NVDM

Bluetooth Flaw in Airoha Chips Exposes Link Keys, Enabling WhatsApp Hijacks via Headphones

Two German researchers discovered a critical unauthenticated service interface in Airoha Bluetooth SoCs used by millions of headphones from Sony, JBL, Marshall and others. The flaw allows any nearby attacker to extract cryptographic Link Keys over Bluetooth without pairing or PIN entry. Researchers reverse-engineered firmware update utilities and the proprietary RACE protocol to dump flash memory and locate stored pairing secrets in the NVDM partition. With stolen keys attackers can impersonate legitimate headphones, connect via the HFP profile and intercept calls to hijack WhatsApp and Amazon accounts. The vulnerability affects both Auracast-enabled devices and classic Bluetooth headsets because OEMs left the RACE command set unprotected. Tools built with Bumble and BTstack demonstrated practical attacks that leave victims unaware while audio continues uninterrupted.