Sound Blaster Hack: Bluetooth Proxy for PC Attacks

A significant security flaw has been identified in Creative's Sound Blaster Katana V2X speaker, potentially enabling remote code execution on connected computers. A researcher discovered that the speaker's Bluetooth connection and proprietary Creative Transport Protocol (CTP) could be exploited without prior pairing or authentication. This vulnerability allows an attacker within Bluetooth range to upload custom firmware, effectively turning the speaker into a keyboard proxy. The modified speaker can then send commands to a connected PC, such as opening applications or executing malicious code. This could allow attackers to gain full control over the target device.

Initially, the researcher was able to replace the speaker's official firmware with a custom version. This custom firmware then leveraged the speaker's Human Interface Device (HID) functions, usually for controlling volume or playback, to act as a keyboard. The process involves altering the speaker's USB descriptor set to identify it as a keyboard and then using existing firmware code to streamline keypress commands. The full attack chain involves wirelessly uploading new firmware to an unpaired speaker, which then boots and executes commands on the connected PC.

Creative Technologies initially informed the researcher that they did not consider this behavior a vulnerability. However, after intervention from CERT Singapore, the company acknowledged the findings. The hack's effectiveness is limited by the attacker's need to be within Bluetooth range of the speaker. Despite this proximity requirement, the potential to compromise a PC through a seemingly innocuous audio device raises broader concerns about the security of other Bluetooth-enabled peripherals. The speaker's Bluetooth remains active even in sleep mode, with no apparent way to disable it, further complicating security.