etc), and the only thing it optimizes for is the wealth of oligarchs, and maybe if they're lucky, there will be a few crumbs left over for their simps. That’s the problem, both “socialist” and “capitalist” ideal systems ignore ape power dynamics. I'm going to go ahead an assume that 'the problem' has more to do with assuming that complex interacting systems can be simplified to 'ape (or any other animal's) power dynamics' than with failing to let the richest people just do whatever they want. Such systems should be designed on top of the fact that jungle law is always allowed So we should just be cool with everybody being poor so Jeff Bezos or whoever can upgrade his megayacht to a gigayacht or whatever? Let me say this in the politest way I know how: LOL no. Also, do you remember when I said this? ‘Won’t someone please think of the billionaires’ is wearing kinda thin You know, right before you went on this very long-winded, surreal, barely-coherent ramble? Did you imagine I would be convinced by literally any of it when all it amounts to is one giant, extraneous, tedious equivalent of 'Won't someone please think of the billionaires?' Simp harder and I bet maybe you can get a crumb or two yourself.