AirPods fast connect security vulnerability

> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds.

> With this trick, they can establish that both devices are speaking the Fast Connect protocol without violating the Bluetooth specification, and then go on to exchange 3 more back-and-forth messages, negotiating all the things necessary to fully connect the two devices.

> The fact that this only takes 4 messages back-and-forth in total is what makes Fast Connect fancy, because usually in Bluetooth the phase of wiring up the individual channels for a connection is quite a complex negotiation and involves sending various SDP descriptors that describe which protocols/features both sides support.

Two devices in the same room communicating over even a very narrow slice of the electromagnetic spectrum could exchange many thousands of messages per second. What is it about Bluetooth that causes each message to take a hundred milliseconds rather than, say, a microsecond? What is setting the timescale for this process?

> That’s because AirPods auto-update their firmware by themselves, but only when they’re used together with an iPhone or MacBook, so Android users have no easy way to update their firmware.

From what I remember, advantage of affected Beats devices which also use same chip is they can actually be updated from the beats app on Android

The Apple Support link given in the article is for what looks like the Indian version. Here's the US version:

https://support.apple.com/en-us/106340

The US version shows different version numbers for the latest firmware, e.g. for the Airpods Pro 2nd Gen it's 6F8, while in India it's 6B34.

Very nice write-up

> ... see if I could get all the functionality working on Linux as well. ... I’ll talk about the specifics in another blog post ...

I am super curious to read when you do write-up about implementation of this functionality in Linux! Thanks for that and I will refresh the blog until that is written :)

So my Airpods 2 have an outdated firmware version, but as a user I can't explicitly have iOS update the firmware, and there is no indication when an update happens. I wish I would have more control.

Obviously any vulnerability is bad, but I'm trying to understand just how bad this one is. What "scary" things could an attacker do?

It doesn't sound like they could listen in on a phone call you're having without your knowledge, or even an audio stream, since it breaks the original connection, right? So is the worst they could do is come within a pretty short distance of you, scan for your mac address, and the auto-connect and play some noise into your ears? Or is there more?

I suppose you could do something like take over the airpods of a high-level celebrity or politician while they're on a video call, that could be bad (but caught instantly). Anything worse?

Settings > Bluetooth > Your AirPods (click on [i]) shows the version, even if AirPods are not actively connected.

6A326 seems to be the version including the fix.

https://support.apple.com/en-us/HT214111

I understand that chances are pretty slim but I still hope that this will make Apple do something regarding AirPods updates on other OSes or at least on Android.

There is no manual update option. Auto-update is the only way to update, and it's unclear how to cajole it to auto-update.

One more advantage of wired headphones in addition to them not running out of batteries.

I’ve got numerous gripes with AirPods under Linux - range doesn’t seem as good as my phone (I’ve tried multiple dongles etc), I wasn’t aware that you could connect to two devices but now I want that, when the microphone is enabled audio sounds absolutely trash. Oddly enough, the connect speed annoyed me but not as much as the other issues.

Are there any alternative headphones that solve all three of these well? I just want a headset that works.

I didn't even know about this vulnerability and mine are updated. Just how I like things.

> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds

Oh no, I'll never get that 0.5 seconds back... /s

Hard to think of a company with as poor security as Apple. No one else hits the headlines as much and creates so much real world consequences.