BIAS Attack - Revision history

SVeseli: /* Requirements */

2020-12-21T19:46:37Z

Requirements

← Older revision		Revision as of 19:46, 21 December 2020
Line 13:		Line 13:
	* CYW920819 devboard		* CYW920819 devboard
	* Google Pixel 2		* Google Pixel 2
	* Linux laptop that can parse diagnostic messages from CYW920819 devboard & run internalblue. Can be achieved by using vanilla linux-4.14.111 kernel compiled with provided modifications of github.		* Linux laptop that can parse diagnostic messages from CYW920819 devboard and run internalblue. Can be achieved by using vanilla linux-4.14.111 kernel compiled with provided modifications of github.

	== Perform Attack ==		== Perform Attack ==

SVeseli: /* Counter Measures */

2020-12-21T19:46:13Z

Counter Measures

← Older revision		Revision as of 19:46, 21 December 2020
Line 31:		Line 31:
	* Start a connection from the attack device to the victim (BIAS master impersonation)		* Start a connection from the attack device to the victim (BIAS master impersonation)

	== ~~Counter Measures~~ ==		== Countermeasures ==
	To reduce the lack of integrity protection during secure connection establishment, the standard should force to use the long term key to protect the connection establishment. Before creating a secure connection the long term key should be available. The standard should force to always use the legacy authentication procedure mutually.		To reduce the lack of integrity protection during secure connection establishment, the standard should force to use the long term key to protect the connection establishment. Before creating a secure connection the long term key should be available. The standard should force to always use the legacy authentication procedure mutually.

	== References ==		== References ==

SVeseli: /* Requirements */

2020-12-21T19:10:13Z

Requirements

← Older revision		Revision as of 19:10, 21 December 2020
Line 13:		Line 13:
	* CYW920819 devboard		* CYW920819 devboard
	* Google Pixel 2		* Google Pixel 2
	* Linux laptop that can parse diagnostic messages from CYW920819 devboard & run internalblue. Can be ~~accomplished~~ by using vanilla linux-4.14.111 kernel compiled with provided modifications of github.		* Linux laptop that can parse diagnostic messages from CYW920819 devboard & run internalblue. Can be achieved by using vanilla linux-4.14.111 kernel compiled with provided modifications of github.


	== Perform Attack ==		== Perform Attack ==

SVeseli: /* Summary */

2020-12-21T19:09:21Z

Summary

← Older revision		Revision as of 19:09, 21 December 2020
Line 1:		Line 1:
	== ~~Summary~~ ==		== Description ==
	Bluetooth Impersonation AttackS (BIAS) was found 2020 by Daniele Antonioli, Nils Ole Tippenhauer and Kasper B. Rasmussen.		Bluetooth Impersonation AttackS (BIAS) was found 2020 by Daniele Antonioli, Nils Ole Tippenhauer and Kasper B. Rasmussen.
	The Bluetooth specification includes authentication mechanisms based on long term pairing key, which are created to protect against impersonation attacks. This attack shows that this mechanisms are not reliable and that an attacker can use the mechanisms to impersonate any master or slave device.		The Bluetooth specification includes authentication mechanisms based on long term pairing key, which are created to protect against impersonation attacks. This attack shows that this mechanisms are not reliable and that an attacker can use the mechanisms to impersonate any master or slave device.

SVeseli: Created page with "== Summary == Bluetooth Impersonation AttackS (BIAS) was found 2020 by Daniele Antonioli, Nils Ole Tippenhauer and Kasper B. Rasmussen. The Bluetooth specification includes a..."

2020-12-21T19:08:44Z

Created page with "== Summary == Bluetooth Impersonation AttackS (BIAS) was found 2020 by Daniele Antonioli, Nils Ole Tippenhauer and Kasper B. Rasmussen. The Bluetooth specification includes a..."

New page

== Summary ==
Bluetooth Impersonation AttackS (BIAS) was found 2020 by Daniele Antonioli, Nils Ole Tippenhauer and Kasper B. Rasmussen.
The Bluetooth specification includes authentication mechanisms based on long term pairing key, which are created to protect against impersonation attacks. This attack shows that this mechanisms are not reliable and that an attacker can use the mechanisms to impersonate any master or slave device.

== Example ==
* Victims Alice & Bob share a long term key and support mutual authentication
*Attacker Charlie presents to Bob as Alice and downgrades mutual authentication to unilateral authentication.
* Abuses Bluetooth role switching to become the new authenticator. Authenticates bob and starts a secure session with Bob as Alice without having to authenticate.

== Requirements ==

* Clone Github https://github.com/francozappa/bias
* CYW920819 devboard
* Google Pixel 2
* Linux laptop that can parse diagnostic messages from CYW920819 devboard & run internalblue. Can be accomplished by using vanilla linux-4.14.111 kernel compiled with provided modifications of github.

== Perform Attack ==
* Open '''IF_PIXEL2''' File
** Change the '''btadd''' to the Bluetooth address of the impersonated device
** Change the '''btname''' to the Bluetooth name of the impersonated device
** Change lmin and lmax to set the max and min entropy value for the session key
* Connect the devboard to laptop via USB
* Attach to the devboard with '''btattach -B /dev/ttyUSB1 -S 115200 &'''
* Enable the devboard diagnostic mode with '''sudo python2 enable_diag.py'''
* Start internalblue with '''sudo internalblue'''
* Start wireshark monitoring from internalblue
* Use '''make generate''' to create '''bias.py'''
* Pair the impersonated victim (Pixel 2) and the other victim device
* Disconnect them and disable Bluetooth on the impersonated device (Pixel 2)
* Start a connection from the victim to the impersonated device (BIAS slave impersonation)
* Start a connection from the attack device to the victim (BIAS master impersonation)

== Counter Measures ==
To reduce the lack of integrity protection during secure connection establishment, the standard should force to use the long term key to protect the connection establishment. Before creating a secure connection the long term key should be available. The standard should force to always use the legacy authentication procedure mutually.
== References ==

* https://francozappa.github.io/publication/bias/paper.pdf
* https://github.com/francozappa/bias
* https://francozappa.github.io/about-bias/
* https://www.youtube.com/watch?v=fASGU7Og5_4&feature=emb_title

[[Category:Documentation]]