# ble_peripheral_sim.py - Simulated BLE peripheral with weak RPA verification
import asyncio, random, hashlib
from bleak import BleakServer, BleakScanner
# (Simplified - we'll use a basic socket to simulate BLE bonding)
# Store bonded IRK (Identity Resolving Key)
irk = b'\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10'
def resolve_rpa(rpa, irk):
# This is a stub: real resolution uses AES-128; vulnerability: attacker can brute-force or replay
# Assume the peripheral accepts any RPA that decrypts to a known hash without replay protection.
return True # always accept for demo
# Simulating the peripheral: wait for connection, check RPA, if resolved, trust.
print("Peripheral running, accepting any RPA...")
使用可解析私有地址（RPA）的低功耗蓝牙（BLE）外设未实现重放缓存。攻击者观察到有效的 RPA 后，可以断开已配对的设备，并使用相同的 RPA 重新连接，从而冒充受信任的设备。
运行模拟：
python ble_peripheral_sim.py
# In another terminal:
python exploit_ble_spoof.py
该漏洞利用会捕获广播的 RPA，并以受信任设备的身份重新连接。