When Your Computer Gets Hacked Through A Bluetooth Speaker

Threat model / attack vectors

The video argues that hacking isn’t limited to emails or malicious websites/USB sticks. Bluetooth speakers can be an unexpected entry point because they can be reprogrammed to control or compromise connected devices.

Target device

A specific focus is the Creative Katana V2X soundbar/speaker system.

Vulnerability name

The attack is called “Pwn Blaster.”

Discovery context (Rasmus Moraatz)

• Researcher Rasmus Moraatz found the flaw while trying to build Linux tooling to control the speaker.
  • Creative only provides an official app for Windows.
• He:
  • analyzed the Windows app
  • captured traffic over USB
  • reverse-engineered Creative’s proprietary protocol CTP (Creative Transport Protocol)

Firmware structure and the core security mistake

The speaker firmware container has multiple sections:

• Fboot: recovery image
  • entered by holding the source button during power-on
  • used to avoid bricking on failed updates
• Fmain: main firmware image
  • based on FreeRTOS
• CHK2: a SHA-256 checksum over the firmware container

Creative appears to have intended the checksum as a security control, but the practical outcome is:

• If an attacker modifies firmware, they can recompute the SHA-256 checksum, so the device accepts the update.
• Therefore, the checksum prevents arbitrary corruption, but does not prevent unauthorized custom firmware.

Why it’s dangerous over Bluetooth (not just USB)

• Custom firmware updates are feasible over Bluetooth Low Energy (BLE), not only via local USB access.
• The video claims CTP commands are accepted over Bluetooth without proper pairing/authentication.
• Noted BLE behavior:
  • even before pairing, devices can expose identifiers/status
  • certain BLE features allow sending data/requests
• Flashing speed: firmware flashing over BLE takes about ~10 minutes, making a non-physical attack plausible.
• No Bluetooth power-off: the speaker reportedly cannot disable Bluetooth except by unplugging it; even “sleep” keeps Bluetooth enabled.

Potential malicious payloads / impacts

• Microphone takeover: turn the built-in mic into a spy device, sending recorded audio back via Bluetooth.
• Persistent exfiltration: use an additional device to capture Bluetooth audio signals and forward them over cellular for longer-term surveillance.
• Pivot to full PC control: modify firmware so the connected computer sees the speaker as a USB keyboard, enabling delivery of commands (e.g., opening shells / running a reverse shell one-liner), effectively taking over the PC.

Disclosure / response / fixes

• Moraatz attempted to contact Creative but found no appropriate security reporting channel.
• He contacted SingCert (Singapore’s cyber emergency response team) and eventually reached Creative after ~2 months.
• Creative’s stance:
  • they claimed it is “not a vulnerability”
  • arguing unauthenticated over-the-air custom firmware updates are a “feature.”
• Moraatz created a workaround/personal patch:
  • disables CTP Bluetooth commands to stop the attack
  • but reportedly breaks much of the mobile app functionality (EQ adjustments and firmware update features stop working)
• The patch dynamically fetched Creative’s latest firmware from Creative’s website each time because the firmware is proprietary and not redistributable.
• Creative made things worse: on June 7, Creative blocked URLs serving the firmware files directly.
  • The video frames this as security through obscurity, arguing it prevents legitimate patching even by the original person who created the fix.

Takeaway / guidance

• Treat Bluetooth accessories (even audio devices) as potential security pivots.
• Do your own research before buying Bluetooth products:
  • vendors may deny risk and later reduce patch availability rather than provide an official security update.

Main speakers / sources

• Rasmus Moraatz
  • security researcher who discovered/analyzed the “Pwn Blaster” vulnerability
  • created the disabling patch
• SingCert
  • Singapore Cyber Emergency Response Team; used as an intermediary for disclosure
• Creative
  • Creative Labs / Creative’s firmware app and response denying the issue