Two German penetration testers set out to audit Auracast implementations and instead uncovered an open backdoor affecting millions of wireless headphones. The researchers, Frieder Steinmetz and Dennis Heinz, found that Airoha Bluetooth Audio SoCs contain an unprotected service interface that lets any device within Bluetooth range extract cryptographic keys, clone the headset and take control of calls without pairing or authentication.
The chain ultimately allowed account takeovers on WhatsApp and Amazon. Affected brands include Sony, Marshall, JBL, Jabra, Beyerdynamic and Teufel, as well as numerous AirPods clones that use the same chipset.
Reverse engineering the firmware update tool
Initial analysis began with a MoerLab Auracast transmitter whose firmware update file was encrypted. By monitoring USB HID traffic between the vendor’s Windows utility and the device, the researchers identified the command that writes arbitrary data to flash at a supplied address. A matching read command existed in the same switch-case table inside the firmware, allowing them to dump the entire flash contents over USB.
Further work showed that the same protocol, named RACE, also runs over Bluetooth Classic RFCOMM and BLE GATT. Mobile companion apps for the headphones contained the identical command set, confirming that every Airoha-based product was potentially reachable.
Unauthenticated memory access and Link Key extraction
Commands in the RACE protocol permit reading and writing anywhere in the ARM Cortex-M4 address space, including the NVDM configuration partition. Inside NVDM the researchers located a connection table that stores Bluetooth addresses and Link Keys in plaintext. A Python script using the Bumble library scans for Airoha devices over BLE, connects without pairing, locates the NVDM partition and extracts the keys while the victim continues listening to music.
Possession of a valid Link Key allows an attacker to spoof the legitimate headset using a programmable Bluetooth adapter. The victim’s phone accepts the connection silently, granting the attacker access to the HFP profile. From there the attacker can answer or place calls, intercept two-factor codes and ultimately hijack messaging and shopping accounts.
Scale and responsible disclosure
Because the vulnerability stems from an OEM decision to leave the diagnostic protocol unauthenticated, the issue affects an entire ecosystem rather than a single vendor. Researchers published proof-of-concept tools and recommended that users forget and re-pair devices only after firmware updates become available. No patches have been issued by Airoha or the affected brands at the time of writing.
