artifact_metadata.txt

badge = "r"
artifact_url = "https://github.com/KULeuven-COSIC/WhisperPair"
cd = "c"
citation = "@inproceedings{whisperpair2026,\n  author={Duttagupta, Sayon and Wyns, Seppe and Antonijević, Nikola and Singelée, Dave and Preneel, Bart},\n  booktitle={2026 IEEE Symposium on Security and Privacy (SP)},\n  title={One Tap to Hijack Them All: A Security Analysis of the Google Fast Pair Protocol},\n  year={2026},\n}"
license_url = "https://github.com/KULeuven-COSIC/WhisperPair/blob/main/LICENSE"
infrastructure_constraints = "Our artifact is a testing harness for Google Fast Pair devices, which requires a Bluetooth adapter. To reproduce our results, physical access to (unpatched) real-world Fast Pair devices is required."
infrastructure_access = "Our testing harness is designed to run on a local Linux machine, interacting with nearby Fast Pair devices using the BlueZ protocol stack."
install_script = "https://github.com/KULeuven-COSIC/WhisperPair/blob/main/build.sh"
use = "Running our artifact requires a Linux machine with a Bluetooth adapter. Although it should be compatible with any Linux machine with the BlueZ protocol stack installed, we recommend a Raspberry Pi 4, which is what we used during our experiments. Our testing harness can evaluate any Fast Pair-compatible accessory, even devices that were not included in our study. The materials are provided to enable reproducibility of our evaluation and to assist researchers in performing defensive testing. As the code in this repository demonstrates vulnerabilities in consumer accessories, do not use it to attack third-party devices without clear written permission. The authors performed all experiments on devices owned by the project team or donated with informed consent."
destructive = "If a Fast Pair device does not enforce the pairing state predicate check correctly, this harness can perform an unauthorized pairing. Doing so establishes a BR/EDR pairing with the host, interrupting the victim's connection. This access could be used to inject (possibly loud) audio, or activate and record the microphones without user consent. The attack does not damage the target device in any way."
claim1 = "Of the 25 accessories evaluated in our study, 68% fail the pairing state predicate."
script1 = "https://github.com/KULeuven-COSIC/WhisperPair/blob/main/README.md"
expected1 = "Validating this claim requires physical access to the devices included in our study. Moreover, the devices should not have received recent software updates, as many vendors have released patches. We acknowledge that procuring these devices may hinder the reproduction process, and we understand that receiving the Artifact Reproduced badge may not be possible as a result."
hw = "The harness requires a Bluetooth adapter that supports dual-mode Bluetooth Low Energy and Bluetooth BR/EDR. We recommend a Raspberry Pi 4. Reproducing our results requires access to unpatched accessories with Google Fast Pair support."
sw = ""
api = ""
gui = "y"
readme = "https://github.com/KULeuven-COSIC/WhisperPair/blob/main/README.md"