Eavesdropping on AirPods?

FPF Logo for circles

Promoting press freedom in the 21st century

It’s the Digital Security Training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone has shared this newsletter with you, please subscribe here.

Freedom of the Press Foundation (CC BY 4.0)
Freedom of the Press Foundation (CC BY 4.0)

In the news

Apple released a firmware update patching a critical Bluetooth vulnerability in AirPods, AirPods Pro, AirPods Max, Powerbeats Pro, and Beats Fit Pro. According to its support page, an adversary in Bluetooth range could spoof as an intended source device for these wireless headphones. When the targeted headphones send a connection request to the spoofed device, it could eavesdrop on confidential conversations. Read more here.

What you can do

As long as your wireless headphones are charged and in Bluetooth range of your Apple device, there is no need to manually apply firmware updates. There has not been a documented case of a threat actor utilizing Bluetooth vulnerabilities to target journalists. However, there are general precautions you should take for all Bluetooth devices:

Get Notified. Take Action.

  • Be wary of sending Bluetooth connection requests in public spaces. Make sure to confirm that the device you are connecting to belongs to you.
  • If you don’t need Bluetooth, consider disabling it from your Settings app.
  • Finally, if this is still a concern for you, you can always use regular old wired headphones or earbuds. Keep in mind that such attacks are unlikely to occur for most individuals.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.



Kevin Pham

Digital Security Training Intern

Freedom of the Press Foundation

Donate to support press freedom

Your support is more important than ever.

Read more about Digital Security Digest

Beware fraudulent CrowdStrike emails

Last Friday, computer systems worldwide were taken down by a defective update from enterprise cybersecurity vendor CrowdStrike. In the wake of the outage, the U.S. Cybersecurity and Infrastructure Agency is warning of phishing emails, with attackers posing as CrowdStrike customer support.

What to do about AT&T breach

Around 110 million AT&T subscribers were affected by a data breach from May 1 to Oct. 31, 2022, TechCrunch reported.

Massive Authy leak, plus Proton Docs

The parent company for Authy, an application for two-factor authentication, has issued a critical security update to its Android and iOS users. According to BleepingComputer, hackers utilized leaked phone numbers from past data breaches to identify up to 33 million Authy users.