Researchers reveal “WhisperPair” attack to eavesdrop on Google Fast Pair headphones

Security researchers from KU Leuven in Belgium have disclosed a vulnerability they call WhisperPair that can allow attackers to hijack Fast Pair-enabled devices to spy on the owner, including microphone access and location tracking. The flaw affects more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself, and Google has acknowledged the flaw and notified partners.

The researchers say an attacker can gain control in a median of about 10 seconds at distances of up to 14 metres, which is near the edge of Bluetooth’s range and would be unlikely to alert a user nearby. Once connected, an attacker could interrupt audio or play audio, and could also monitor conversations via the device in the user’s pocket.

The Pixel Buds Pro 2 are among the vulnerable devices, and while Google has pushed an update to its own devices, the researchers tell according to Wired that workaround patches were easy to find; full fixes for all affected devices may take weeks or months. There is currently no option to disable Fast Pair on supported devices, other than installing the companion app and awaiting firmware updates.