انتبه.. سماعات البلوتوث تتيح «التنصت»!

Security experts have revealed serious vulnerabilities in several popular Bluetooth headphones, which could allow hackers to infiltrate these devices and spy on their users, as well as execute advanced hacking operations that may include the connected phones, according to Forbes.

German security researcher Dennis Heinz, along with Friedrich Steinmetz from the cybersecurity company ERNW, announced the detection of several vulnerabilities in devices that rely on Airoha chips, one of the leading companies in Bluetooth technology manufacturing, particularly True Wireless Stereo (TWS) headphones.

According to the researchers, these vulnerabilities allow— in some cases— complete remote control of the headphones without the need for any pairing or authentication, provided the attacker is within the Bluetooth range of the device.

Heinz warned that if a hacker successfully exploits these vulnerabilities, they would be able to read and write the device's memory, break the trust relationships between the headphones and the phone, and eavesdrop on what the microphone picks up, as long as the headphones are powered on and not actively in use.

In some scenarios, the hacker could also impersonate the headphones and execute commands on the smartphone, such as making calls or extracting contacts and call logs, which poses a direct threat to privacy.

Although hackers may not target the average user at this stage, the researchers confirmed that the risks affect specific groups, including journalists, diplomats, activists, and political opponents, especially in environments that are subject to surveillance or intense monitoring.

Heinz emphasized the importance of updating the firmware of devices when available, stressing the need to completely disconnect the headphones from the phone, not just turn them off.

He stated, "The warning is directed at anyone using these headphones in sensitive places or during missions that require high privacy."

The report indicated that Airoha released a patch to address the vulnerabilities during the first week of June, while some manufacturing companies began preparing their own updates.

In an official statement, Jabra confirmed that it is working on a security update to address the vulnerability in the Elite 8 and Elite 10 headphones, while other models are not affected.

For his part, Boris Sibot, the chief security engineer at Black Duck, stressed that every new technological development carries undiscovered vulnerabilities, calling for automatic security updates without relying on user intervention.

He concluded his statement by saying, "Maintaining device security is a shared responsibility between companies and users, but the greater burden falls on manufacturers to ensure a quick and effective response."