ap425q/whisper-pairA Vulnerablity Scanner for Whisper Pair (CVE-2025-36911)
Security research tool for detecting Bluetooth accessories vulnerable to WhisperPair attacks
🌐 WhisperPair Research • 📦 Installation • 🚀 Usage • 🔬 Technical Details
This tool is for authorized security testing and research only. Testing devices without explicit authorization may violate laws in your jurisdiction. Only test devices you own or have permission to test.
Google Fast Pair enables one-tap pairing and account synchronisation across supported Bluetooth accessories. While Fast Pair has been adopted by many popular consumer brands, researchers discovered that many flagship products have not implemented Fast Pair correctly, introducing a flaw that allows an attacker to hijack devices and track victims using Google's Find Hub network.
WhisperPair is a family of practical attacks that leverages a flaw in the Fast Pair implementation on flagship audio accessories. The findings show how a small usability 'add-on' can introduce large-scale security and privacy risks for hundreds of millions of users.
📖 For the full research paper and details, visit whisperpair.eu
WhisperPair enables attackers to forcibly pair a vulnerable Fast Pair accessory (e.g., wireless headphones or earbuds) with an attacker-controlled device without user consent. This gives an attacker complete control over the accessory, allowing them to:
Attack Performance:
- ⏱️ Median time: 10 seconds
- 📏 Tested range: Up to 14 metres
- 🚫 No physical access required
Some devices also support Google's Find Hub network, enabling users to find lost accessories using crowdsourced location reports from other Android devices. However, if an accessory has never been paired with an Android device, an attacker can add the accessory to their own Google account, allowing them to track the user via the compromised accessory.
The victim may see an unwanted tracking notification after several hours or days, but this notification will show their own device. This may lead users to dismiss the warning as a bug, enabling an attacker to track the victim for an extended period.
The flaw stems from many accessories failing to enforce a critical step in the pairing process.
To start the Fast Pair procedure, a Seeker (a phone) sends a Key-Based Pairing (KBP) message to the Provider (an accessory) indicating that it wants to pair. According to the Fast Pair specification:
"If the accessory is not in pairing mode, it should disregard such messages."
However, many devices fail to enforce this check in practice, allowing unauthorised devices to start the pairing process. After receiving a reply from the vulnerable device, an attacker can finish the Fast Pair procedure by establishing a regular Bluetooth pairing.
Byte 0: Message Type (0x00 = KBP Request)
Byte 1: Flags
Bit 0: Request device action
Bit 4: Request bonding
Bytes 2-7: Provider's BLE address (6 bytes)
Bytes 8-15: Random salt (should be encrypted with shared secret)
A patched device will verify the salt is properly encrypted using an ECDH-derived shared secret. A vulnerable device accepts any 16-byte payload without validation.
This attack exploits the fact that non-Android devices do not perform the Fast Pair procedure when they connect to an accessory. Android devices write an Account Key to the accessory after pairing has completed. This key establishes ownership—the first key written is marked as the Owner Account Key.
Therefore, if the victim has never connected their accessory to an Android device, the attacker will be marked as the owner after writing their account key.
WhisperPair is not an isolated issue. Research shows that multiple devices, vendors, and chipsets are affected. This demonstrates a systemic failure rather than individual developer error. Insecure implementations reached the market at scale, showing a chain of compliance failures across three levels:
| Level | Status |
|---|---|
| Implementation | ❌ Failed |
| Validation | ❌ Failed |
| Certification | ❌ Failed |
Many Fast Pair certified devices from various manufacturers have been found vulnerable:
⚠️ This list is not exhaustive. Many more devices may be affected.
The only way to fix this vulnerability is by installing a software update issued by the manufacturer of the accessory.
Although many manufacturers have released patches for their impacted devices, software updates may not yet be available for every vulnerable device. We encourage researchers and users to verify patch availability directly with the manufacturer.
cd fastpair-scanner
# Create virtual environment (recommended)
python -m venv venv
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Basic scan (10 seconds)
python main.py scan
# Extended scan (30 seconds)
python main.py scan -d 30
Scan and automatically test all discovered devices:
python main.py scan --mass-test
python main.py test AA:BB:CC:DD:EE:FF
python main.py -v scan --mass-test
╔══════════════════════════════════════════════════════════════╗
║ Fast Pair Vulnerability Scanner ║
║ CVE-2025-36911 Detection Tool ║
╚══════════════════════════════════════════════════════════════╝
Scanning for Fast Pair devices (10.0s)...
────────────────────────────────────────────────────────────────
███░ 5D:55:42:37:D7:60 - OnePlus Buds 3 [PAIRING]
Model ID: 347C9F
Testing 1 device(s) for CVE-2025-36911...
[1/1] Testing OnePlus Buds 3
Connected, discovering services...
Found KBP characteristic, sending test request...
🔴 VULNERABLE! Device accepted unencrypted KBP request
────────────────────────────────────────────────────────────────
Summary:
Total devices: 1
Vulnerable: 1
This tool tests devices using the following method:
0xFE2C)...1234...)This software is provided for educational and authorized security testing purposes only. The authors are not responsible for misuse of this tool. Always obtain proper authorization before testing any devices.
MIT License - See LICENSE for details.
Based on research from whisperpair.eu
| Property | Value |
|---|
| Attack Time | ~10 seconds (median) |
| Range | Up to 14 metres tested |
| Requirements | Commodity hardware |
| User Interaction | None required |
| Physical Access | Not needed |
| Manufacturer | Known Affected Models |
|---|
| OnePlus | Buds 3, Buds Pro 2, Buds Z |
| Pixel Buds Pro, Pixel Buds A-Series | |
| Samsung | Galaxy Buds2 Pro, Galaxy Buds FE |
| JBL | Various models |
| Sony | Various models |