Apple: Airpods Pro Device Link without Key

### Summary The Apple Airpods Pros will initiate profile connections to a host previously paired that claims not to have a link key. (Other versions have not been tested) This can be exploited by a malicious host capturing the airpods page request to its previously paired host and simply replying with Link Key Request Negative Reply during the link authentication procedure. The result is the Simple Pairing (without bonding or MITM Protection) procedure is performed to encrypt the connection and the profile connections are established, allowing the malicious host to open an HFP connection and exploit an open microphone. Since the airpods had a previously established link key with the host, it likely should have terminated the link when the link could not be authenticated using the previously established link key. This is very similar to the BlueDump vulnerability where a malicious actor can force a vulnerable device to “dump” their previously established link key. ### Severity High - This vulnerability allows for a malicious actor to connect to Airpods Pro without a valid link key. ### Proof of Concept 1. Connection request from the airpods ``` > HCI Event: Connect Request (0x04) plen 10 #9424 [hci0] 09:30:06.736875 Address: D0:65:44:C6:2E:36 (OUI D0-65-44) Class: 0x240418 Major class: Audio/Video (headset, speaker, stereo, video, vcr) Minor class: Headphones Rendering (Printing, Speaker) Audio (Speaker, Microphone, Headset) Link type: ACL (0x01) < HCI Command: Accept Connection Request (0x01|0x0009) plen 7 #9425 [hci0] 09:30:06.737533 Address: D0:65:44:C6:2E:36 (OUI D0-65-44) Role: Central (0x00) > HCI Event: Command Status (0x0f) plen 4 #9426 [hci0] 09:30:06.738590 Accept Connection Request (0x01|0x0009) ncmd 1 Status: Success (0x00) > HCI Event: Role Change (0x12) plen 8 #9427 [hci0] 09:30:06.859781 Status: Success (0x00) Address: D0:65:44:C6:2E:36 (OUI D0-65-44) Role: Central (0x00) > HCI Event: Connect Complete (0x03) plen 11 #9429 [hci0] 09:30:07.053810 Status: Success (0x00) Handle: 256 Address: D0:65:44:C6:2E:36 (OUI D0-65-44) Link type: ACL (0x01) Encryption: Disabled (0x00) < HCI Command: Read Remote Version Information (0x01|0x001d) plen 2 #9430 [hci0] 09:30:07.054279 Handle: 256 < ACL Data TX: Handle 256 flags 0x00 dlen 10 #9431 [hci0] 09:30:07.054450 L2CAP: Information Request (0x0a) ident 2 len 2 Type: Extended features supported (0x0002) > HCI Event: Command Status (0x0f) plen 4 #9432 [hci0] 09:30:07.054745 Read Remote Version Information (0x01|0x001d) ncmd 1 Status: Success (0x00) < HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2 #9433 [hci0] 09:30:07.054993 Handle: 256 > HCI Event: Command Status (0x0f) plen 4 #9434 [hci0] 09:30:07.055772 Read Remote Supported Features (0x01|0x001b) ncmd 1 Status: Success (0x00) < HCI Command: Write Link Policy Settings (0x02|0x000d) plen 4 #9435 [hci0] 09:30:07.055950 Handle: 256 Link policy: 0x0005 Enabl

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-8jpp-wj9j-gfmg
• github.com/google/security-research