alt Hacker News>Email from SingCERT stating vendor "do not consider this to be a vulnerability, as it does not present a cybersecurity risk."
So wirelessly writing custom firmware to someone else's device that is connected via USB to their computer without even needing to pair is not a security vulnerability. Yea.
Replies
That answer will change very quickly, if someone marches to a Creative show room, sales event or CES and "patches" all of their devices.
Sounds like Microsoft too:
This quote on risk seems to completely misunderstand the concept of risk. First we have a vulnerability ( IMHO that is equals a hazard), then we assign both impact and probability and only then we get risk. By definition there are IMHO always vulnerabilities with low impact or low probability and thus low risk. While CVEs have some score, the actual risk and later accepting those risks before or after mitigations is up to the use case to define. No risk => no vulnerability is flawed reasoning by design. No vulnerability => no risk, I think is the only thing we can agree on.
Yeah, but we already sold the device, so it's someone else's problem. Now if they were paying us a subscription fee..
AND being able to further reprogram the device to gain control of the PC.
This is negligence of the highest kind.
> SingCERT dropped the case
I expect some dodgy company to try to shirk out of it, I don't expect a country's cybersecurity agency to do so
The vendor response is the more worrying part
"You can just make it type words, what's the risk in that?"
Makes you wonder what other peripheral companies out there are also operating with seemingly no security team. There must be other vulnerabilities like this just waiting to be discovered.
My brother was awoken one morning at 2am because some neighborhood kids connected to his bluetooth speaker and blasted fart sounds on loop at max volume, and that's literally only the absolute tippy top of the malicious bluetooth use iceberg.