OS makers go to great lengths to prevent their products from accepting commands from remote devices. These protections, intended to block malicious attacks, usually force hackers to work hard to get around the measures. But what if remote code execution were as simple as being in Bluetooth range of a speaker attached to the target machine?
It turns out it can, at least when the speaker is a Sound Blaster Katana V2X sold by Singapore-based Creative Technologies. The speaker, which sells for $283, is widely acclaimed, with numerous reviews showering praise on the sound and performance of it and its predecessor, the Sound Blaster V2.
The hack was discovered by researcher Rasmus Moorats, who accidentally stumbled on it while purchasing a Katana V2X, a soundbar that connects to PCs, Macs, and Linux devices via USB or Bluetooth. Moorats was wondering if he could build a Linux tool that would talk to his speaker. He found he could do it through CTP, a proprietary mechanism he guesses is short for Creative Transport Protocol.
Devices connected via Bluetooth or USB can send commands to the speaker using CTP, including changing the color of the LEDs and the equalizer. CTP also allows the devices connected to receive responses from the speaker.
Moorats was surprised that his Bluetooth device could connect to the speaker, plugged into a PC via USB, with no authentication. And, his Bluetooth device didn’t even have to be paired first. Also surprising: one of the CTP commands, called “upload new firmware to device,” allowed him to replace the official firmware with his own custom one. The firmware reflashing did not include code signing or other protections against loading unofficial code.
The researcher was able to successfully swap the firmware with a replacement image that simply displayed the word “patched” on the LED display on the speaker, but then wondered what else a hacker could do. So he started looking at FreeRTOS, the open source operating system that powered the Katana V2X. That included a set of HID functions so that the speaker could act as a human interface device, a category that includes keyboards, mice, and webcams. The speaker had a limited HID that could do things like change the volume or play/stop sound, but little else.
USB speaker vulnerability
The researcher found that he could change the USB descriptor set of the speaker, which is essentially a report that tells devices what a USB or Bluetooth peripheral is capable of. He could add a second descriptor to the existing set, indicating that the speaker was a keyboard. He then optimized the process of sending keypresses via code already in the firmware.
All of this gave Moorats an idea: What if he used his device to send commands to the speaker that used the HID to pass them along to the connected PC? After some trial and error, he found that he could. In a blog post published on Wednesday, he wrote:
So all of that together I was able to completely remotely, over the air, upload custom firmware to my speaker, which I hadn’t paired with, which would reboot, flash the custom firmware, and after rebooting type in the command “echo pwned” and execute it.
I would actually do the keystrokes to open powershell.exe or similar and paste an actually malicious one-liner into that in a real attack scenario but this was more than enough for me as a proof of concept. In a real attack, the attacker would probably also disable the normal mode and recovery mode firmware update routine so that the malicious firmware could not be wiped from the device or the device patched in the future.
Compounding the problem, the speaker always has Bluetooth switched on, even in sleep mode, and there appears to be no way to switch it off.
Before the speaker can talk to the USB-connected device, they have to go through a challenge-and-response authentication process first. This isn’t usually a problem for the hacker, since the devices do this handshake automatically every time the software boots up. However, in some cases, such as when the Katana V2X app is not open on the connected device, it is required.
USB device malware
Still, the authentication is a simple enough hurdle to jump, as the correct response can be found within the app binary that ships with the speaker. Interestingly, for Bluetooth-connected devices, there is no challenge and response.
Moorats told Creative Technologies what he had found, but he never got a reply. He then called in CERT Singapore to help. Eventually, the company replied to the organization. Company engineers “do not consider the behaviour a vulnerability”, it said. The researcher tested the attack on a Windows computer connected to the network.
As a reminder, the hacks described here can only happen when the attacker is within Bluetooth range of the speaker. That’s a big ask, so attacks are limited to neighbors, housemates or people in offices next door to the speaker.
However, the ability to use a Bluetooth device as a PC-pwning proxy and remote bugging device doesn’t exactly inspire warm and fuzzy feelings. It also raises the question: What other Bluetooth devices leave users vulnerable to the same attacks?
TechDriver is a cybersecurity researcher and digital forensics specialist based in United States. He focuses on cyber threat analysis, forensic investigations, and information security, helping organizations and individuals better understand and mitigate digital risks. With extensive experience in uncovering hidden digital evidence and examining complex security incidents, he regularly shares practical insights on cybersecurity, digital forensics, ethical hacking, and online privacy
We use cookies to enhance your experience, analyze site traffic, and deliver personalized security intelligence content.
Your preference is remembered for 7 days.
Privacy Policy
Leave a comment