[jogu]

Sounds like you should have actually watched the “long ass video”.

It allows the pairing key to be exfiltrated from the compromised device and an external, attacker controlled device to perform any function the original device could. This includes retrieving the paired devices phone number, answering phone calls, and receiving the audio. They live demo hijacking a whatsapp account using this.

[bethekidyouwant]

Neat. It appears my headphones have to be in pairing mode. Which is a very short window, at which point the attacker can impersonate your device. this allows him to answer phone calls for you or make phone calls, but you would notice right away. It’s not like cloning the audio and eves dropping. so yeah it’s a nothing burger.

[jogu]

Some devices are/were only vulnerable during the initial pairing but a key point from this talk was that most of these devices were vulnerable during normal use.

The RACE protocol could be accessed even if the device isn’t in pairing mode. Then once you have a target device’s key you can carry out the attack at anytime, when they’d be unlikely to notice.

[bethekidyouwant]

If you have the target device key, you can impersonate the device later. But how do you get the device key in the real world? I would need to be in pairing mode for you to get it. Even if you did get it, then you can answer my calls if you are next to me, which in the real world is certainly noticeable.

[JCattheATM]

> I would need to be in pairing mode for you to get it.

No, that doesn't seem to be the case.

> then you can answer my calls if you are next to me, which in the real world is certainly noticeable.

You may not notice if the call was answered automatically and you didn't have your device on you, and the call could be forwarded with acceptable latency so the speech wouldn't be in earshot. Or these days you could use an AI to generate voice and it would sound realistic.

Just because something isn't likely to affect ordinary citizens doesn't mean it isn't possible.