ymsniper/whisper_bully

Whisper Bully is a Bluetooth security research tool written in Python. It targets devices that advertise Google's Fast Pair feature, and it demonstrates three attack stages the author says are not fixed by an existing patch known as CVE-2025-36911. The first stage extracts a device's permanent hardware address. Normally a Bluetooth device hides this address behind a rotating, temporary one for privacy. The tool connects to the device using a plain Bluetooth connection, then reads a cached value from the Linux Bluetooth stack to recover the real, permanent address, without needing to interact with the Fast Pair protocol at all. The second stage floods the target device with rapid connect and disconnect attempts using a modified version of a tool called l2flood. This can make the device unresponsive to normal Bluetooth connections while the flood runs, though the README states the device fully recovers once the flood stops. The third stage tries to pair with the target while it is recovering from the flood. During that recovery window, the tool argues the device accepts a standard pairing request without the extra security check that the Fast Pair protocol would normally require, resulting in a bond that persists even after the flood ends. The project requires Linux with root access, a working BlueZ Bluetooth stack, Python 3.7 or newer, and the separately maintained l2flood tool for the flooding and hijack stages. The README includes an explicit legal warning stating the tool is for research on devices the user owns or has written authorization to test, and that unauthorized use can be a federal crime under the Computer Fraud and Abuse Act. The full README is longer than what was shown.