CVE-2020-10135-BIAS

CVE 2020-10135 別名 BIAS (Bluetooth Impersonation Attack)

しばらくして、いくつかのハードルを乗り越えた後、BIAS（Bluetooth Impersonation Attack）CVE 2020-10135を実行することができました。Samsung S3 Neo+ の Linuxホストへの接続を偽装しました。すごいですね。Internalblue と BIAS PoCs に感謝します。

私の視点から分かったのは、攻撃を実行するのに必要なものはほぼすべて、以前に対象側とペアリングおよび接続されていた偽装デバイスのBTアドレスだけであるということです。残りはPoCを動作させるために取得できます。

PoC/原作者: https://github.com/francozappa/bias

ログ```

No. Time Source Destination Protocol Length Info 1 0.000000 2f:d0:a5:b4 controller LMP 64 LMP_version_req

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 2 0.016282 controller 2f:d0:a5:b4 LMP 64 LMP_version_res

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 3 0.016293 2f:d0:a5:b4 controller LMP 64 LMP_features_req

Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 4 0.016295 controller 2f:d0:a5:b4 LMP 64 LMP_features_res

Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 5 0.032274 2f:d0:a5:b4 controller LMP 64 LMP_features_req_ext

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 6 0.032285 controller 2f:d0:a5:b4 LMP 64 LMP_features_res_ext

Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 7 0.032287 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 8 0.048306 2f:d0:a5:b4 controller LMP 64 LMP_host_connection_req

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 9 0.048313 controller host HCI_EVT 13 Rcvd Connect Request

Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Connect Request

No. Time Source Destination Protocol Length Info 10 0.048319 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 11 0.048415 host controller HCI_CMD 11 Sent Accept Connection Request

Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Command - Accept Connection Request

No. Time Source Destination Protocol Length Info 12 0.063970 controller host HCI_EVT 7 Rcvd Command Status (Accept Connection Request)

Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Command Status

No. Time Source Destination Protocol Length Info 13 0.080314 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 14 0.080320 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 15 0.096284 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 16 0.096294 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 17 0.256055 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 18 0.256066 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 19 0.256067 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 20 0.272129 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 20: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 21 0.400080 controller host HCI_EVT 11 Rcvd Role Change