45
45
55
30
30
30
30
30
30
30
55
60
30
30
35
57
gr-PHYSEC: Real-time Channel-based Key Generation for Physical Layer Secure Wireless Communications
gr-PHYSEC GNU Radio module derives symmetric encryption keys from wireless channel randomness using a neural network, validated on robotic platforms with ADALM-Pluto SDRs.
The paper introduces gr-PHYSEC, a GNU Radio out-of-tree module for real-time physical-layer key generation that derives symmetric keys from the wireless channel's inherent randomness instead of pre-shared secrets. A trained neural network extracts channel features between trusted parties during probe exchanges; features are quantized into binary keys, reconciled via Reed-Solomon encoding, and secured with SHA-512 hashing before direct use for encryption. Real-world experiments at the FAU CAAI connected robotics testbed using ADALM Pluto software-defined radios and NVIDIA Jetson Orin demonstrated low key disagreement rates and NIST-verified randomness. Source code is publicly available on GitHub.
25
60
47
42
30
60
30
30
30
30
30
60
30
47
VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.
24
Researchers open-source a Wi-Fi cyber range for security training
NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.
Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.
28
55
60
47
60
50
D-Link addressed three critical RCE in wireless router models
60
60
30