- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,220
A Creative column that decided to play the keyboard and hack your PC.
The column, connected to the computer via USB, suddenly turned into a bridge for remote burglary. Security specialist Rasmus Moorats found that the popular sound Blaster Katana V2X speaker system allows the attacker to download his own firmware on Bluetooth, and then execute commands on a connected PC without even touching the device.
The problem was solved by accident. After buying Sound Blaster Katana V2X, Moorats decided to study how the speaker is exchanging data with a computer. During the analysis, he discovered the proprietary Creative Transport Protocol (CTP), which allows you to control the backlight, equalizer and other functions of the device.
It turned out that the Bluetooth device can connect to the column without authentication and even without prior pairing. Moreover, one of the protocol commands allows you to download a new firmware. The manufacturer did not sign the firmware with a digital signature and did not add other verification mechanisms, so the column took the modified code without objection.
To begin with, the specialist downloaded a harmless version of the firmware, which simply displayed the word “patched” on the device display. Then attention was attracted by the operating system FreeRTOS, operating inside the column. FreeRTOS has a set of functions that allows the device to work as HID, which include keyboards, mice and other peripherals.
Text displayed on the column display (blog.nns.ee)
By default, HID was limited to playback and volume management. However, the specialist changed the USB descriptor of the device, adding keyboard functions. After that, the computer began to recognize the column as an additional input device, and the column was able to send key presses.
The next step was logical. Moorats forced the Bluetooth device to send commands to the column, and the column forced the functions of the keyboard to send commands to the computer. As a result, the specialist remotely updated the firmware through Bluetooth, rebooted the device and performed the “echo pwned” command on the connected computer.
The demonstration used a harmless team, but in a real attack, the attacker could open PowerShell and run malicious code. Moreover, the modified firmware is able to disable the mechanism of subsequent updates, which will make it difficult to attempt to remove the malware.
The situation is aggravated by the fact that Bluetooth remains active even in the sleepy mode of the column, and the standard way to completely disable the wireless interface is not provided.
In order for the column and connected computer to exchange data, authentication is provided. However, the defense was weak. The required response to the request can be extracted from the program supplied with the device. When the device is connected via Bluetooth, there is no such check at all.
The specialist reported the find of Creative Technology, but did not receive a response. After the intervention of the national response center CERT Singapore, the manufacturer still reacted. The company said it did not consider the described behavior to be a vulnerability.
The attack requires the attacker to be in the area of action of Bluetooth, so it is impossible to conduct it through the Internet. For successful hacking, the attacker needs to be nearby: in a nearby apartment, a neighboring office or the same room. However, the find shows that a regular Bluetooth speaker can be an unexpected tool for hacking a computer and raises the question of how many other wireless devices have similar hidden capabilities.
The column, connected to the computer via USB, suddenly turned into a bridge for remote burglary. Security specialist Rasmus Moorats found that the popular sound Blaster Katana V2X speaker system allows the attacker to download his own firmware on Bluetooth, and then execute commands on a connected PC without even touching the device.
The problem was solved by accident. After buying Sound Blaster Katana V2X, Moorats decided to study how the speaker is exchanging data with a computer. During the analysis, he discovered the proprietary Creative Transport Protocol (CTP), which allows you to control the backlight, equalizer and other functions of the device.
It turned out that the Bluetooth device can connect to the column without authentication and even without prior pairing. Moreover, one of the protocol commands allows you to download a new firmware. The manufacturer did not sign the firmware with a digital signature and did not add other verification mechanisms, so the column took the modified code without objection.
To begin with, the specialist downloaded a harmless version of the firmware, which simply displayed the word “patched” on the device display. Then attention was attracted by the operating system FreeRTOS, operating inside the column. FreeRTOS has a set of functions that allows the device to work as HID, which include keyboards, mice and other peripherals.
Text displayed on the column display (blog.nns.ee)
By default, HID was limited to playback and volume management. However, the specialist changed the USB descriptor of the device, adding keyboard functions. After that, the computer began to recognize the column as an additional input device, and the column was able to send key presses.
The next step was logical. Moorats forced the Bluetooth device to send commands to the column, and the column forced the functions of the keyboard to send commands to the computer. As a result, the specialist remotely updated the firmware through Bluetooth, rebooted the device and performed the “echo pwned” command on the connected computer.
The demonstration used a harmless team, but in a real attack, the attacker could open PowerShell and run malicious code. Moreover, the modified firmware is able to disable the mechanism of subsequent updates, which will make it difficult to attempt to remove the malware.
The situation is aggravated by the fact that Bluetooth remains active even in the sleepy mode of the column, and the standard way to completely disable the wireless interface is not provided.
In order for the column and connected computer to exchange data, authentication is provided. However, the defense was weak. The required response to the request can be extracted from the program supplied with the device. When the device is connected via Bluetooth, there is no such check at all.
The specialist reported the find of Creative Technology, but did not receive a response. After the intervention of the national response center CERT Singapore, the manufacturer still reacted. The company said it did not consider the described behavior to be a vulnerability.
The attack requires the attacker to be in the area of action of Bluetooth, so it is impossible to conduct it through the Internet. For successful hacking, the attacker needs to be nearby: in a nearby apartment, a neighboring office or the same room. However, the find shows that a regular Bluetooth speaker can be an unexpected tool for hacking a computer and raises the question of how many other wireless devices have similar hidden capabilities.
GET IN TOUCH WITH ME IF YOU’RE INTERESTED IN FRESH VALID
CREDIT CARDS 
CREDIT CARDS 
