Hacking Your PC Through Speakers: BadUSB Without Touching the Computer

Remember when you tried to hack a PC by yelling at it? No? Well, it turns out modern speakers can do it for you. Researchers from NNS have published a demo of the Katana BadUSB attack, which turns an ordinary audio speaker into a hacking tool. And yes, you don't need to touch the computer.

How does it work? The attacker connects a special device to the speaker (or uses an already compromised speaker), which sends a signal through the audio cable that mimics keyboard presses. The computer thinks it's a keyboard and executes commands. Voila — you watch your PC open a terminal and type commands to the beat of the music.

Of course, this isn't the kind of hack where you can compromise a PC just by cranking up the volume. But if an attacker already has physical access to your speaker (or you connected a "smart" speaker from a shady source), your computer is at risk. Especially if you're one of those who connect speakers via USB — then the attack becomes even easier.

Technically, it's a variation of the BadUSB attack, but with an unexpected vector — through audio. The developers claim you can protect yourself by disabling autorun for devices or using physical USB port blockers. But honestly, it's easier to not connect dubious speakers to your PC, especially if they have RGB and promise "enhanced bass."

METABYTE Studio comment: We've always said peripherals are a security blind spot. Now even a speaker can be a spy. Good thing our projects go through audits for such non-obvious vectors — so your PC doesn't start playing sinister music on its own.