Pwnd Blaster: Hacking your PC using your speaker without ever touching it

submitted by

https://blog.nns.ee/2026/06/03/katana-badusb/

25
213
3

Log in to comment

Hot Top New Old

Awesome write up.

Allowing arbitrary firmware updates without any signature validation, over Bluetooth, even unpaired and in sleep mode, and without any authentication is absolutely wild and should be criminal negligence.

It took Creative nearly two months to respond to SingCERT. Unfortunately, their response was that “they do not consider this to be a vulnerability, as it does not present a cybersecurity risk”

What a foolish response. The guy wasn’t asking for money and gave them everything they would need to make a patched firmware.

 reply
80

“It’s not a vulnerability, no I’m not crying”

 reply
40

“You’re the vulnerability”

 reply
4

Came to comment the same.

Getting in touch with Creative was a frustrating process.

They do not have any security contacts. In fact, I wasn’t even able to find regular contacts that wasn’t just a support form on their website. I tried (two times) to get in contact with them via the web form before giving up and contacting SingCERT to act as an intermediary, hoping they would have better luck reaching Creative.

Initially, SingCERT didn’t seem to be able to get in contact with Creative either. It took Creative nearly two months to respond to SingCERT. Unfortunately, their response was that “they do not consider this to be a vulnerability, as it does not present a cybersecurity risk”. I don’t know how they reached this conclusion, but it became clear that Creative had no interest in responding to or addressing this issue.

That and it has a microphone built in.

 reply
23

Well I won’t be buying another creative product ever again

 reply
8

I didn’t even know that was still an option.

 reply
3

I don’t understand how this can still happen with a well known brand in 2026. Personally the microphone is the least concerning aspect of this finding, since a Bluetooth connection would still be required. With more dedicated research, the BadUSB aspect is far more concerning in my book. Plug the speaker into a computer, even once and only to charge, and the computer is pwned? Preventing any future patching? I don’t know how I could ever trust one of these devices going forward.

 reply
6

“does not present a cybersecurity risk…” to them.

 reply
18

I suppose that depends on your definition of a cybersecurity risk. Unfortunately it likely won’t matter to them unless it starts affecting their bottom line.

 reply
3

The way BLE (Bluetooth Low Energy) works is that each device has various registers (called GATT characteristics) that, if you’re connected to the device, you can write to, read, subscribe to notifications for, and so on. What’s important to note is that to connect to a device, you don’t need to (necessarily) pair with it. You can often just connect with a device and immediately start reading and writing data to characteristics. Pairing establishes encryption, but a connection can be made without it.

To my surprise, upon reading the characteristic 9e9daaeb-3a10-4fe8-b69f-7397aff77886, I was greeted with the full version string. This means anyone can just connect to any Katana V2X over Bluetooth and start sending CTP commands to it, reading information, changing settings, etc.

I thought of the implications for a bit. The speaker has a microphone. An attacker could, theoretically, upload a custom firmware that effectively turns the speaker into a covert monitoring device, listening in on conversations and forwarding them to a receiver over Bluetooth.

What was more interesting to me was the fact that the speaker is, in a standard setup, connected to a PC over USB. It’s by all means a trusted USB device.

What if we wrote custom firmware that forced the speaker into acting as a keyboard, sending keystrokes for opening up the terminal and executing arbitrary commands? We would turn the speaker into a Rubber Ducky, but remotely, without ever having to plug anything into either the speaker or the PC.

 reply
31

At first, I thought it was an attack using audio only. That would have been crazy impressive.

 reply
9

<sad modem noises>

 reply
6

I enjoy knowing people like this exist.

 reply
3

Amazing job and beautifully written! Now I kind of want one of these speakers lol.

 reply
3

My speakers can’t get hacked like this luckily.

They use a headphone jack line.

 reply
5
edited

As someone who’s done only minimal hacking I found this fascinating and very readable. I could skim the parts I was only sort of familiarish with and still follow the overall plot, and I felt like with a little research I could actually do what he was describing. Probably the best-written piece about hardcore hackery I’ve ever read!

 reply
4

That was a great read, and wild that all of that was possible.

 reply
2

firmwares

And I’m out. If you can’t spell a word, I don’t need to hear you talk about it.

 reply
-51
OP

Dude, the author is from Estonia. English is therefore not his native language. Fuck you for attacking non-native speakers because of some minor grammar error.

 reply
22

Spell-check is so weird.

 reply
-14

Well, we all bring joy to a room. Some when they enter, and others, as yourself, when they leave.

 reply
10

I don’t understand the purpose of your comment. That word exclusively appears twice in the twelfth paragraph, and makes complete sense in context. I think the write up is incredibly detailed but also easy to understand.

 reply
9

We do not applaud a tenor who cannot clear his throat.

 reply
-12

I’m sorry to say it but now I’m even more confused.

 reply
1
edited

Ok bye 👋

Don’t let the dors hit you on the way aut

 reply
7
Insert image