CVE-2020-10135-BIAS

CVE 2020-10135, 일명 BIAS(블루투스 가장 공격)

얼마간의 시간과 우여곡절 끝에 BIAS(블루투스 가장 공격) CVE 2020-10135를 수행할 수 있었습니다. Samsung S3 Neo+ 연결을 Linux 호스트로 가장했습니다. 멋지네요. Internalblue와 BIAS PoC에 감사드립니다.

제 관점에서 보면 공격을 수행하는 데 필요한 것은 거의 전부가 상대방과 이전에 페어링 및 연결되었던 가장된 장치의 BT 주소입니다. 나머지는 PoC가 작동하도록 얻을 수 있습니다.

PoC/원작자: https://github.com/francozappa/bias

로그```

No. Time Source Destination Protocol Length Info 1 0.000000 2f:d0:a5:b4 controller LMP 64 LMP_version_req

Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 2 0.016282 controller 2f:d0:a5:b4 LMP 64 LMP_version_res

Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 3 0.016293 2f:d0:a5:b4 controller LMP 64 LMP_features_req

Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 4 0.016295 controller 2f:d0:a5:b4 LMP 64 LMP_features_res

Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 5 0.032274 2f:d0:a5:b4 controller LMP 64 LMP_features_req_ext

Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 6 0.032285 controller 2f:d0:a5:b4 LMP 64 LMP_features_res_ext

Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 7 0.032287 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 8 0.048306 2f:d0:a5:b4 controller LMP 64 LMP_host_connection_req

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 9 0.048313 controller host HCI_EVT 13 Rcvd Connect Request

Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Connect Request

No. Time Source Destination Protocol Length Info 10 0.048319 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 11 0.048415 host controller HCI_CMD 11 Sent Accept Connection Request

Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Command - Accept Connection Request

No. Time Source Destination Protocol Length Info 12 0.063970 controller host HCI_EVT 7 Rcvd Command Status (Accept Connection Request)

Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Command Status

No. Time Source Destination Protocol Length Info 13 0.080314 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 14 0.080320 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 15 0.096284 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 16 0.096294 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req

Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 17 0.256055 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res

Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 18 0.256066 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset

Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 19 0.256067 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req

Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 20 0.272129 2f:d0:a5:b4 controller LMP 64 LMP_accepted

Frame 20: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific

No. Time Source Destination Protocol Length Info 21 0.400080 controller host HCI_EVT 11 Rcvd Role Change