CVE-2020-10135-BIAS

CVE-2020-10135 alias BIAS (attaque d'usurpation Bluetooth)

Il semble qu'après un certain temps et en surmontant quelques obstacles, j'ai pu réaliser l'attaque BIAS (Bluetooth Impersonation Attack) CVE-2020-10135. Usurpation de la connexion d'un Samsung S3 Neo+ vers un hôte Linux. Truc cool. MERCI à Internalblue et aux PoCs BIAS.

De mon point de vue, j'ai découvert que tout ce dont vous avez besoin pour réaliser l'attaque est l'adresse BT du dispositif usurpé qui était précédemment appairé et connecté à l'autre extrémité. Le reste peut être obtenu pour que le PoC fonctionne.

PoC/auteur(s) original(aux) : https://github.com/francozappa/bias

LOG```

No. Time Source Destination Protocol Length Info 1 0.000000 2f:d0:a5:b4 controller LMP 64 LMP_version_req

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 2 0.016282 controller 2f:d0:a5:b4 LMP 64 LMP_version_res

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 3 0.016293 2f:d0:a5:b4 controller LMP 64 LMP_features_req

Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 4 0.016295 controller 2f:d0:a5:b4 LMP 64 LMP_features_res

Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 5 0.032274 2f:d0:a5:b4 controller LMP 64 LMP_features_req_ext

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 6 0.032285 controller 2f:d0:a5:b4 LMP 64 LMP_features_res_ext

Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 7 0.032287 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 8 0.048306 2f:d0:a5:b4 controller LMP 64 LMP_host_connection_req

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 9 0.048313 controller host HCI_EVT 13 Rcvd Connect Request

Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Connect Request

No. Time Source Destination Protocol Length Info 10 0.048319 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 11 0.048415 host controller HCI_CMD 11 Sent Accept Connection Request

Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Command - Accept Connection Request

No. Time Source Destination Protocol Length Info 12 0.063970 controller host HCI_EVT 7 Rcvd Command Status (Accept Connection Request)

Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Command Status

No. Time Source Destination Protocol Length Info 13 0.080314 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 14 0.080320 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 15 0.096284 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 16 0.096294 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 17 0.256055 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 18 0.256066 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 19 0.256067 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 20 0.272129 2f:d0:a5:b4 controller LMP 64 LMP_accepted