The Hitchhikers Guide to Hacking Cheap Bluetooth Speakers
2026-09-18 , Pupin

The story so far: In the beginning closed Hard- and Software was created.
This has made a lot of people very angry and been widely regarded as a bad move.
(Wrong book, I know...)


Deep inside the shelves of our nearest IKEA store, hidden between smart appliances, there lies the cheap IKEA KALLSUP, a Bluetooth speaker, that promises limitless possibilities. Well, maybe not limitless. But it does allow synchronization of up to 100 devices. Supposedly at least, we did not buy 100 of them. However, it is not this promise of connectivity that caught our attention, but the curiosity about the intricacies of the internals of such a cheap device.

Follow us along on our journey into the unknown, hitchhiking on the experiences made by those who came before us, while we dive into reverse engineering of cheap, undocumented chips, analyzing firmware, and other general tomfoolery.

PhD student at UniVie and CTF player at We_0wn_y0u. Passionate for reverse engineering, graphics programming and all kinds of low-level software development.

This speaker also appears in:

Senior researcher at SBA Research in Vienna, dealing mostly with systems and firmware stuff. Dabbled in pentesting as well as teaching at TU Wien. Collecting flags with We_0wn_Y0u for well over a decade. Tinkering with all kinds of hardware (when there's time left).

This speaker also appears in: