Researcher hacks Sound Blaster Katana V2X speaker into a remote Rubber Ducky

A security researcher has published details of flaws in the Creative Sound Blaster Katana V2X sound bar that let an attacker within roughly 15 metres take over the device over Bluetooth — without pairing with it or touching it — and use it to send keystrokes to the computer it is plugged into.

The project started as an effort to write a Linux tool for controlling the USB-connected speaker. It ended with custom firmware that turns the device into what the author describes as a remotely operated Rubber Ducky.

No authentication over Bluetooth

Creative's desktop app controls the speaker through a proprietary command set the researcher calls CTP (Creative Transport Protocol). Over USB, CTP requires a challenge-response authentication step, using a static key that can be derived from the binaries shipped with the Creative app. Over Bluetooth, that protection is absent.

By sniffing the traffic of the vendor's mobile app, he found that pairing data was written to one BLE characteristic and read from another. He then connected to the speaker from his laptop without pairing, wrote a CTP command that reads the firmware version, and got the full version string back. Any device in range can therefore send CTP commands to the speaker.

Unsigned firmware updates

Firmware updates also run over CTP. The container holds a bootloader with a recovery mode, the main firmware image and a SHA-256 checksum appended at the end. There is no signature check: the device accepts modified firmware as long as that checksum is correct. He confirmed this by replacing the "WELCOME" string shown on the speaker's display with "PATCHED".

Uploading a modified image over Bluetooth took about ten minutes, after which the speaker rebooted showing his patched text. Because the sound bar already presents itself to the PC as a USB human interface device for volume and media control, he was able to append a second report descriptor making it appear as a keyboard and reuse an existing routine for sending HID data. His payload overwrites an unused diagnostic task, waits about 20 seconds for the USB subsystem to come up, types echo pwned and presses enter, with roughly 20 milliseconds between keystrokes. A real attacker could instead open a shell, paste a malicious command and disable the update routine so the firmware cannot be wiped.

Vendor response

The researcher reported the issues to Singapore's SingCERT after two attempts to reach Creative through its support form failed; he notes the company has no public security contact. Creative took nearly two months to reply and told SingCERT on 3 June that it "do not consider this to be a vulnerability, as it does not present a cybersecurity risk". The case was closed and no vendor patch exists — the latest firmware remains vulnerable.

As a partial remedy he released a tool that downloads the official firmware, patches it in memory to block CTP over Bluetooth and uploads it to a USB-connected Katana V2X. The fix likely breaks the vendor's mobile app, and Bluetooth stays on even in sleep mode, with no apparent way to disable it.