Remote code execution via Bluetooth-enabled speaker: a case study in insecure design

A security researcher has demonstrated that a commercially available USB-connected speaker can be compromised remotely over Bluetooth, enabling arbitrary code execution on a connected PC without physical interaction. The device in question is the Sound Blaster Katana V2X, manufactured by Creative Technologies. The researcher, Rasmus Moorats, purchased the speaker and subsequently developed a Linux tool to interface with it. He discovered that the speaker employs a proprietary mechanism, which he hypothesises stands for Creative Transport Protocol (CTP). This protocol facilitates bidirectional communication, allowing connected devices to send commands—such as adjusting LED colours or equaliser settings—and receive responses. Crucially, Moorats was able to connect to the speaker via Bluetooth without prior pairing or any form of authentication. He then issued a command to upload new firmware. The firmware reflashing process lacked code signing, enabling him to replace the official firmware with a custom image that merely displayed the word "patched" on the speaker's LED display. The speaker runs FreeRTOS, an open source operating system. This OS includes HID functions that permit the speaker to act as a human interface device, such as a keyboard. Moorats modified the speaker's USB descriptor set, appending a second descriptor that identified the speaker as a keyboard. Leveraging existing code within the firmware, he streamlined the transmission of keypresses. By chaining these techniques, he achieved remote, over-the-air firmware upload, which caused the speaker to reboot and type the command "echo pwned" on the connected PC; the command was subsequently executed. The attack vector is constrained by Bluetooth range, requiring the attacker to be in close proximity to the speaker. Moorats reported his findings to Creative Technologies, but the company did not respond. Following intervention by CERT Singapore, the company asserted that its engineers do not consider the behaviour a vulnerability. Notably, the speaker's Bluetooth radio remains active even in sleep mode, with no apparent mechanism to disable it. Although a challenge-and-response authentication procedure exists for USB-connected devices, no such authentication is required for Bluetooth connections. This asymmetry, combined with the absence of code signing, renders the attack relatively straightforward to execute.