CVE-2020-10135-BIAS

CVE 2020-10135 auch bekannt als BIAS (Bluetooth-Impersonationsangriff)

Es scheint, dass ich nach einiger Zeit und durch einige Hindernisse in der Lage war, BIAS (Bluetooth-Impersonationsangriff) CVE 2020-10135 durchzuführen. Ich habe die Verbindung eines Samsung S3 Neo+ zu einem Linux-Host nachgeahmt. Coole Sache. DANKE an Internalblue und die BIAS PoCs.

Aus meiner Perspektive habe ich herausgefunden, dass man für den Angriff so ziemlich nur die BT-Adresse des nachgeahmten Geräts benötigt, das zuvor mit dem anderen Ende gekoppelt und verbunden war. Den Rest kann man sich besorgen, damit der PoC funktioniert.

PoC/ursprüngliche Autoren: https://github.com/francozappa/bias

LOG```

No. Time Source Destination Protocol Length Info 1 0.000000 2f:d0:a5:b4 controller LMP 64 LMP_version_req

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 2 0.016282 controller 2f:d0:a5:b4 LMP 64 LMP_version_res

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 3 0.016293 2f:d0:a5:b4 controller LMP 64 LMP_features_req

Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 4 0.016295 controller 2f:d0:a5:b4 LMP 64 LMP_features_res

Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 5 0.032274 2f:d0:a5:b4 controller LMP 64 LMP_features_req_ext

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 6 0.032285 controller 2f:d0:a5:b4 LMP 64 LMP_features_res_ext

Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 7 0.032287 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 8 0.048306 2f:d0:a5:b4 controller LMP 64 LMP_host_connection_req

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 9 0.048313 controller host HCI_EVT 13 Rcvd Connect Request

Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Connect Request

No. Time Source Destination Protocol Length Info 10 0.048319 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 11 0.048415 host controller HCI_CMD 11 Sent Accept Connection Request

Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Command - Accept Connection Request

No. Time Source Destination Protocol Length Info 12 0.063970 controller host HCI_EVT 7 Rcvd Command Status (Accept Connection Request)

Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Command Status

No. Time Source Destination Protocol Length Info 13 0.080314 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 14 0.080320 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 15 0.096284 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 16 0.096294 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 17 0.256055 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 18 0.256066 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 19 0.256067 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 20 0.272129 2f:d0:a5:b4 controller LMP 64 LMP_accepted