CVE 2020-10135 又名 BIAS（蓝牙冒充攻击）
看起来经过一段时间并费了一些周折后，我成功执行了 BIAS（蓝牙冒充攻击）CVE-2020-10135。冒充了 Samsung S3 Neo+ 与 Linux 主机的连接。很酷的东西。感谢 Internalblue 和 BIAS PoC。
从我的角度来看，我发现执行该攻击几乎只需要被冒充设备的 BT 地址，该设备此前已与另一端配对并连接。其余信息你都可以获取，以便 PoC 正常工作。
PoC/原始作者: https://github.com/francozappa/bias
日志```
No. Time Source Destination Protocol Length Info 1 0.000000 2f:d0:a5:b4 controller LMP 64 LMP_version_req
Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 2 0.016282 controller 2f:d0:a5:b4 LMP 64 LMP_version_res
Frame 2: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 3 0.016293 2f:d0:a5:b4 controller LMP 64 LMP_features_req
Frame 3: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 4 0.016295 controller 2f:d0:a5:b4 LMP 64 LMP_features_res
Frame 4: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 5 0.032274 2f:d0:a5:b4 controller LMP 64 LMP_features_req_ext
Frame 5: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 6 0.032285 controller 2f:d0:a5:b4 LMP 64 LMP_features_res_ext
Frame 6: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 7 0.032287 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req
Frame 7: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 8 0.048306 2f:d0:a5:b4 controller LMP 64 LMP_host_connection_req
Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 9 0.048313 controller host HCI_EVT 13 Rcvd Connect Request
Frame 9: 13 bytes on wire (104 bits), 13 bytes captured (104 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Connect Request
No. Time Source Destination Protocol Length Info 10 0.048319 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res
Frame 10: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 11 0.048415 host controller HCI_CMD 11 Sent Accept Connection Request
Frame 11: 11 bytes on wire (88 bits), 11 bytes captured (88 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Command - Accept Connection Request
No. Time Source Destination Protocol Length Info 12 0.063970 controller host HCI_EVT 7 Rcvd Command Status (Accept Connection Request)
Frame 12: 7 bytes on wire (56 bits), 7 bytes captured (56 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth HCI Event - Command Status
No. Time Source Destination Protocol Length Info 13 0.080314 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset
Frame 13: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 14 0.080320 2f:d0:a5:b4 controller LMP 64 LMP_accepted
Frame 14: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 15 0.096284 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req
Frame 15: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 16 0.096294 2f:d0:a5:b4 controller LMP 64 LMP_power_control_req
Frame 16: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 17 0.256055 controller 2f:d0:a5:b4 LMP 64 LMP_power_control_res
Frame 17: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 18 0.256066 controller 2f:d0:a5:b4 LMP 64 LMP_slot_offset
Frame 18: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 19 0.256067 controller 2f:d0:a5:b4 LMP 64 LMP_switch_req
Frame 19: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 20 0.272129 2f:d0:a5:b4 controller LMP 64 LMP_accepted
Frame 20: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface bluetooth1, id 0 Bluetooth Bluetooth HCI H4 Bluetooth H4 Serial Broadcom Vendor Specific
No. Time Source Destination Protocol Length Info 21 0.400080 controller host HCI_EVT 11 Rcvd Role Change
